IOC Report
https://airmarkcomponents.com/

loading gif

Files

File Path
Type
Category
Malicious
/home/james/.cache/dconf/user
very short file (no magic)
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/3897E273C86B69E7EC90C667F04ACC4F68CD01F9
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/3A2B697F1FDA5E8CED55FE586EBC2F5D11E0E55F
370 sysV executable not stripped
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/3D18B3B7E73CB9205101A761EB49BAE007D291B0
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/3E1FE883C0FA3898B65C0D6FADBA039F7902FAF2
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/3FE38C9C3C92A20A0349E3495766F11D3CA2EC60
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/4098689E1EA45FF0094F1C8088E49251FFFF7585
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/8F43299B2BBC180803AAE2295F17077D2C87FC5E
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/A32D31641179C3E5616066431ABEF74C58BB525A
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/A9DB122571F6E7BBF5B17F0B73306BED943AF492
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/C389DE279BF5275924497D5B33D1F1900116E591
JSON data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/F044322FA5BF290DD59313620194059BDC3D6C98
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/FECDC94F0E7BAF8E66A29D10078DC7C9E82E2A2B
PNG image data, 44 x 44, 8-bit colormap, non-interlaced
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple-1.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple-1.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-malware-simple-1.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-malware-simple.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-malware-simple.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-phish-simple-1.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-phish-simple.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-phish-simple.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-track-simple-1.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-track-simple.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-track-simple.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-trackwhite-simple-1.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-trackwhite-simple.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-trackwhite-simple.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-unwanted-simple-1.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-unwanted-simple.pset
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-unwanted-simple.sbstore
data
dropped
/home/james/.cache/mozilla/firefox/5zxot757.default/startupCache/webext.sc.lz4.tmp
data
dropped
/home/james/.mozilla/firefox/5zxot757.default/addonStartup.json.lz4.tmp
Mozilla lz4 compressed data, originally 1426 bytes
dropped
/home/james/.mozilla/firefox/5zxot757.default/cert9.db
SQLite 3.x database, last written using SQLite version 3026000, page size 32768, file counter 4, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 4
dropped
/home/james/.mozilla/firefox/5zxot757.default/cert9.db-journal
data
dropped
/home/james/.mozilla/firefox/5zxot757.default/cookies.sqlite-wal
SQLite Write-Ahead Log, version 3007000
dropped
/home/james/.mozilla/firefox/5zxot757.default/key4.db
SQLite 3.x database, last written using SQLite version 3026000, page size 32768, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
dropped
/home/james/.mozilla/firefox/5zxot757.default/key4.db-journal
data
dropped
/home/james/.mozilla/firefox/5zxot757.default/permissions.sqlite
SQLite 3.x database, user version 9, last written using SQLite version 3026000, page size 32768, file counter 5, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 5
dropped
/home/james/.mozilla/firefox/5zxot757.default/permissions.sqlite-journal
data
dropped
/home/james/.mozilla/firefox/5zxot757.default/places.sqlite-wal
SQLite Write-Ahead Log, version 3007000
dropped
/home/james/.mozilla/firefox/5zxot757.default/prefs-1.js
ASCII text, with very long lines (663)
dropped
/home/james/.mozilla/firefox/5zxot757.default/sessionCheckpoints.json.tmp
JSON data
dropped
/proc/4887/gid_map
ASCII text, with no line terminators
dropped
/proc/4887/setgroups
ASCII text, with no line terminators
dropped
/proc/4887/uid_map
ASCII text, with no line terminators
dropped
/proc/4963/gid_map
ASCII text, with no line terminators
dropped
/proc/4963/setgroups
ASCII text, with no line terminators
dropped
/proc/4963/uid_map
ASCII text, with no line terminators
dropped
/proc/5001/gid_map
ASCII text, with no line terminators
dropped
/proc/5001/setgroups
ASCII text, with no line terminators
dropped
/proc/5001/uid_map
ASCII text, with no line terminators
dropped
There are 64 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
/usr/bin/exo-open
exo-open https://airmarkcomponents.com/
/usr/bin/exo-open
-
/usr/bin/exo-open
-
/usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1
/usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 --launch WebBrowser https://airmarkcomponents.com/
/usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1
-
/usr/bin/sensible-browser
/bin/sh /usr/bin/sensible-browser https://airmarkcomponents.com/
/usr/bin/x-www-browser
/bin/sh /usr/bin/x-www-browser https://airmarkcomponents.com/
/usr/bin/x-www-browser
-
/usr/bin/which
/bin/sh /usr/bin/which /usr/bin/x-www-browser
/usr/lib/firefox/firefox
/usr/lib/firefox/firefox https://airmarkcomponents.com/
/usr/lib/firefox/firefox
-
/usr/lib/firefox/firefox
-
/usr/lib/firefox/firefox
-
/usr/bin/lsb_release
/usr/bin/python3 -Es /usr/bin/lsb_release -idrc
/usr/lib/firefox/firefox
-
/usr/bin/dbus-launch
dbus-launch --autolaunch=11ced2f07072c6ae389b731c5cc84014 --binary-syntax --close-stderr
/usr/lib/firefox/firefox
-
/usr/lib/firefox/firefox
-
/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4749 true tab
/usr/lib/firefox/firefox
-
/usr/lib/firefox/firefox
-
/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 6115 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4749 true tab
/usr/lib/firefox/firefox
-
/usr/lib/firefox/firefox
-
/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 6934 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4749 true tab
There are 15 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://airmarkcomponents.com/
http://www.debian.org
unknown
http://www.debian.org/gro.naibed.www.
unknown
https://qltuh.algiedideneb.com/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&click_id=cr8q51ijvq38mvmg0730
104.21.22.55
https://support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.
unknown
https://qltuh.check-tl-ver-108-a.com
unknown
http://www.ubuntu.com
unknown
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/apple-touch-icon.png
188.114.97.3
https://qltuh.check-tl-ver-108-a.com/sw-707a7d0735647f53a9228ce50d13ab46.js
188.114.97.3
https://airmarkcomponents.com/
3.224.72.48
http://wiki.ubuntu.com/moc.utnubu.ikiw.
unknown
https://mbtrk1.com/click.php?key=7ef1qd1lvftdju4n985s&tracker=pushlink-placeholder-
unknown
https://pki.goog/repository/0
unknown
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/favicon-16x16.png
188.114.97.3
https://push.services.mozilla.com/
34.107.243.93
https://answers.launchpad.net/ubuntu/
unknown
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/trls.js1
unknown
http://www.ubuntu.com/moc.utnubu.www.
unknown
https://cdnstatic.check-tl-ver-108-a.com/ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=cr8q51ijvq38mvmg0730&sub_id=&appspot=&d=https%3A%2F%2Fcdnstatic.check-tl-ver-108-a.com&timeout=180&tb=true&nrid=de31d1cd52d74e28bde7668b9e540ce5
188.114.96.3
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/style.css?v=5
188.114.97.3
https://js.streampsh.top
unknown
https://airmarkcomponents.com
unknown
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/main.js?v=31
unknown
https://airmarkcomponents.com/predictor::seen1
unknown
https://support.mozilla.org/en-US/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire
unknown
https://answers.launchpad.net
unknown
https://qltuh.check-tl-ver-108-a.com($
unknown
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/style.css?v=51
unknown
https://github.com/
unknown
https://qltuh.algiedideneb.com
unknown
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/corner.png
188.114.97.3
http://wiki.ubuntu.com
unknown
https://qltuh.check-tl-ver-108-a.com/shared-js/assets/static-pl.js?v=41
unknown
https://cdnstatic.check-tl-ver-108-a.com/ps/config.js?id=CHiI7Gh3GUyTa8XGgNqDyQ
188.114.96.3
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/trls.js
188.114.97.3
https://support.mozilla.org
unknown
http://crl.pki.goog/gsr2/gsr2.crl0?
unknown
https://qltuh.algiedideneb.com/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&click_id=cr8q51ijvq38mvmg0730moc.benedidei
unknown
https://airmarkcomponents.com/moc.stnenopmockramria.
unknown
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/corner.png1
unknown
https://qltuh.check-tl-ver-108-a.com/shared-js/assets/static-pl.js?v=4
188.114.97.3
https://qltuh.check-tl-ver-108-a.com/space-robot/assets/main.js?v=3
188.114.97.3
https://cdnstatic.check-tl-ver-108-a.com/ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=
unknown
https://qltuh.check-tl-ver-108-a.com/space-robot/?pl=CHiI7Gh3GUyTa8XGgNqDyQ&sm=space-robot&click_id=
unknown
There are 33 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
airmarkcomponents.com
3.224.72.48
prod.balrog.prod.cloudops.mozgcp.net
35.244.181.201
cdnstatic.check-tl-ver-108-a.com
188.114.96.3
push.services.mozilla.com
34.107.243.93
d228z91au11ukj.cloudfront.net
18.165.183.111
qltuh.check-tl-ver-108-a.com
188.114.97.3
qltuh.algiedideneb.com
104.21.22.55

IPs

IP
Domain
Country
Malicious
35.244.181.201
prod.balrog.prod.cloudops.mozgcp.net
United States
104.21.22.55
qltuh.algiedideneb.com
United States
188.114.97.3
qltuh.check-tl-ver-108-a.com
European Union
188.114.96.3
cdnstatic.check-tl-ver-108-a.com
European Union
18.165.183.111
d228z91au11ukj.cloudfront.net
United States
3.224.72.48
airmarkcomponents.com
United States
34.107.243.93
push.services.mozilla.com
United States