| URL: | vesak.thulshy.info |
| Full analysis: | https://app.any.run/tasks/951e3514-4132-47fc-89e6-4884368c4a5d |
| Verdict: | Malicious activity |
| Analysis date: | May 15, 2025, 17:15:39 |
| OS: | Android 14 |
| Tags: | |
| Indicators: | |
| MD5: | 6883046B9B24057777CC6784DCC98B66 |
| SHA1: | E88E87C89C1A89CF81910021763EFE942DBE41F4 |
| SHA256: | 123B728987CDB42A4352EA8BE43E030841513A90446008BA31A651E179C045F5 |
| SSDEEP: | 3:XEOsrKW:X0KW |
MALICIOUS
PHISHING has been detected (SURICATA)
- netd (PID: 345)
SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
127
Monitored processes
5
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 345 | /system/bin/netd | /system/bin/netd | init | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2244 | org.chromium.webview_shell | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2272 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2284 | webview_zygote | /system/bin/app_process32 | — | app_process32 |
User: webview_zygote Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2322 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
44
DNS requests
28
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 142.250.186.35:80 | http://connectivitycheck.gstatic.com/generate_204 | unknown | — | — | whitelisted |
2244 | app_process64 | GET | 301 | 188.114.97.3:80 | http://vesak.thulshy.info/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
449 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 216.239.35.12:123 | time.android.com | — | — | whitelisted |
— | — | 142.250.185.68:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 142.250.186.35:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 142.251.31.81:443 | staging-remoteprovisioning.sandbox.googleapis.com | GOOGLE | US | whitelisted |
2322 | app_process32 | 142.250.186.35:443 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
2272 | app_process32 | 216.58.206.35:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
2244 | app_process64 | 188.114.97.3:80 | vesak.thulshy.info | CLOUDFLARENET | NL | unknown |
2322 | app_process32 | 216.58.206.46:443 | dl.google.com | GOOGLE | US | whitelisted |
2244 | app_process64 | 188.114.97.3:443 | vesak.thulshy.info | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
connectivitycheck.gstatic.com |
| whitelisted |
www.google.com |
| whitelisted |
google.com |
| whitelisted |
time.android.com |
| whitelisted |
staging-remoteprovisioning.sandbox.googleapis.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
vesak.thulshy.info |
| unknown |
dl.google.com |
| whitelisted |
pagead2.googlesyndication.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |
345 | netd | Not Suspicious Traffic | INFO [ANY.RUN] Image Sharing Service (imgur.com) |
345 | netd | Potentially Bad Traffic | ET DNS Query for .cc TLD |
345 | netd | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
345 | netd | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
345 | netd | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain (waust .at) |
345 | netd | Misc activity | ET TA_ABUSED_SERVICES Observed DNS Query to Real-time Web Stats Domain (whos .amung .us) |
2244 | app_process64 | Misc activity | ET TA_ABUSED_SERVICES Observed Real-time Web Stats Domain (whos .amung .us in TLS SNI) |