Analysis
-
max time kernel
0s -
max time network
50s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
02-07-2024 11:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sc.link/Faqyp
Resource
win10v2004-20240508-en
6 signatures
600 seconds
Behavioral task
behavioral2
Sample
https://sc.link/Faqyp
Resource
ubuntu2204-amd64-20240522.1-en
2 signatures
600 seconds
General
-
Target
https://sc.link/Faqyp
Score
3/10
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
dbus-daemondescription ioc process File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon -
Reads runtime system information 27 IoCs
Reads data from /proc virtual filesystem.
Processes:
grepdbus-daemonsedgrepsedgrepgrepdbus-sendgrepgrepgrepgrepseddbus-sendsedgrepgrepgrepgrepsedgrepdescription ioc process File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/1564/attr/apparmor/current dbus-daemon File opened for reading /proc/1559/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/1564/status dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/1586/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/self/maps grep
Processes
-
/usr/bin/xdg-openxdg-open https://sc.link/Faqyp1⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
-
/usr/bin/xpropxprop -root2⤵
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
-
/usr/bin/unameuname2⤵
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
-
/usr/bin/xpropxprop -root3⤵
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
-
/usr/bin/unameuname3⤵
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/whichwhich firefox2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/firefox/usr/bin/firefox https://sc.link/Faqyp2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/root/.dbus/session-bus/f2de92a803c744e586bd87567a26b68a-0Filesize
465B
MD5ea959f8cf670a824543202970309dca5
SHA11b75de65bc2bc08f03f8bcf4d6ec226299e56bde
SHA256f6c2f56fcd5b2a46178605292959351e46c8c2359db01a209fdf817e4aae82e3
SHA51290968619874857520b6e6c71ec8ad12dd8420482181ac18d9de5e4a4bb72a7376489bfc20f926e52fdfcf5fd5ed293e29ead0e83dcf06729f67e1c3de51902c3