URL: | https://url10.mailanyone.net/scanner?m=1s83rc-0000LK-6P&d=4%7Cmail%2F90%2F1715976000%2F1s83rc-0000LK-6P%7Cin10h%7C57e1b682%7C12862802%7C10019077%7C6647B908E32A44FF352F85E2C61BD30F&o=%2Fphta%3A%2Frtsaipadslnv.%2F.owlomPec%2F0TMR&s=3DSRz2LNrQqySXTuJ7lmTQItJWI |
Full analysis: | https://app.any.run/tasks/a98f6397-7e45-48b9-999b-60152836d708 |
Verdict: | Malicious activity |
Analysis date: | May 20, 2024, 20:31:26 |
OS: | Ubuntu 22.04.2 |
MD5: | 11D344C86BCA4C30C578EB9DFA397D4C |
SHA1: | EE19B30C80E5A1E531B4C36E28B56EB7C5175F3C |
SHA256: | 1CD75A76F76A9BFDB970126287FDA11F67D99D5FB3E543F9FEA6EF405A228DAF |
SSDEEP: | 6:2Ua4Tl6ISMGPwye6BnA4s75RYxY7D28V7x0y:2UZHnGPwEnA44RT0y |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
6174 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://url10\.mailanyone\.net/scanner?m=1s83rc-0000LK-6P&d=4%7Cmail%2F90%2F1715976000%2F1s83rc-0000LK-6P%7Cin10h%7C57e1b682%7C12862802%7C10019077%7C6647B908E32A44FF352F85E2C61BD30F&o=%2Fphta%3A%2Frtsaipadslnv\.%2F\.owlomPec%2F0TMR&s=3DSRz2LNrQqySXTuJ7lmTQItJWI " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
6175 | sudo -iu user google-chrome https://url10.mailanyone.net/scanner?m=1s83rc-0000LK-6P | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN | ||||
6176 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://url10\.mailanyone\.net/scanner?m=1s83rc-0000LK-6P&d=4%7Cmail%2F90%2F1715976000%2F1s83rc-0000LK-6P%7Cin10h%7C57e1b682%7C12862802%7C10019077%7C6647B908E32A44FF352F85E2C61BD30F&o=%2Fphta%3A%2Frtsaipadslnv\.%2F\.owlomPec%2F0TMR&s=3DSRz2LNrQqySXTuJ7lmTQItJWI " | /usr/bin/dash | — | sh |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
6177 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://url10\.mailanyone\.net/scanner?m=1s83rc-0000LK-6P&d=4%7Cmail%2F90%2F1715976000%2F1s83rc-0000LK-6P%7Cin10h%7C57e1b682%7C12862802%7C10019077%7C6647B908E32A44FF352F85E2C61BD30F&o=%2Fphta%3A%2Frtsaipadslnv\.%2F\.owlomPec%2F0TMR&s=3DSRz2LNrQqySXTuJ7lmTQItJWI " | /usr/bin/dash | — | sh |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
6178 | /usr/bin/google-chrome https://url10.mailanyone.net/scanner?m=1s83rc-0000LK-6P | /opt/google/chrome/chrome | sudo | |
User: user Integrity Level: UNKNOWN | ||||
6179 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
6180 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
6181 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
6182 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
6183 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN |
PID | Process | Filename | Type | |
---|---|---|---|---|
6178 | chrome | /proc/6178/fd/63 | — | |
MD5:— | SHA256:— | |||
6178 | chrome | /dev/shm/.com.google.Chrome.G32NV7 | — | |
MD5:— | SHA256:— | |||
6178 | chrome | /dev/shm/.com.google.Chrome.Ku1SZO | — | |
MD5:— | SHA256:— | |||
6178 | chrome | /dev/shm/.com.google.Chrome.LEuehz | — | |
MD5:— | SHA256:— | |||
6178 | chrome | /dev/shm/.com.google.Chrome.C049yl | — | |
MD5:— | SHA256:— | |||
6178 | chrome | /dev/shm/.com.google.Chrome.CGyfp6 | — | |
MD5:— | SHA256:— | |||
6178 | chrome | /dev/shm/.com.google.Chrome.tvwuCL | — | |
MD5:— | SHA256:— | |||
6178 | chrome | /dev/shm/.com.google.Chrome.Ucm0j5 | — | |
MD5:— | SHA256:— | |||
6178 | chrome | /dev/shm/.com.google.Chrome.dOkLOS | — | |
MD5:— | SHA256:— | |||
6178 | chrome | /dev/shm/.com.google.Chrome.XhOjKj | — | |
MD5:— | SHA256:— |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
470 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 185.125.188.55:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
6178 | chrome | 239.255.255.250:1900 | — | — | — | unknown |
6223 | chrome | 64.233.167.84:443 | accounts.google.com | GOOGLE | US | unknown |
6223 | chrome | 142.250.185.227:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
6223 | chrome | 104.18.11.14:443 | url10.mailanyone.net | CLOUDFLARENET | — | unknown |
6223 | chrome | 142.250.185.163:443 | update.googleapis.com | GOOGLE | US | whitelisted |
6223 | chrome | 172.217.18.4:443 | www.google.com | — | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
api.snapcraft.io |
| unknown |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
url10.mailanyone.net |
| unknown |
url10.mailanyone.net.cdn.cloudflare.net |
| unknown |
131.100.168.192.in-addr.arpa |
| unknown |
update.googleapis.com |
| unknown |
www.google.com |
| whitelisted |
connectivity-check.ubuntu.com |
| unknown |
optimizationguide-pa.googleapis.com |
| whitelisted |