Linux Analysis Report
https://airmarkcomponents.com/

Overview

General Information

Sample URL: https://airmarkcomponents.com/
Analysis ID: 1501760
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false

Signatures

Creates hidden files and/or directories
Creates hidden files without content (potentially used as a mutex)
Queries the installed Ubuntu/CentOS release
Reads the 'hosts' file potentially containing internal network hosts
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.20:58566 version: TLS 1.2
Reads the 'hosts' file potentially containing internal network hosts
Source: /usr/lib/firefox/firefox (PID: 4749) Reads hosts file: /etc/hosts Jump to behavior
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: airmarkcomponents.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic HTTP traffic detected: GET /6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/ HTTP/1.1Host: snippets.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /?pl=CHiI7Gh3GUyTa8XGgNqDyQ&click_id=cr8q51ijvq38mvmg0730 HTTP/1.1Host: qltuh.algiedideneb.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic HTTP traffic detected: GET /space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&nrid=de31d1cd52d74e28bde7668b9e540ce5&hash=s38RJoCM1jVSTvs8F6cz6w&exp=1725014963 HTTP/1.1Host: qltuh.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic HTTP traffic detected: GET /us-west/bundles-pregen/Firefox/en-us/default.json HTTP/1.1Host: snippets.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /space-robot/assets/trls.js HTTP/1.1Host: qltuh.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://qltuh.check-tl-ver-108-a.com/space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&nrid=de31d1cd52d74e28bde7668b9e540ce5&hash=s38RJoCM1jVSTvs8F6cz6w&exp=1725014963Connection: keep-alive
Source: global traffic HTTP traffic detected: GET /space-robot/assets/style.css?v=5 HTTP/1.1Host: qltuh.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/css,*/*;q=0.1Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://qltuh.check-tl-ver-108-a.com/space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&nrid=de31d1cd52d74e28bde7668b9e540ce5&hash=s38RJoCM1jVSTvs8F6cz6w&exp=1725014963Connection: keep-alive
Source: global traffic HTTP traffic detected: GET /space-robot/assets/main.js?v=3 HTTP/1.1Host: qltuh.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://qltuh.check-tl-ver-108-a.com/space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&nrid=de31d1cd52d74e28bde7668b9e540ce5&hash=s38RJoCM1jVSTvs8F6cz6w&exp=1725014963Connection: keep-alive
Source: global traffic HTTP traffic detected: GET /shared-js/assets/static-pl.js?v=4 HTTP/1.1Host: qltuh.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://qltuh.check-tl-ver-108-a.com/space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&nrid=de31d1cd52d74e28bde7668b9e540ce5&hash=s38RJoCM1jVSTvs8F6cz6w&exp=1725014963Connection: keep-alive
Source: global traffic HTTP traffic detected: GET /space-robot/assets/corner.png HTTP/1.1Host: qltuh.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: image/webp,*/*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://qltuh.check-tl-ver-108-a.com/space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&nrid=de31d1cd52d74e28bde7668b9e540ce5&hash=s38RJoCM1jVSTvs8F6cz6w&exp=1725014963Connection: keep-alive
Source: global traffic HTTP traffic detected: GET /ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&sub_id=&appspot=&d=https%3A%2F%2Fcdnstatic.check-tl-ver-108-a.com&timeout=180&tb=true&nrid=de31d1cd52d74e28bde7668b9e540ce5 HTTP/1.1Host: cdnstatic.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://qltuh.check-tl-ver-108-a.com/space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&nrid=de31d1cd52d74e28bde7668b9e540ce5&hash=s38RJoCM1jVSTvs8F6cz6w&exp=1725014963Connection: keep-alive
Source: global traffic HTTP traffic detected: GET /space-robot/assets/apple-touch-icon.png HTTP/1.1Host: qltuh.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: image/webp,*/*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /space-robot/assets/favicon-16x16.png HTTP/1.1Host: qltuh.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: image/webp,*/*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /ps/config.js?id=CHiI7Gh3GUyTa8XGgNqDyQ HTTP/1.1Host: cdnstatic.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://qltuh.check-tl-ver-108-a.com/space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&nrid=de31d1cd52d74e28bde7668b9e540ce5&hash=s38RJoCM1jVSTvs8F6cz6w&exp=1725014963Connection: keep-aliveCookie: __psu=5bae6dc6-cff2-4d35-8c46-e4e147c7e338
Source: global traffic HTTP traffic detected: GET /sw-707a7d0735647f53a9228ce50d13ab46.js HTTP/1.1Host: qltuh.check-tl-ver-108-a.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brService-Worker: scriptConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /update/3/GMP/66.0.3/20190410113011/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/update.xml HTTP/1.1Host: aus5.mozilla.orgUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: c6kBy8Q962evQN09480c7A==Connection: keep-alive, UpgradePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: m+gHMIH+bM+IXrbp144tUg==Connection: keep-alive, UpgradePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: gzH4mgj0m04q25/HFLUzOQ==Connection: keep-alive, UpgradePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: 2m+e3cL0QOajGC13MGedSQ==Connection: keep-alive, UpgradePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: mG0Ahy8ERvDWimCnq72XWQ==Connection: keep-alive, UpgradePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic DNS traffic detected: DNS query: airmarkcomponents.com
Source: global traffic DNS traffic detected: DNS query: qltuh.algiedideneb.com
Source: global traffic DNS traffic detected: DNS query: qltuh.check-tl-ver-108-a.com
Source: global traffic DNS traffic detected: DNS query: cdnstatic.check-tl-ver-108-a.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: places.sqlite-wal.34.dr String found in binary or memory: http://wiki.ubuntu.com
Source: places.sqlite-wal.34.dr String found in binary or memory: http://wiki.ubuntu.com/moc.utnubu.ikiw.
Source: places.sqlite-wal.34.dr String found in binary or memory: http://www.debian.org
Source: places.sqlite-wal.34.dr String found in binary or memory: http://www.debian.org/gro.naibed.www.
Source: places.sqlite-wal.34.dr String found in binary or memory: http://www.ubuntu.com
Source: places.sqlite-wal.34.dr String found in binary or memory: http://www.ubuntu.com/moc.utnubu.www.
Source: places.sqlite-wal.34.dr String found in binary or memory: https://airmarkcomponents.com
Source: 3A2B697F1FDA5E8CED55FE586EBC2F5D11E0E55F.34.dr, F044322FA5BF290DD59313620194059BDC3D6C98.34.dr String found in binary or memory: https://airmarkcomponents.com/
Source: places.sqlite-wal.34.dr String found in binary or memory: https://airmarkcomponents.com/moc.stnenopmockramria.
Source: F044322FA5BF290DD59313620194059BDC3D6C98.34.dr String found in binary or memory: https://airmarkcomponents.com/predictor::seen1
Source: places.sqlite-wal.34.dr String found in binary or memory: https://answers.launchpad.net
Source: places.sqlite-wal.34.dr String found in binary or memory: https://answers.launchpad.net/ubuntu/
Source: 3D18B3B7E73CB9205101A761EB49BAE007D291B0.34.dr String found in binary or memory: https://cdnstatic.check-tl-ver-108-a.com/ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=
Source: 8F43299B2BBC180803AAE2295F17077D2C87FC5E.34.dr, 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff21
Source: webext.sc.lz4.tmp.34.dr String found in binary or memory: https://github.com/
Source: 3E1FE883C0FA3898B65C0D6FADBA039F7902FAF2.34.dr String found in binary or memory: https://js.streampsh.top
Source: 3E1FE883C0FA3898B65C0D6FADBA039F7902FAF2.34.dr String found in binary or memory: https://mbtrk1.com/click.php?key=7ef1qd1lvftdju4n985s&tracker=pushlink-placeholder-
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: https://pki.goog/repository/0
Source: places.sqlite-wal.34.dr String found in binary or memory: https://qltuh.algiedideneb.com
Source: 3A2B697F1FDA5E8CED55FE586EBC2F5D11E0E55F.34.dr String found in binary or memory: https://qltuh.algiedideneb.com/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&click_id=cr8q51ijvq38mvmg0730
Source: places.sqlite-wal.34.dr String found in binary or memory: https://qltuh.algiedideneb.com/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&click_id=cr8q51ijvq38mvmg0730moc.benedidei
Source: places.sqlite-wal.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com
Source: places.sqlite-wal.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com($
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr, 3E1FE883C0FA3898B65C0D6FADBA039F7902FAF2.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/shared-js/assets/static-pl.js?v=4
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/shared-js/assets/static-pl.js?v=41
Source: places.sqlite-wal.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr, FECDC94F0E7BAF8E66A29D10078DC7C9E82E2A2B.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/space-robot/assets/corner.png
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/space-robot/assets/corner.png1
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr, A9DB122571F6E7BBF5B17F0B73306BED943AF492.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/space-robot/assets/main.js?v=3
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/space-robot/assets/main.js?v=31
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr, 3897E273C86B69E7EC90C667F04ACC4F68CD01F9.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/space-robot/assets/style.css?v=5
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/space-robot/assets/style.css?v=51
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr, A32D31641179C3E5616066431ABEF74C58BB525A.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/space-robot/assets/trls.js
Source: 3FE38C9C3C92A20A0349E3495766F11D3CA2EC60.34.dr String found in binary or memory: https://qltuh.check-tl-ver-108-a.com/space-robot/assets/trls.js1
Source: 4098689E1EA45FF0094F1C8088E49251FFFF7585.34.dr String found in binary or memory: https://snippets.cdn.mozilla.net/6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck
Source: C389DE279BF5275924497D5B33D1F1900116E591.34.dr, 4098689E1EA45FF0094F1C8088E49251FFFF7585.34.dr String found in binary or memory: https://snippets.cdn.mozilla.net/us-west/bundles-pregen/Firefox/en-us/default.json
Source: places.sqlite-wal.34.dr String found in binary or memory: https://support.mozilla.org
Source: places.sqlite-wal.34.dr String found in binary or memory: https://support.mozilla.org/en-US/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire
Source: places.sqlite-wal.34.dr String found in binary or memory: https://support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/en-US/about/gro.allizom.www.
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/en-US/contribute/gro.allizom.www.
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/en-US/firefox/central/gro.allizom.www.
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 44884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 44886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 44870
Source: unknown Network traffic detected: HTTP traffic on port 44878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 44876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 44894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 35930
Source: unknown Network traffic detected: HTTP traffic on port 44874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 35930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 37696 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 33986 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33980
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58566
Source: unknown Network traffic detected: HTTP traffic on port 35928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 33984 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 39214 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 44868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 44868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 44884
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 44886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 43830
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 35928
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33986
Source: unknown Network traffic detected: HTTP traffic on port 33980 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 44870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 37696
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33984
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39214
Source: unknown Network traffic detected: HTTP traffic on port 44872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 39208 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39208
Source: unknown Network traffic detected: HTTP traffic on port 43828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 43828
Source: unknown Network traffic detected: HTTP traffic on port 43826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 43830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 43824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 43826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 44876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 43820
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 44878
Source: unknown Network traffic detected: HTTP traffic on port 43824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 44872
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 44894
Source: unknown Network traffic detected: HTTP traffic on port 43820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 44874
Source: unknown Network traffic detected: HTTP traffic on port 58566 -> 443
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.20:58566 version: TLS 1.2
Source: classification engine Classification label: clean2.lin@0/73@26/0
Creates hidden files and/or directories
Source: /usr/bin/exo-open (PID: 4734) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/bin/exo-open (PID: 4734) Directory: /home/james/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4742) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4742) Directory: /home/james/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4742) Directory: /home/james/.local Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4742) Directory: /home/james/.config Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) File: /tmp/firefox_james/.parentlock Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) File: /home/james/.mozilla/firefox/5zxot757.default/.parentlock Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) File: /home/james/.cache/mozilla/firefox/5zxot757.default/.startup-incomplete Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Directory: /home/james/.Xdefaults-ubuntu Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Directory: /home/james/.mime.types Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Directory: /home/james/.mozilla/firefox/5zxot757.default/storage/permanent/chrome/.metadata-v2 Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Directory: /home/james/.mailcap Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) File: /home/james/.mozilla/firefox/5zxot757.default/storage/default/https+++qltuh.check-tl-ver-108-a.com/.metadata-tmp Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) File: /home/james/.mozilla/firefox/5zxot757.default/storage/default/https+++qltuh.check-tl-ver-108-a.com/.metadata-v2-tmp Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) File: /home/james/.mozilla/firefox/5zxot757.default/storage/default/https+++qltuh.check-tl-ver-108-a.com/cache/.padding Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Directory: /home/james/.cache Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4777) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4777) Directory: /home/james/.drirc Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4811) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4887) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4963) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 5001) Directory: /home/james/.Xauthority Jump to behavior
Creates hidden files without content (potentially used as a mutex)
Source: /usr/lib/firefox/firefox (PID: 4749) Empty hidden file: /tmp/firefox_james/.parentlock Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Empty hidden file: /home/james/.cache/mozilla/firefox/5zxot757.default/.startup-incomplete Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Empty hidden file: /home/james/.mozilla/firefox/5zxot757.default/.parentlock Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Empty hidden file: /home/james/.mozilla/firefox/5zxot757.default/storage/default/https+++qltuh.check-tl-ver-108-a.com/cache/.padding Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Empty hidden file: /home/james/.mozilla/firefox/5zxot757.default/storage/default/https+++qltuh.check-tl-ver-108-a.com/.metadata-tmp Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Empty hidden file: /home/james/.mozilla/firefox/5zxot757.default/storage/default/https+++qltuh.check-tl-ver-108-a.com/.metadata-v2-tmp Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /usr/bin/exo-open (PID: 4734) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4742) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4749) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4777) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4811) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4887) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4963) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 5001) Queries kernel information via 'uname': Jump to behavior
Queries the installed Ubuntu/CentOS release
Source: /usr/lib/firefox/firefox (PID: 4791) Arguments: /usr/bin/lsb_release -> /usr/bin/python3 -Es /usr/bin/lsb_release -idrc Jump to behavior
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
104.21.22.55
 qltuh.algiedideneb.com United States
13335 CLOUDFLARENETUS false
188.114.97.3
 qltuh.check-tl-ver-108-a.com European Union
13335 CLOUDFLARENETUS false
188.114.96.3
 cdnstatic.check-tl-ver-108-a.com European Union
13335 CLOUDFLARENETUS false
18.165.183.111
 d228z91au11ukj.cloudfront.net United States
3 MIT-GATEWAYSUS false
3.224.72.48
 airmarkcomponents.com United States
14618 AMAZON-AESUS false
34.107.243.93
 push.services.mozilla.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
airmarkcomponents.com 3.224.72.48 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
cdnstatic.check-tl-ver-108-a.com 188.114.96.3 true
push.services.mozilla.com 34.107.243.93 true
d228z91au11ukj.cloudfront.net 18.165.183.111 true
qltuh.check-tl-ver-108-a.com 188.114.97.3 true
qltuh.algiedideneb.com 104.21.22.55 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://qltuh.algiedideneb.com/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&click_id=cr8q51ijvq38mvmg0730 false
  • Avira URL Cloud: safe
 unknown
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/apple-touch-icon.png false
  • Avira URL Cloud: safe
 unknown
https://qltuh.check-tl-ver-108-a.com/sw-707a7d0735647f53a9228ce50d13ab46.js false
  • Avira URL Cloud: safe
 unknown
https://airmarkcomponents.com/ false
    		unknown
    https://qltuh.check-tl-ver-108-a.com/space-robot/assets/favicon-16x16.png false
    • Avira URL Cloud: safe
    		 unknown
    https://push.services.mozilla.com/ false
    • URL Reputation: safe
    		 unknown
    https://cdnstatic.check-tl-ver-108-a.com/ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&sub_id=&appspot=&d=https%3A%2F%2Fcdnstatic.check-tl-ver-108-a.com&timeout=180&tb=true&nrid=de31d1cd52d74e28bde7668b9e540ce5 false
    • Avira URL Cloud: safe
    		 unknown
    https://qltuh.check-tl-ver-108-a.com/space-robot/assets/style.css?v=5 false
    • Avira URL Cloud: safe
    		 unknown
    https://qltuh.check-tl-ver-108-a.com/space-robot/assets/corner.png false
    • Avira URL Cloud: safe
    		 unknown
    https://cdnstatic.check-tl-ver-108-a.com/ps/config.js?id=CHiI7Gh3GUyTa8XGgNqDyQ false
    • Avira URL Cloud: safe
    		 unknown
    https://qltuh.check-tl-ver-108-a.com/space-robot/assets/trls.js false
    • Avira URL Cloud: safe
    		 unknown
    https://qltuh.check-tl-ver-108-a.com/shared-js/assets/static-pl.js?v=4 false
    • Avira URL Cloud: safe
    		 unknown
    https://qltuh.check-tl-ver-108-a.com/space-robot/assets/main.js?v=3 false
    • Avira URL Cloud: safe
    		 unknown