Malware analysis sitwell.xyz Malicious activity | ANY.RUN

Add for printing

URL:	sitwell.xyz
Full analysis:	https://app.any.run/tasks/9493a3fe-6ac7-4b8f-99ac-f840fa80aaf8
Verdict:	Malicious activity
Analysis date:	June 12, 2024, 18:51:23
OS:	Ubuntu 22.04.2
Indicators:
MD5:	3F3873F1D58CD599C3F0B05B2F105A0B
SHA1:	51FF3AF82118ED463FC8383A34376622EA70B01F
SHA256:	7938FCB66D7F737B2F4D92D4FD181166F4768D3A333A0015BBC6DF00621FBF87
SSDEEP:	3:IWdu:Jdu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - apt (PID: 12772)
  - gnome-terminal-server (PID: 12712)
  - su (PID: 12759)
  - apt (PID: 12819)
  - bash (PID: 12762)
  - dpkg-preconfigure (PID: 12942)
  - apt (PID: 13018)
  - update-notifier (PID: 13104)
- Executes the "rm" command to delete files or directories
  - dpkg (PID: 12957)
  - update-motd-updates-available (PID: 13024)
- Uses base64 (probably to encode stolen data or decode malicious payload)
  - nmap-common.postinst (PID: 13007)
- Creates or rewrites file in the "bin" folder
  - dpkg (PID: 12957)
- Changes time attribute to hide new files or make changes to the existing one
  - sh (PID: 13022)
- Reads network configuration
  - bash (PID: 12760)
- Reads /proc/mounts (likely used to find writable filesystems)
  - check-new-release-gtk (PID: 13106)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

481

Monitored processes

267

Malicious processes

0

Suspicious processes

2

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
12444	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
12445	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
12446	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome sitwell\.xyz "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN
12447	sudo -iu user google-chrome sitwell.xyz	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN
12448	/usr/bin/google-chrome sitwell.xyz	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
12449	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12450	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12451	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12452	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12453	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN

Add for printing

Executable files

5

Suspicious files

348

Text files

357

Unknown types

16

Dropped files

PID	Process	Filename		Type
12942	dpkg-preconfigure	/var/cache/debconf/config.dat		text
		MD5:—	SHA256:—
12942	dpkg-preconfigure	/var/cache/debconf/templates.dat		text
		MD5:—	SHA256:—
12448	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
12448	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
12448	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
12448	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:—	SHA256:—
12448	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:—	SHA256:—
12448	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:—	SHA256:—
12448	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_3		vxd
		MD5:—	SHA256:—
12448	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_2		vxd
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

16

TCP/UDP connections

2 078

DNS requests

88

Threats

0

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	301	3.64.163.50:80	http://sitwell.xyz/	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/niikhdgajlphfehepabhhblakbdgeefj/1.d6f323b9706bc47455a3cc1cbe64aa772234dd33aa54b1cba2eb3434470bef0b/1.1dbb3990e16ba546e7367ef84c38441173fbb5a7b570bb9b183d3b6faaeb622d/f6e99fc206e576ee66796d25f03bfdbceb8eadedcd9235233675cb6c4c4a363b.puff	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/lvx4ng4qhhp4kpddwmwjgzrumu_2024.6.5.140657/eeigpngbgcognadeebkilcpcaedhellh_2024.06.05.140657_all_ccj7nw5iotmqmvpbhiiji4wfca.crx3	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/lmelglejhemejginpboagddgdfbepgmp/1.36dd253d64a806545f17ee91078fb1f5fa9b07f0620eeea02dc70894da6a107c/1.7c7270ef0b71ec063a98f512831a53690989605dcb0fbf503b95ca5bb4f98b63/72f60ee4dabc614446401930a0d034fb4b74408ad57a4cda047e7a2e6a03f9a6.puff	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jxqgeyodl2wb4o4hxkzt62egnm_20240429.634529504.14/obedbbhbpmojnkanicioggnmelmoomoc_20240429.634529504.14_all_ENGB500000_drh7pqj4o7a7karn7sdqrnqyte.crx3	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/akxke7yqecznil7hwgyv3lemaq_8842/hfnkpimlhhgieaddgfemjhofmfblmnib_8842_all_ac53uly6h3pfin2ia2d3gcx7tutq.crx3	unknown	—	—	unknown
12885	http	GET	200	91.189.91.82:80	http://archive.ubuntu.com/ubuntu/pool/main/l/lapack/libblas3_3.10.0-2ubuntu1_amd64.deb	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.9e8b5281e830ef98473ebe00b121ecdad269c9dec6a305cdffc18f8df0f2aa17/1.153e9301be7e862a33e2cab936a0a97e2f8bdf2dae1be516d6fe8a5f184ce028/3865325347bda7f565702e2ccfb3e95df4655ae831a6c8f84fd358a3b01270f7.puff	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.c5a4836b63b63c1d68339aa301781096c97ea3f383d04cd6831851de88a4294f/1.ff0e88cc4f10c87e09be229b861a5ce2909b22d830b3634c51e29b150342eee0/9f8fd74d8ec762e298cc55ecd0464ec91a90e868c7f3405c77b62dbb5bcfbb40.puff	unknown	—	—	unknown
12885	http	GET	—	91.189.91.82:80	http://archive.ubuntu.com/ubuntu/pool/universe/libl/liblinear/liblinear4_2.3.0%2bdfsg-5_amd64.deb	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	142.250.185.227:443	clientservices.googleapis.com	GOOGLE	US	unknown
12448	chrome	239.255.255.250:1900	—	—	—	unknown
—	—	142.250.186.42:443	safebrowsingohttpgateway.googleapis.com	GOOGLE	US	unknown
—	—	3.64.163.50:80	sitwell.xyz	AMAZON-02	DE	unknown
—	—	151.101.65.91:443	google-ohttp-relay-safebrowsing.fastly-edge.com	FASTLY	US	unknown
—	—	74.125.206.84:443	accounts.google.com	—	—	unknown
—	—	3.64.163.50:443	sitwell.xyz	AMAZON-02	DE	unknown

DNS requests

Domain	IP	Reputation
api.snapcraft.io	185.125.188.55 185.125.188.59 185.125.188.54 185.125.188.58	unknown
173.100.168.192.in-addr.arpa	—	unknown
clientservices.googleapis.com	142.250.185.227	whitelisted
sitwell.xyz	3.64.163.50	unknown
safebrowsingohttpgateway.googleapis.com	142.250.186.42 216.58.212.138 172.217.16.202 142.250.185.234 142.250.185.74 142.250.185.170 142.250.186.106 142.250.186.74 142.250.181.234 142.250.185.138 142.250.185.106 142.250.184.234 142.250.185.202 142.250.186.170 216.58.206.74 172.217.18.106	unknown
google-ohttp-relay-safebrowsing.fastly-edge.com	151.101.65.91 151.101.193.91 151.101.1.91 151.101.129.91	unknown
accounts.google.com	74.125.206.84	shared
dan.com	2.18.64.6 2.18.64.29	unknown
www.google.com	142.250.185.196	whitelisted
cdn3.dan.com	52.222.236.31 52.222.236.79 52.222.236.2 52.222.236.17 18.238.243.9 18.238.243.71 18.238.243.30 18.238.243.20	shared

Threats

No threats detected

Add for printing

No debug info

General Info

sitwell.xyz

3F3873F1D58CD599C3F0B05B2F105A0B

51FF3AF82118ED463FC8383A34376622EA70B01F

7938FCB66D7F737B2F4D92D4FD181166F4768D3A333A0015BBC6DF00621FBF87

3:IWdu:Jdu

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Executes the "rm" command to delete files or directories

Uses base64 (probably to encode stolen data or decode malicious payload)

Creates or rewrites file in the "bin" folder

Changes time attribute to hide new files or make changes to the existing one

Reads network configuration

Reads /proc/mounts (likely used to find writable filesystems)

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings