Malware analysis 139.45.197.153 Malicious activity | ANY.RUN

Add for printing

URL:	139.45.197.153
Full analysis:	https://app.any.run/tasks/50d30c2e-7d83-4dd2-9219-58a580080bef
Verdict:	Malicious activity
Analysis date:	July 31, 2024, 10:25:30
OS:	Ubuntu 22.04.2
Tags:	smb
Indicators:
MD5:	0C6A0DA3CB6FF814218FDA492EC1140E
SHA1:	6C951D6A5E64FF32C572B01938C7D639551A1DFF
SHA256:	54446908DBB109BD3F1AF55F059B8A2919B0D35B4599BA593EA8EE788D61DC23
SSDEEP:	3:P7Lnn:jrn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Attempt to connect to SMB server
  - nmap (PID: 13523)
SUSPICIOUS
- Executes the "rm" command to delete files or directories
  - dpkg (PID: 13377)
  - update-motd-updates-available (PID: 13451)
- Executes commands using command-line interpreter
  - apt (PID: 13274)
  - dpkg-preconfigure (PID: 13362)
  - gnome-terminal-server (PID: 13213)
  - apt (PID: 13445)
  - update-notifier (PID: 13509)
- Changes time attribute to hide new files or make changes to the existing one
  - sh (PID: 13449)
- Uses base64 (probably to encode stolen data or decode malicious payload)
  - nmap-common.postinst (PID: 13434)
- Connects to SMTP port
  - nmap (PID: 13523)
- Connects to SSH
  - nmap (PID: 13523)
- Connects to FTP
  - nmap (PID: 13523)
- Potential Corporate Privacy Violation
  - nmap (PID: 13523)
- Reads /proc/mounts (likely used to find writable filesystems)
  - check-new-release-gtk (PID: 13511)
- Connects to unusual port
  - nmap (PID: 13523)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

449

Monitored processes

235

Malicious processes

3

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
12924	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome 139\.45\.197\.153 "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN
12925	sudo -iu user google-chrome 139.45.197.153	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN
12926	/usr/bin/google-chrome 139.45.197.153	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
12927	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12928	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12929	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12930	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12931	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
12932	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
12933		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

9

Suspicious files

110

Text files

667

Unknown types

0

Dropped files

PID	Process	Filename		Type
13362	dpkg-preconfigure	/var/cache/debconf/config.dat		text
		MD5:—	SHA256:—
13362	dpkg-preconfigure	/var/cache/debconf/templates.dat		text
		MD5:—	SHA256:—
12926	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
12926	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
12926	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
12926	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		binary
		MD5:—	SHA256:—
12926	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		binary
		MD5:—	SHA256:—
12926	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		binary
		MD5:—	SHA256:—
12926	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_3		binary
		MD5:—	SHA256:—
12926	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_2		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

43

TCP/UDP connections

44 376

DNS requests

62

Threats

6

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	404	139.45.197.153:80	http://139.45.197.153/	unknown	—	—	unknown
—	—	GET	403	139.45.197.153:80	http://139.45.197.153/favicon.ico	unknown	—	—	unknown
—	—	GET	403	139.45.197.153:80	http://139.45.197.153/favicon.ico	unknown	—	—	unknown
—	—	GET	403	139.45.197.153:80	http://139.45.197.153/robots.txt	unknown	—	—	unknown
—	—	GET	403	139.45.197.153:80	http://139.45.197.153/awidgwa	unknown	—	—	unknown
—	—	GET	403	139.45.197.153:80	http://139.45.197.153/feeds	unknown	—	—	unknown
—	—	GET	403	139.45.197.153:80	http://139.45.197.153/favicon.ico	unknown	—	—	unknown
—	—	GET	204	172.217.18.3:80	http://www.gstatic.com/generate_204	unknown	—	—	whitelisted
—	—	GET	403	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrnpn4oqndirc4e4znryad25caa_2024.7.25.0/niikhdgajlphfehepabhhblakbdgeefj_2024.07.25.00_all_ac77hp7ujdfagzpwcjuouk7ix2wa.crx3	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.18:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	212.102.56.181:443	odrs.gnome.org	Datacamp Limited	DE	unknown
—	—	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
485	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	malicious
485	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	66.102.1.84:443	accounts.google.com	GOOGLE	US	unknown
—	—	142.250.185.195:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
12926	chrome	239.255.255.250:1900	—	—	—	whitelisted

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.18 185.125.190.48 91.189.91.98 91.189.91.49 185.125.190.97 185.125.190.96 185.125.190.17 91.189.91.97 91.189.91.48 185.125.190.98 91.189.91.96 185.125.190.49 2620:2d:4000:1::23 2001:67c:1562::23 2620:2d:4000:1::98 2620:2d:4000:1::96 2001:67c:1562::24 2620:2d:4000:1::22 2620:2d:4000:1::2b 2620:2d:4002:1::197 2620:2d:4000:1::2a 2620:2d:4000:1::97 2620:2d:4002:1::196 2620:2d:4002:1::198	whitelisted
google.com	142.250.184.206 2a00:1450:4001:828::200e	whitelisted
odrs.gnome.org	212.102.56.181 138.199.37.40 138.199.37.38 212.102.56.178 138.199.37.35 195.181.170.19 195.181.175.40 156.146.33.138 2a02:6ea0:c700::112 2a02:6ea0:c700::21 2a02:6ea0:c700::17 2a02:6ea0:c700::18 2a02:6ea0:c700::19 2a02:6ea0:c700::101 2a02:6ea0:c700::11 2a02:6ea0:c700::107	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.59 185.125.188.58 185.125.188.54	whitelisted
accounts.google.com	66.102.1.84	whitelisted
clientservices.googleapis.com	142.250.185.195	whitelisted
safebrowsingohttpgateway.googleapis.com	142.250.186.42 172.217.18.106 142.250.184.234 142.250.185.138 142.250.181.234 142.250.186.138 172.217.16.202 142.250.186.74 216.58.206.74 142.250.74.202 172.217.18.10 142.250.186.170 142.250.186.106 142.250.185.74 172.217.23.106 142.250.184.202	whitelisted
google-ohttp-relay-safebrowsing.fastly-edge.com	151.101.1.91 151.101.193.91 151.101.129.91 151.101.65.91	unknown
update.googleapis.com	142.250.186.35	whitelisted
www.google.com	142.250.185.68 142.250.184.196	whitelisted

Threats

PID	Process	Class	Message
13328	http	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
13328	http	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
13328	http	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
13328	http	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
13328	http	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
13523	nmap	Potential Corporate Privacy Violation	POLICY [ANY.RUN] Attempt to connect to an external SMB server

Add for printing

No debug info

General Info

139.45.197.153

0C6A0DA3CB6FF814218FDA492EC1140E

6C951D6A5E64FF32C572B01938C7D639551A1DFF

54446908DBB109BD3F1AF55F059B8A2919B0D35B4599BA593EA8EE788D61DC23

3:P7Lnn:jrn

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Attempt to connect to SMB server

SUSPICIOUS

Executes the "rm" command to delete files or directories

Executes commands using command-line interpreter

Changes time attribute to hide new files or make changes to the existing one

Uses base64 (probably to encode stolen data or decode malicious payload)

Connects to SMTP port

Connects to SSH

Connects to FTP

Potential Corporate Privacy Violation

Reads /proc/mounts (likely used to find writable filesystems)

Connects to unusual port

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings