URL:

http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/

Full analysis: https://app.any.run/tasks/e468bcfb-d85b-42c0-aa8c-07b0a7a4eb25
Verdict: Malicious activity
Analysis date: July 22, 2024, 13:31:56
OS: Ubuntu 22.04.2
MD5:

DCCCACD036B6E7A1E924DE83349C3EC2

SHA1:

3FF1C0724EB98E491B75B78B2CCE74D6958FD939

SHA256:

7513FBCDEB03A4B5F3BB2B8A5FA9C5917370EC1178367C0CE6990A79D59A9C6D

SSDEEP:

3:N1KSKGOwSKGFsPXYiCRCex20gZfn:CSdOw8ePXLSCex20gZn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • gnome-terminal-server (PID: 13181)
      • apt (PID: 13226)
      • apt (PID: 13723)
      • apt (PID: 14139)

    • Executes the "rm" command to delete files or directories

      • apt-key (PID: 13313)
      • apt-key (PID: 13251)
      • apt-key (PID: 13326)
      • apt-key (PID: 13534)
      • update-motd-updates-available (PID: 13844)
      • apt-key (PID: 13595)

    • Creates shell script file

      • apt-key (PID: 13326)
      • apt-key (PID: 13595)
      • apt-key (PID: 13251)
      • apt-key (PID: 13313)

  • INFO

    • Dropped object may contain TOR URL's

      • chrome (PID: 12985)
      • chrome (PID: 12940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
1 016
Monitored processes
802
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
12937/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd\.onion/ "/bin/sh—any-guest-agent
User:
root
Integrity Level:
UNKNOWN
Exit code:
485
12939sudo -iu user google-chrome http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion//usr/bin/sudo—sh
User:
root
Integrity Level:
UNKNOWN
Exit code:
1195
12940/usr/bin/google-chrome http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion//opt/google/chrome/chrome
sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
1195
12941/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—chrome
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
12942readlink -f /usr/bin/google-chrome/usr/bin/readlink—chrome
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
12943dirname /opt/google/chrome/google-chrome/usr/bin/dirname—chrome
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
12944mkdir -p /home/user/.local/share/applications/usr/bin/mkdir—chrome
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
12945cat/usr/bin/cat—chrome
User:
user
Integrity Level:
UNKNOWN
Exit code:
1195
12946cat/usr/bin/cat—chrome
User:
user
Integrity Level:
UNKNOWN
Exit code:
485
12947/opt/google/chrome/chrome—chrome
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
143
Text files
386
Unknown types
73

Dropped files

PID
Process
Filename
Type
12940chrome/home/user/.config/google-chrome/GrShaderCache/data_2vxd
MD5:0962291D6D367570BEE5454721C17E11
SHA256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
12940chrome/home/user/.config/google-chrome/ShaderCache/data_2vxd
MD5:0962291D6D367570BEE5454721C17E11
SHA256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
12985chrome/home/user/.config/google-chrome/Default/Trust Tokenssqlite
MD5:DEA619BA33775B1BAEEC7B32110CB3BD
SHA256:3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
12940chrome/home/user/.config/google-chrome/Default/Extension State/MANIFEST-000001binary
MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
SHA256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
12940chrome/home/user/.config/google-chrome/Default/shared_proto_db/MANIFEST-000001binary
MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
SHA256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
12940chrome/home/user/.config/google-chrome/GrShaderCache/data_3vxd
MD5:41876349CB12D6DB992F1309F22DF3F0
SHA256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
12940chrome/home/user/.config/google-chrome/GraphiteDawnCache/data_0vxd
MD5:CF89D16BB9107C631DAABF0C0EE58EFB
SHA256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
12940chrome/home/user/.config/google-chrome/GraphiteDawnCache/data_3vxd
MD5:41876349CB12D6DB992F1309F22DF3F0
SHA256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
12940chrome/home/user/.config/google-chrome/Default/WebStorage/QuotaManagerbinary
MD5:981F351994975A68A0DD3ECE5E889FD0
SHA256:3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
12940chrome/home/user/.config/google-chrome/Default/Sync Data/LevelDB/MANIFEST-000001binary
MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
SHA256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
96
TCP/UDP connections
31
DNS requests
90
Threats
133

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
13235
http
GET
304
91.189.91.81:80
http://archive.ubuntu.com/ubuntu/dists/jammy/InRelease
US
—
—
whitelisted
—
—
GET
204
185.125.190.97:80
http://connectivity-check.ubuntu.com/
GB
—
—
whitelisted
13235
http
GET
200
91.189.91.81:80
http://archive.ubuntu.com/ubuntu/dists/jammy-security/InRelease
US
text
125 Kb
whitelisted
13235
http
GET
200
91.189.91.81:80
http://archive.ubuntu.com/ubuntu/dists/jammy-backports/InRelease
US
text
124 Kb
whitelisted
13235
http
GET
200
91.189.91.81:80
http://archive.ubuntu.com/ubuntu/dists/jammy-updates/restricted/binary-i386/by-hash/SHA256/a89e6a8dfbf400b5d18db1e434e07fd84d158eab9cdbf3d1cdcd1f08a307ef35
US
binary
649 Kb
whitelisted
13235
http
GET
—
91.189.91.81:80
http://archive.ubuntu.com/ubuntu/dists/jammy-updates/main/binary-i386/by-hash/SHA256/f42452b757a991d355fe0b1bc4183c1d31ae39ecd7f0b436d297022f5c627187
US
—
—
whitelisted
13235
http
GET
—
91.189.91.81:80
http://archive.ubuntu.com/ubuntu/dists/jammy-updates/main/dep11/by-hash/SHA256/7989bb311baa38ef545250282aa065d23281c46dfb8faabe4c653487bdbded5c
US
—
—
whitelisted
13235
http
GET
200
91.189.91.81:80
http://archive.ubuntu.com/ubuntu/dists/jammy-updates/restricted/i18n/by-hash/SHA256/344068083aef300c205bca1f11f5554dc70df665d5460a6f31bee48bd79484a7
US
binary
1.77 Mb
whitelisted
13235
http
GET
—
91.189.91.81:80
http://archive.ubuntu.com/ubuntu/dists/jammy-updates/main/cnf/by-hash/SHA256/93febcc32c46b354298f625aa001397c95ed9b9b5317629b76abe45a07bd7004
US
—
—
whitelisted
13235
http
GET
—
91.189.91.81:80
http://archive.ubuntu.com/ubuntu/dists/jammy-updates/restricted/binary-amd64/by-hash/SHA256/a0b1ec47a040ec357098d7415b1b2de4c76b0b1b6682905b06a4337ad709dffd
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
470
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
unknown
—
—
185.125.190.49:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
unknown
—
—
156.146.33.138:443
odrs.gnome.org
Datacamp Limited
DE
unknown
—
—
185.125.190.97:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
unknown
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
485
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
12985
chrome
172.217.16.195:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
12940
chrome
239.255.255.250:1900
—
—
—
whitelisted
12985
chrome
173.194.76.84:443
accounts.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 91.189.91.96
  • 185.125.190.97
  • 185.125.190.49
  • 91.189.91.49
  • 185.125.190.98
  • 185.125.190.17
  • 185.125.190.18
  • 91.189.91.98
  • 185.125.190.48
  • 185.125.190.96
  • 91.189.91.48
  • 91.189.91.97
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::96
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::23
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::2b
  • 2001:67c:1562::24
  • 2001:67c:1562::23
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::2a
whitelisted
google.com
  • 142.250.184.238
  • 2a00:1450:4001:831::200e
  • 142.251.36.142
whitelisted
odrs.gnome.org
  • 156.146.33.138
  • 195.181.175.15
  • 156.146.33.141
  • 212.102.56.181
  • 195.181.175.41
  • 195.181.170.18
  • 156.146.33.14
  • 212.102.56.179
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::10
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::17
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::22
whitelisted
api.snapcraft.io
  • 185.125.188.54
  • 185.125.188.58
  • 185.125.188.59
  • 185.125.188.55
whitelisted
clientservices.googleapis.com
  • 172.217.16.195
whitelisted
accounts.google.com
  • 173.194.76.84
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 142.250.74.202
  • 142.250.184.202
  • 172.217.18.10
  • 142.250.186.42
  • 172.217.16.202
  • 172.217.23.106
  • 172.217.16.138
  • 216.58.206.74
  • 216.58.212.170
  • 142.250.184.234
  • 142.250.185.74
  • 142.250.181.234
  • 216.58.206.42
  • 142.250.186.170
  • 142.250.186.138
  • 142.250.186.106
whitelisted
lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion
  • —
unknown
google-ohttp-relay-safebrowsing.fastly-edge.com
  • 151.101.193.91
  • 151.101.1.91
  • 151.101.65.91
  • 151.101.129.91
unknown
update.googleapis.com
  • 142.250.186.35
whitelisted

Threats

PID
Process
Class
Message
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
425
systemd-resolved
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/