Malware analysis https://1tamilblasters.dad Malicious activity

Add for printing

URL:	https://1tamilblasters.dad
Full analysis:	https://app.any.run/tasks/6cdb1211-e65b-481b-b31b-dd6d76d6bd46
Verdict:	Malicious activity
Analysis date:	October 11, 2024, 18:49:08
OS:	Ubuntu 22.04.2
MD5:	BF9C041D67E71CC75BD30AD189C3F9AF
SHA1:	EC0B4D787F46469581DD5C9A008D9CDF696151F4
SHA256:	83E9A441354AB2264517B887A8D024FB4755BE84966E64F2871536C84D2C804B
SSDEEP:	3:N86aJp/y:26aJty

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Checks DMI information (probably VM detection)
  - udevadm (PID: 14360)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 14359)
- Reads /proc/mounts (likely used to find writable filesystems)
  - check-new-release-gtk (PID: 14770)
- Executes commands using command-line interpreter
  - update-notifier (PID: 14768)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

464

Monitored processes

247

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
13902	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://1tamilblasters\.dad "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN
13903	sudo -iu user google-chrome https://1tamilblasters.dad	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN
13905	/usr/bin/google-chrome https://1tamilblasters.dad	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
13906	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13907	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13908	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13909	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13910	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
13911	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
13913		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

853

Text files

31

Unknown types

4

Dropped files

PID	Process	Filename		Type
13905	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
13905	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
13905	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
13905	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:—	SHA256:—
13905	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:—	SHA256:—
13905	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:—	SHA256:—
13905	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_3		vxd
		MD5:—	SHA256:—
13905	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_2		vxd
		MD5:—	SHA256:—
13905	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_0		vxd
		MD5:—	SHA256:—
13905	chrome	/home/user/.config/google-chrome/Default/History		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

16

TCP/UDP connections

299

DNS requests

334

Threats

9

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.98:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
13950	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pjnu5jyln4kujhcmwstuyyvyyu_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_linux_ace35m3jiw32bj5wzzow5nia7yta.crx3	unknown	—	—	whitelisted
13950	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aciueukdrxvb6khkx2mvifmvt57a_20240902.672363756.14/obedbbhbpmojnkanicioggnmelmoomoc_20240902.672363756.14_all_ENGB500000_pioxf2kb34f767sqbe3w4sspgi.crx3	unknown	—	—	whitelisted
13950	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/nbg6itlvk4yl6d2rswyssepvu4_469/lmelglejhemejginpboagddgdfbepgmp_469_all_ZZ_j7r5ncjd54qdtugucamngve5uq.crx3	unknown	—	—	whitelisted
13950	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gcmjkmgdlgnkkcocmoeiminaijmmjnii/1.3651711652892acf34795b2c7e4d401ed2274c20e952f65cf52deeeef5bbf9b5/1.cd1978742a4afdbaaa15bf712d5c90bef4144caa99024df98f6a9ad58043ae85/f57d48f2458d0a8d34ccc2077ca88da0d44e809d2acd717f10ab827dae45743b	unknown	—	—	whitelisted
13950	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/blyd6eu5tkxgls254j2m2rsxz4_9198/hfnkpimlhhgieaddgfemjhofmfblmnib_9198_all_k2zuwmgxittymd6labmsytsgka.crx3	unknown	—	—	whitelisted
13950	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/nnvcrqouuyblra6n7ismordi7m_2024.10.7.0/niikhdgajlphfehepabhhblakbdgeefj_2024.10.07.00_all_adr4glii4uzhesq5ohhw4ucfg5oa.crx3	unknown	—	—	whitelisted
13950	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx	unknown	—	—	whitelisted
13950	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/khaoiebndkojlmppeemjhbpbandiljpe/1.05399c5840405f4af2454470ceccaa3d097f07e271705cf37c1e5559ce793eeb/1.1471c6c104c7e11f08fd446f83dcdb396b1fef335f4e3c744007c2272064f538/44367e7bc13464ae48fa3a83edb9a1fc3258aa32540abba470d2ff291e5eaf0e	unknown	—	—	whitelisted
13950	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.10.11.01_all_jzb2rltf4ebriiaz3nap6gmbai.crx3	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	91.189.91.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	185.125.190.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	195.181.170.19:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
485	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
13950	chrome	172.217.23.99:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
13950	chrome	74.125.206.84:443	accounts.google.com	GOOGLE	US	whitelisted

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.48 185.125.190.97 185.125.190.17 91.189.91.49 91.189.91.98 185.125.190.98 185.125.190.18 91.189.91.48 185.125.190.49 91.189.91.97 185.125.190.96 91.189.91.96 2620:2d:4002:1::197 2620:2d:4000:1::98 2620:2d:4000:1::22 2620:2d:4000:1::2a 2001:67c:1562::24 2620:2d:4000:1::23 2620:2d:4002:1::198 2620:2d:4002:1::196 2620:2d:4000:1::96 2620:2d:4000:1::2b 2620:2d:4000:1::97 2001:67c:1562::23	whitelisted
google.com	142.250.184.238 2a00:1450:4001:82a::200e	whitelisted
odrs.gnome.org	195.181.170.19 169.150.255.183 37.19.194.81 169.150.255.180 207.211.211.26 212.102.56.178 195.181.175.40 2a02:6ea0:c700::19 2a02:6ea0:c700::112 2a02:6ea0:c700::11 2a02:6ea0:c700::21 2a02:6ea0:c700::18 2a02:6ea0:c700::101 2a02:6ea0:c700::107	whitelisted
api.snapcraft.io	185.125.188.59 185.125.188.58 185.125.188.54 185.125.188.55 2620:2d:4000:1010::2e6 2620:2d:4000:1010::117 2620:2d:4000:1010::6d 2620:2d:4000:1010::42	whitelisted
clientservices.googleapis.com	172.217.23.99	whitelisted
accounts.google.com	74.125.206.84	whitelisted
1tamilblasters.dad	172.67.199.213 104.21.13.106	unknown
safebrowsingohttpgateway.googleapis.com	216.58.206.42 216.58.206.74 142.250.186.42 142.250.185.74 172.217.16.202 142.250.181.234 142.250.184.234 142.250.186.170 142.250.184.202 142.250.185.106 142.250.185.138 172.217.18.10 142.250.186.106 142.250.185.170 142.250.185.234 142.250.185.202	whitelisted
a.nel.cloudflare.com	35.190.80.1	whitelisted
google-ohttp-relay-safebrowsing.fastly-edge.com	151.101.65.91 151.101.193.91 151.101.1.91 151.101.129.91	unknown

Threats

PID	Process	Class	Message
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—	—	Misc activity	ET INFO Observed DNS Query to .dad TLD
—	—	Misc activity	ET INFO Observed DNS Query to .dad TLD
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
—	—	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com
—	—	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)

Add for printing

No debug info

General Info

https://1tamilblasters.dad

BF9C041D67E71CC75BD30AD189C3F9AF

EC0B4D787F46469581DD5C9A008D9CDF696151F4

83E9A441354AB2264517B887A8D024FB4755BE84966E64F2871536C84D2C804B

3:N86aJp/y:26aJty

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Checks DMI information (probably VM detection)

Manipulating modules (likely to execute programs on system boot)

Reads /proc/mounts (likely used to find writable filesystems)

Executes commands using command-line interpreter

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings