| URL: | yandex.ru |
| Full analysis: | https://app.any.run/tasks/7fc90eec-d457-46f3-8c8a-e1171c500f55 |
| Verdict: | Malicious activity |
| Analysis date: | February 26, 2024, 03:27:19 |
| OS: | Ubuntu 22.04.2 |
| MD5: | 83C04328C2935E8AEF7CDD3EB4395D04 |
| SHA1: | DB546BABA3ACB079F91946F80B9078FFA565E36D |
| SHA256: | 79E20B2452034A8399AE0E1D7E1FAFDBCCB375A9414616763EC11C0F7F177428 |
| SSDEEP: | 3:1n:F |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads information about logins, logouts, and login attempts
- bash (PID: 8213)
Executes commands using command-line interpreter
- gnome-terminal-server (PID: 8195)
- apt (PID: 8235)
- dpkg-preconfigure (PID: 8280)
- apt (PID: 8328)
Executes the "rm" command to delete files or directories
- dpkg (PID: 8301)
- update-motd-updates-available (PID: 8334)
Changes time attribute to hide new files or make changes to the existing one
- sh (PID: 8332)
Creates or rewrites file in the "bin" folder
- dpkg (PID: 8301)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
565
Monitored processes
340
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 7932 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome \"yandex\.ru\" " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7933 | sudo -iu user google-chrome yandex.ru | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7934 | /usr/bin/google-chrome yandex.ru | /opt/google/chrome/chrome | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7935 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7936 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7937 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7938 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7939 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7940 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7941 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7934 | chrome | /7934/fd/63 | — | |
MD5:— | SHA256:— | |||
| 7934 | chrome | /home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-65DC051E-1EFE.pma | — | |
MD5:— | SHA256:— | |||
| 7934 | chrome | /home/user/.config/google-chrome/Default/Local Storage/leveldb/LOG | — | |
MD5:— | SHA256:— | |||
| 7934 | chrome | /.com.google.Chrome.UoOJWm | — | |
MD5:— | SHA256:— | |||
| 7934 | chrome | /.com.google.Chrome.Mi3kyn | — | |
MD5:— | SHA256:— | |||
| 7934 | chrome | /home/user/.config/google-chrome/Default/Session Storage/LOG | — | |
MD5:— | SHA256:— | |||
| 7934 | chrome | /home/user/.config/google-chrome/Default/shared_proto_db/metadata/LOG | — | |
MD5:— | SHA256:— | |||
| 7934 | chrome | /home/user/.config/google-chrome/Default/shared_proto_db/LOG | — | |
MD5:— | SHA256:— | |||
| 7934 | chrome | /home/user/.config/google-chrome/WidevineCdm/.com.google.Chrome.ynzK32 | — | |
MD5:— | SHA256:— | |||
| 7934 | chrome | /.com.google.Chrome.nDktoH | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
95
DNS requests
107
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.17:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
— | — | GET | 200 | 91.189.91.83:80 | http://ie.archive.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.81.0-1ubuntu1.15_amd64.deb | unknown | binary | 189 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/lmelglejhemejginpboagddgdfbepgmp/1.5bdc69c131996e6e6abeeba649e5a21c2f62a0b40bce413f8a728108c0d4fe06/1.1c9ef13b7a63abd8f89d0cbad98858b9e8f54fc3951160950403c72b45812d07/865d7f70f7a9d5db0e532d532dcdac720827d84b53c19d9201854f1c174ccfe7.puff | unknown | binary | 2.27 Kb | unknown |
— | — | GET | 200 | 162.248.224.101:80 | http://162.248.224.101/m | unknown | binary | 104 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acfxlrp5viwchbuphckmvomvnw3q_2024.2.23.0/niikhdgajlphfehepabhhblakbdgeefj_2024.02.23.00_all_fu35rmvtot47476jnmknlqqxru.crx3 | unknown | binary | 5.80 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.1379eef506ab6fba0188245b16a8443df9500ddd8553bfb2f6f3903f4a7c6e1a/1.6fcc02a365d39485c49c9da8679a9fd979832315b2d47ff7f0ab395b10e303bd/3d2f8e760c9c6839d43e3e3004945ff5d33819ab285335201ef6a9749b28da69.puff | unknown | binary | 17.8 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/act6xyjtfqstmyiq32bv6f5pf6ka_8569/hfnkpimlhhgieaddgfemjhofmfblmnib_8569_all_acmx3zvomstjcmnrnikybm5alzza.crx3 | unknown | binary | 26.2 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/jflookgnkcckhobaglndicnbbgbonegd/1.af8fa6822a4a3a4aeaf78dd2b562b3b76ed3ef0b362f8ebc822df79717c996df/1.ab8da5b849ba36382f26992fe1b52d72aa457549f31246a0c386d6880fca8afc/3c8c4f546e4fa8003cf45c6c7acda068b295a9b5c871927c28fcffb32827dc42.puff | unknown | binary | 41.2 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adntsu7c2i6rqgpdez3sjfuq367a_2024.2.23.1/jflhchccmppkfebkiaminageehmchikm_2024.02.23.01_all_eoyb64giamrgjvhtv54527gmti.crx3 | unknown | binary | 7.84 Kb | unknown |
— | — | GET | 204 | 91.189.91.97:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 185.125.190.17:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | unknown |
— | — | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 91.189.91.48:80 | connectivity-check.ubuntu.com | Canonical Group Limited | US | unknown |
— | — | 142.250.185.227:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
— | — | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 74.125.206.84:443 | accounts.google.com | GOOGLE | US | unknown |
— | — | 5.255.255.77:80 | yandex.ru | YANDEX LLC | RU | unknown |
— | — | 77.88.55.88:443 | yandex.ru | YANDEX LLC | RU | unknown |
— | — | 62.217.160.2:443 | dzen.ru | LLC VK | RU | unknown |
— | — | 213.180.204.24:443 | sso.passport.yandex.ru | YANDEX LLC | RU | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
yandex.ru |
| whitelisted |
dzen.ru |
| unknown |
sso.passport.yandex.ru |
| whitelisted |
passport.yandex.ru |
| unknown |
sso.dzen.ru |
| unknown |
login.vk.com |
| whitelisted |
suggest.sso.dzen.ru |
| unknown |
suggest.dzen.ru |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Not Suspicious Traffic | ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management |
— | — | Attempted Information Leak | ET POLICY curl User-Agent Outbound |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potential Corporate Privacy Violation | ET POLICY Executable and linking format (ELF) file download Over HTTP |