URL: | https://hurawatch.bz/ |
Full analysis: | https://app.any.run/tasks/b5999eeb-4fb9-439f-bb33-3d5037e7c57c |
Verdict: | Malicious activity |
Analysis date: | July 11, 2024, 18:22:34 |
OS: | Ubuntu 22.04.2 |
MD5: | 1512882B61A6F5DC3707B9760183E5FD |
SHA1: | 86EEA08172D2424094C87BB3CC4B615C324FF785 |
SHA256: | 71A0E844C5056E07B73F033B8F69D2FE7E65C4D36D9B7D3B8DDEA2EBEE92F720 |
SSDEEP: | 3:N8s1zKn:2s1m |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
12931 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://hurawatch\.bz/ " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN | ||||
12932 | sudo -iu user google-chrome https://hurawatch.bz/ | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN | ||||
12933 | /usr/bin/google-chrome https://hurawatch.bz/ | /opt/google/chrome/chrome | sudo | |
User: user Integrity Level: UNKNOWN | ||||
12934 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12935 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12936 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12937 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12938 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
12939 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
12940 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
12933 | chrome | /home/user/.config/google-chrome/ShaderCache/data_3 | binary | |
MD5:— | SHA256:— | |||
12933 | chrome | /home/user/.config/google-chrome/ShaderCache/data_2 | binary | |
MD5:— | SHA256:— | |||
12933 | chrome | /home/user/.config/google-chrome/ShaderCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
12933 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
12933 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
12933 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
12933 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
12933 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
12933 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_0 | binary | |
MD5:— | SHA256:— | |||
13081 | chrome | /home/user/.cache/mesa_shader_cache/index | binary | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 91.189.91.97:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 185.125.190.96:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | unknown |
470 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 156.146.33.15:443 | odrs.gnome.org | Datacamp Limited | DE | unknown |
— | — | 91.189.91.97:80 | connectivity-check.ubuntu.com | Canonical Group Limited | US | unknown |
485 | snapd | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
485 | snapd | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 142.250.186.35:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
— | — | 64.233.166.84:443 | accounts.google.com | GOOGLE | US | unknown |
— | — | 142.250.185.138:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | whitelisted |
12933 | chrome | 239.255.255.250:1900 | — | — | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
connectivity-check.ubuntu.com |
| unknown |
google.com |
| whitelisted |
odrs.gnome.org |
| unknown |
api.snapcraft.io |
| unknown |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| whitelisted |
hurawatch.bz |
| unknown |
safebrowsingohttpgateway.googleapis.com |
| unknown |
google-ohttp-relay-safebrowsing.fastly-edge.com |
| unknown |
hurawatch2.to |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query for .to TLD |
— | — | Potentially Bad Traffic | ET DNS Query for .to TLD |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Claudflare content delivery network (cdnjs .cloudflare .com) |