Malware analysis https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe Malicious activity

Add for printing

URL:	https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
Full analysis:	https://app.any.run/tasks/73d57f38-892a-43c7-9082-533ce511104b
Verdict:	Malicious activity
Analysis date:	October 06, 2024, 08:33:43
OS:	Ubuntu 22.04.2
Tags:	github maldoc-14 maldoc
MD5:	5AA8230B6818910BE4DD7A38F4FD2322
SHA1:	B57B48B0EEB3FD05A3F5E95586292DD3E7078CB8
SHA256:	3C1F7DFA76B79CAD4B13D065663190D8547CCAF1C6F37012C41A0DB0A88AD391
SSDEEP:	3:N8tEdJejSOpykOhuKIEHAz4kokA:2ubYSOcry+Az4Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Drops known malicious document
  - chrome (PID: 13915)
- Drops known malicious image
  - chrome (PID: 13915)
SUSPICIOUS
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 14294)
  - update-notifier (PID: 14322)
- Reads /proc/mounts (likely used to find writable filesystems)
  - pkexec (PID: 14324)
- Uses pkexec (likely to bypass security restrictions)
  - sh (PID: 14323)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

351

Monitored processes

133

Malicious processes

3

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
13909	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://github\.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker\.exe "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN
13910	sudo -iu user google-chrome https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN
13911	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
13912	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
13913	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
13914	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
13915	/usr/bin/google-chrome https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
13916	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13917	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13918	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

323

Text files

45

Unknown types

1

Dropped files

PID	Process	Filename		Type
13915	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
13915	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
13915	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
13915	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:—	SHA256:—
13915	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:—	SHA256:—
13915	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:—	SHA256:—
13915	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_3		vxd
		MD5:—	SHA256:—
13915	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_2		vxd
		MD5:—	SHA256:—
13915	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_0		vxd
		MD5:—	SHA256:—
13915	chrome	/home/user/.config/google-chrome/Default/History		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

17

TCP/UDP connections

67

DNS requests

71

Threats

2

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.98:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
13961	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pjnu5jyln4kujhcmwstuyyvyyu_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_linux_ace35m3jiw32bj5wzzow5nia7yta.crx3	unknown	—	—	whitelisted
13961	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gcmjkmgdlgnkkcocmoeiminaijmmjnii/1.3651711652892acf34795b2c7e4d401ed2274c20e952f65cf52deeeef5bbf9b5/1.cd1978742a4afdbaaa15bf712d5c90bef4144caa99024df98f6a9ad58043ae85/f57d48f2458d0a8d34ccc2077ca88da0d44e809d2acd717f10ab827dae45743b	unknown	—	—	whitelisted
13961	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aciueukdrxvb6khkx2mvifmvt57a_20240902.672363756.14/obedbbhbpmojnkanicioggnmelmoomoc_20240902.672363756.14_all_ENGB500000_pioxf2kb34f767sqbe3w4sspgi.crx3	unknown	—	—	whitelisted
13961	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/fy6gcuz7d35wpliekinea3enmi_468/lmelglejhemejginpboagddgdfbepgmp_468_all_ZZ_d4nfnzkgqvc2ngwyveswvfctoi.crx3	unknown	—	—	whitelisted
13961	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad4hpytkvfw66zgvp6ccf22mfbbq_2024.10.4.0/niikhdgajlphfehepabhhblakbdgeefj_2024.10.04.00_all_adwqxuuranzmeclphki5yktwfkaa.crx3	unknown	—	—	whitelisted
13961	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adn3tbb2pd3we3bgvlhz7kbeqlca_2024.9.30.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.09.30.01_all_acosqho7p2tdp4gkqv4e3ge37qna.crx3	unknown	—	—	whitelisted
13961	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrrdxnjcwfqghe5ldbmjjkfukca_1088/efniojlnjndmcbiieegkicadnoecjjef_1088_all_goahc2youlbog7nygjjmilyci4.crx3	unknown	—	—	whitelisted
13961	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/khaoiebndkojlmppeemjhbpbandiljpe/1.05399c5840405f4af2454470ceccaa3d097f07e271705cf37c1e5559ce793eeb/1.1471c6c104c7e11f08fd446f83dcdb396b1fef335f4e3c744007c2272064f538/44367e7bc13464ae48fa3a83edb9a1fc3258aa32540abba470d2ff291e5eaf0e	unknown	—	—	whitelisted
13961	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	212.102.56.178:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
—	—	91.189.91.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.97 91.189.91.97 185.125.190.18 185.125.190.49 185.125.190.17 91.189.91.49 91.189.91.98 185.125.190.96 185.125.190.48 91.189.91.48 91.189.91.96 185.125.190.98 2001:67c:1562::23 2620:2d:4002:1::197 2620:2d:4000:1::97 2620:2d:4000:1::2b 2620:2d:4000:1::96 2620:2d:4002:1::198 2620:2d:4000:1::98 2620:2d:4000:1::22 2620:2d:4000:1::2a 2620:2d:4000:1::23 2001:67c:1562::24 2620:2d:4002:1::196	whitelisted
google.com	172.217.18.110 2a00:1450:4001:82b::200e	whitelisted
odrs.gnome.org	212.102.56.178 169.150.255.181 195.181.170.18 37.19.194.80 195.181.175.41 169.150.255.183 207.211.211.26 2a02:6ea0:c700::19 2a02:6ea0:c700::101 2a02:6ea0:c700::112 2a02:6ea0:c700::11 2a02:6ea0:c700::107 2a02:6ea0:c700::21 2a02:6ea0:c700::18	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.59 185.125.188.55 185.125.188.54 2620:2d:4000:1010::42 2620:2d:4000:1010::2e6 2620:2d:4000:1010::6d 2620:2d:4000:1010::117	whitelisted
clientservices.googleapis.com	172.217.18.3	whitelisted
github.com	140.82.121.3	shared
safebrowsingohttpgateway.googleapis.com	142.250.186.42 142.250.184.202 142.250.184.234 142.250.185.202 142.250.186.138 142.250.185.234 172.217.16.202 142.250.186.106 142.250.185.170 216.58.212.170 142.250.186.170 216.58.206.42 142.250.181.234 172.217.18.10 142.250.74.202 142.250.186.74	whitelisted
accounts.google.com	64.233.166.84	whitelisted
safebrowsing.googleapis.com	142.250.186.138	whitelisted
github.githubassets.com	185.199.111.154 185.199.110.154 185.199.109.154 185.199.108.154	whitelisted

Threats

PID	Process	Class	Message
425	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub
425	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub

Add for printing

No debug info

General Info

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe

5AA8230B6818910BE4DD7A38F4FD2322

B57B48B0EEB3FD05A3F5E95586292DD3E7078CB8

3C1F7DFA76B79CAD4B13D065663190D8547CCAF1C6F37012C41A0DB0A88AD391

3:N8tEdJejSOpykOhuKIEHAz4kokA:2ubYSOcry+Az4Z

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Drops known malicious document

Drops known malicious image

SUSPICIOUS

Executes commands using command-line interpreter

Reads /proc/mounts (likely used to find writable filesystems)

Uses pkexec (likely to bypass security restrictions)

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings