hxxps://www[.]mediafire[.]com/file/8h4qy1v3lxv1rii/Delta-2[.]741[.]1062_sign[.]apk/file

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_name	firefox-bin

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
401	raw.githubusercontent.com
402	raw.githubusercontent.com
403	raw.githubusercontent.com
404	raw.githubusercontent.com
400	raw.githubusercontent.com

Reads hardware information 1 TTPs 1 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_sku	firefox-bin

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	AsyncSi~lThread	1600	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gmain	1604	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool	1606	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gdbus	1607	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1608	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1610	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1610	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1610	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1611	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1611	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	1612	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1614	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1613	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1615	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	1612	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1613	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1614	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1615	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool	1616	firefox-bin
Changes the process name, possibly in an attempt to hide itself	dconf worker	1618	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1619	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1619	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1621	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1621	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1622	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1622	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1623	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1623	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	1624	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	1624	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1626	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1625	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1627	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1627	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1628	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1628	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1629	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1629	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1630	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1630	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gmain	1633	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	gdbus	1634	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	pool	1635	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	gmain	1638	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	gdbus	1639	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	gmain	1642	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	pool	1643	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	1644	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	1644	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	1644	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gdbus	1657	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	Glyph rasterize	1648	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WrGlyph~terizer	1648	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRSceneBuilder#	1649	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRScene~ilder#0	1649	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	1647	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	1647	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRSceneBuilderL	1650	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRScene~derLP#0	1650	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRRenderBackend	1651	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRRende~ckend#0	1651	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	1646	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	1646	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRSceneBuilder#	1652	firefox-bin

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

description	ioc	Process
File opened for reading	/proc/cpuinfo	gfxtest
File opened for reading	/proc/cpuinfo	firefox-bin

Reads CPU attributes 1 TTPs 9 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	gfxtest
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox-bin
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_cpus	firefox-bin
File opened for reading	/sys/devices/system/cpu/present	firefox-bin

Enumerates kernel/hardware configuration 1 TTPs 59 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	gfxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	gfxtest
File opened for reading	/sys/devices/system/cpu	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	gfxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	gfxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox-bin
File opened for reading	/sys/devices/system/cpu	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0	firefox-bin
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	gfxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	gfxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	gfxtest
File opened for reading	/sys/bus/pci/devices	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	gfxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	gfxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	gfxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	gfxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	gfxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	gfxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/cmdline	firefox-bin
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/self/task/1791/stat	firefox-bin
File opened for reading	/proc/mounts	xdg-desktop-portal
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/1665/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/136	firefox-bin
File opened for reading	/proc/self/fd/99	firefox-bin
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/self/fd/46	firefox-bin
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	at-spi-bus-launcher
File opened for reading	/proc/self/fd/122	firefox-bin
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/171	firefox-bin
File opened for reading	/proc/meminfo	firefox-bin
File opened for reading	/proc/1597/cmdline	dbus-daemon
File opened for reading	/proc/self/task/1826/stat	firefox-bin
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/1670/cmdline	dbus-daemon
File opened for reading	/proc/self/task/1803/stat	firefox-bin
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/1531/cmdline	dbus-daemon
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/fd/56	firefox-bin
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/1513/status	dbus-daemon
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/self/task/1808/stat	firefox-bin
File opened for reading	/proc/filesystems	gfxtest
File opened for reading	/proc/self/fd/45	firefox-bin
File opened for reading	/proc/self/fd	firefox-bin
File opened for reading	/proc/self/maps	crashreporter
File opened for reading	/proc/self/fd/69	firefox-bin
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/17	firefox-bin
File opened for reading	/proc/self/fd/87	firefox-bin
File opened for reading	/proc/self/task/1751/stat	firefox-bin
File opened for reading	/proc/1597/root	xdg-desktop-portal
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/self/task/1710/stat	firefox-bin
File opened for reading	/proc/pressure/memory	firefox-bin
File opened for reading	/proc/self/fd/156	firefox-bin
File opened for reading	/proc/self/fd	firefox-bin
File opened for reading	/proc/self/fd/39	firefox-bin
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/self/fd/41	firefox-bin
File opened for reading	/proc/self/task/1718/stat	firefox-bin
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/1513/attr/current	dbus-daemon
File opened for reading	/proc/1506/cmdline	dbus-daemon
File opened for reading	/proc/1675/cmdline	dbus-daemon
File opened for reading	/proc/self/task/1691/stat	firefox-bin
File opened for reading	/proc/1632/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/filesystems	crashreporter

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.97e77d3a16243694	firefox-bin
File opened for modification	/tmp/.97e77d3a16243694	firefox-bin
File opened for modification	/tmp/tmp-f4g.xpi	firefox-bin
File opened for modification	/tmp/tmpaddon	firefox-bin
File opened for modification	/tmp/ad8a06eb-2055-45d4-a4b6-77fbff8f96e0.zip.tmp	firefox-bin
File opened for modification	/tmp/2110a7bf-5d74-42ee-93a0-53edbd3ca0cc.zip.tmp	firefox-bin
File opened for modification	/tmp/firefox/.parentlock	firefox-bin

/usr/bin/xdg-open
xdg-open https://www.mediafire.com/file/8h4qy1v3lxv1rii/Delta-2.741.1062_sign.apk/file
1⤵
PID:1505
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  - Reads runtime system information
  PID:1506
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1507
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:1511
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Changes its process name
        Reads runtime system information
        
        PID:1632
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Changes its process name
        Reads runtime system information
        
        PID:1637
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        Changes its process name
        Reads runtime system information
        
        PID:1641
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        Reads runtime system information
        
        PID:1665
    - - /usr/lib/gvfs/gvfsd
        
        /usr/lib/gvfs/gvfsd
        5⤵
        Reads runtime system information
        
        PID:1670
    - - /usr/lib/at-spi2-core/at-spi-bus-launcher
        
        /usr/lib/at-spi2-core/at-spi-bus-launcher
        5⤵
        Reads runtime system information
        
        PID:1689
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1516
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1515
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1519
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1518
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1521
- /bin/uname
  uname
  2⤵
  PID:1522
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1524
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1526
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1526
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1526
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1526
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1526
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1526
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1526
- /bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:1529
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1530
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    - Reads runtime system information
    PID:1531
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1532
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1534
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1533
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1536
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1535
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1541
- - /bin/uname
    uname
    3⤵
    PID:1542
- - /bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:1545
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1548
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1549
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1550
- - /bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1547
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1555
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1554
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1553
- - /bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1552
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1558
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1560
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1559
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1557
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1565
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1564
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1563
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1562
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1570
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1569
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1568
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    PID:1567
- /bin/sed
  sed "s/:/ /g"
  2⤵
  - Reads runtime system information
  PID:1573
- /bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1576
- /bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1579
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1584
- /usr/bin/which
  which firefox
  2⤵
  PID:1585
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1588
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1591
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1596
- /usr/bin/firefox
  /usr/bin/firefox https://www.mediafire.com/file/8h4qy1v3lxv1rii/Delta-2.741.1062_sign.apk/file
  2⤵
  PID:1597
- /usr/lib/firefox/firefox-bin
  /usr/bin/firefox https://www.mediafire.com/file/8h4qy1v3lxv1rii/Delta-2.741.1062_sign.apk/file
  2⤵
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Changes its process name
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1597
- - /usr/lib/firefox/crashhelper
    /usr/lib/firefox/crashhelper 1597 9 /tmp/ 11 20261007201254
    3⤵
    PID:1601
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1605
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1605
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1605
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1605
- - /usr/lib/firefox/gfxtest
    /usr/lib/firefox/gfxtest glx -f 18
    3⤵
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1609
- - /usr/lib/firefox/firefox-bin
    /usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{5aafccaf-d50d-4de8-8cf9-281a34c81023}" -parentPid 1597 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1684
- - /usr/lib/firefox/crashreporter
    /usr/lib/firefox/crashreporter --ping-cleanup "/root/.config/mozilla/firefox/Crash Reports" /root/.config/mozilla/firefox/61ud20t4.default-release
    3⤵
    - Reads runtime system information
    PID:2091

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1675

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

Credential Access

Discovery

System Information Discovery

Virtualization/Sandbox Evasion

T1497

System Checks