URL: | betacraft.uk |
Full analysis: | https://app.any.run/tasks/bb302bb6-e64f-4361-a13e-e75824b92ca9 |
Verdict: | Malicious activity |
Analysis date: | February 11, 2024, 06:47:16 |
OS: | Ubuntu 22.04.2 |
MD5: | ECF4EB55A7D8B33D833E099A8F1B0C09 |
SHA1: | AE6D7D08EB1A87BAA4AFBEF579ED1C5EF1BE5AE1 |
SHA256: | 64D967770AC53F9030C6277CAE6FF602034E2BFF59A08CDD59BD08EE2C65B910 |
SSDEEP: | 3:EXqtQOn:EXlOn |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
7935 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome \"betacraft\.uk\" " | /bin/sh | — | any-guest-agent |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
7936 | sudo -iu user google-chrome betacraft.uk | /usr/bin/sudo | — | sh |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
7937 | /usr/bin/google-chrome betacraft.uk | /opt/google/chrome/chrome | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
7938 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
7939 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
7940 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
7941 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
7942 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
7943 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
7944 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
7937 | chrome | /7937/fd/63 | — | |
MD5:— | SHA256:— | |||
7937 | chrome | /home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-65C86D7A-1F01.pma | — | |
MD5:— | SHA256:— | |||
7937 | chrome | /.com.google.Chrome.UfMjxZ | — | |
MD5:— | SHA256:— | |||
7937 | chrome | /.com.google.Chrome.odF7xW | — | |
MD5:— | SHA256:— | |||
7937 | chrome | /home/user/.config/google-chrome/Default/Session Storage/LOG | — | |
MD5:— | SHA256:— | |||
7937 | chrome | /home/user/.config/google-chrome/Default/shared_proto_db/metadata/LOG | — | |
MD5:— | SHA256:— | |||
7937 | chrome | /home/user/.config/google-chrome/Default/shared_proto_db/LOG | — | |
MD5:— | SHA256:— | |||
7937 | chrome | /home/user/.config/google-chrome/WidevineCdm/.com.google.Chrome.n5jCtk | — | |
MD5:— | SHA256:— | |||
7937 | chrome | /.com.google.Chrome.zf0gFi | — | |
MD5:— | SHA256:— | |||
7937 | chrome | /.com.google.Chrome.qTNR98 | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | — |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/lmelglejhemejginpboagddgdfbepgmp/1.d714e27bbcdedab3f9f9ca92462ee6dc8ca779849aefdd27af92009a9d55a38f/1.1c9ef13b7a63abd8f89d0cbad98858b9e8f54fc3951160950403c72b45812d07/7c4973aa28b0c59d92cc9ebf075fcdccab6008b049c66388f079107ba6184551.puff | unknown | binary | 2.28 Kb | — |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/jflookgnkcckhobaglndicnbbgbonegd/1.363351f0d0ca05b48f43d4adac95ad01d955bb2988c015733e70e09625d47065/1.ab8da5b849ba36382f26992fe1b52d72aa457549f31246a0c386d6880fca8afc/7d154c7442d14a8b229549ff84d2ee16f1b087332b3d00cd990023f1966e5935.puff | unknown | binary | 40.3 Kb | — |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.9324e37832b4647cfe6dd5c305addbd1aebad06a25acf8cab9423efe9424cbf2/1.6fcc02a365d39485c49c9da8679a9fd979832315b2d47ff7f0ab395b10e303bd/04aec90660ca209151b66b2ff3d7c7e7c402fe8f78436469699d5e4971bf74d6.puff | unknown | binary | 11.3 Kb | — |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad7owvftcnssvkb2ygpc72axdarq_2024.2.9.1/jflhchccmppkfebkiaminageehmchikm_2024.02.09.01_all_ncoj624gr3w4ji4dr37mffpmc4.crx3 | unknown | binary | 7.66 Kb | — |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/1.90f54a8ca8c3135f647fedbb5f38ecadbbae4d45dafc3b73cde0c96d924a1773/1.70f09e0a653ea31af7453dc2a5ca85655e727beb924726f38d1703dba8e26eb5/09df53ba9d8e4075e806a682b0f3a7e18ec21481e88115716d16cbdf8efe988d.puff | unknown | binary | 2.25 Kb | — |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac4f3somx23o64dmkbjhcjiarbaa_2024.2.7.0/niikhdgajlphfehepabhhblakbdgeefj_2024.02.07.00_all_aday4y2elpq75abbq5dcch3j5mra.crx3 | unknown | binary | 5.61 Kb | — |
— | — | GET | — | 91.189.91.81:80 | http://ie.archive.ubuntu.com/ubuntu/pool/universe/o/openjdk-8/openjdk-8-jre-headless_8u392-ga-1%7e22.04_amd64.deb | unknown | — | — | — |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx | unknown | binary | 3.07 Kb | — |
— | — | GET | 204 | 185.125.190.49:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | — |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 185.125.190.98:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | unknown |
— | — | 91.189.91.49:80 | connectivity-check.ubuntu.com | Canonical Group Limited | US | unknown |
— | — | 212.102.56.179:443 | — | Datacamp Limited | DE | unknown |
— | — | 156.146.33.138:443 | — | Datacamp Limited | DE | unknown |
— | — | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 142.250.181.227:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
— | — | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 74.125.71.84:443 | accounts.google.com | GOOGLE | US | unknown |
— | — | 49.12.205.146:80 | betacraft.uk | Hetzner Online GmbH | DE | unknown |
— | — | 49.12.205.146:443 | betacraft.uk | Hetzner Online GmbH | DE | unknown |
Domain | IP | Reputation |
---|---|---|
clientservices.googleapis.com |
| unknown |
accounts.google.com |
| unknown |
betacraft.uk |
| unknown |
update.googleapis.com |
| unknown |
211.100.168.192.in-addr.arpa |
| unknown |
www.google.com |
| unknown |
api.snapcraft.io |
| unknown |
optimizationguide-pa.googleapis.com |
| unknown |
connectivity-check.ubuntu.com |
| unknown |
github.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Not Suspicious Traffic | ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management |
— | — | Not Suspicious Traffic | ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management |
— | — | Not Suspicious Traffic | ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management |