| URL: | bavel.biz |
| Full analysis: | https://app.any.run/tasks/0cc68702-396f-4a45-b511-d46e56158ea3 |
| Verdict: | Malicious activity |
| Analysis date: | July 01, 2024, 08:59:34 |
| OS: | Ubuntu 22.04.2 |
| Indicators: | |
| MD5: | B8FCAD47B9E1C97D015D4ED37F740B00 |
| SHA1: | 58C018BEED1187ECD179A79C4645C250BE704B0C |
| SHA256: | 86E22E77670553F651B00FBC8F30870984665BB1640A4F825480F183114933F2 |
| SSDEEP: | 3:9an:8 |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
215
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 12934 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome bavel\.biz " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN | ||||
| 12935 | sudo -iu user google-chrome bavel.biz | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
35
DNS requests
51
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | POST | 200 | 184.24.77.71:80 | http://r11.o.lencr.org/ | unknown | — | — | unknown |
— | — | GET | 204 | 185.125.190.18:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 185.125.190.18:80 | — | Canonical Group Limited | GB | unknown |
— | — | 185.125.190.48:80 | — | Canonical Group Limited | GB | unknown |
1195 | snap-store | 156.146.33.137:443 | odrs.gnome.org | Datacamp Limited | DE | unknown |
485 | snapd | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
485 | snapd | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
485 | snapd | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 185.125.188.55:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 172.217.16.195:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
odrs.gnome.org |
| unknown |
api.snapcraft.io |
| unknown |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
bavel.biz |
| unknown |
safebrowsingohttpgateway.googleapis.com |
| unknown |
google-ohttp-relay-safebrowsing.fastly-edge.com |
| unknown |
www.google.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
197.100.168.192.in-addr.arpa |
| unknown |