| URL: | https://dl.brave.com/install.sh |
| Full analysis: | https://app.any.run/tasks/d245bcbe-5a6e-4a2a-b2f6-821a287afacd |
| Verdict: | Malicious activity |
| Analysis date: | February 05, 2025, 14:22:05 |
| OS: | Ubuntu 22.04.2 LTS |
| Indicators: | |
| MD5: | D2068022A74136A422320C9AEBEA053D |
| SHA1: | 398E89C178F617037E5136806C009C80B87145DF |
| SHA256: | 86E8BEFDF49D7F3DD544C94364562397C6895C5FCD832740599EC6493EEC6649 |
| SSDEEP: | 3:N8R2XygFKn:24ygs |
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 38745 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://dl\.brave\.com/install\.sh " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38746 | sudo -iu user google-chrome https://dl.brave.com/install.sh | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38747 | /usr/bin/google-chrome https://dl.brave.com/install.sh | /opt/google/chrome/chrome | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38748 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38749 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38750 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38751 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38752 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38753 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38754 | "/opt/google/chrome/chrome https://dl\.brave\.com/install\." | /opt/google/chrome/chrome | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 38747 | chrome | /home/user/.config/google-chrome/ShaderCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
| 38747 | chrome | /home/user/.config/google-chrome/ShaderCache/data_2 | binary | |
MD5:— | SHA256:— | |||
| 38747 | chrome | /home/user/.config/google-chrome/ShaderCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
| 38747 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
| 38747 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_2 | binary | |
MD5:— | SHA256:— | |||
| 38747 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_0 | binary | |
MD5:— | SHA256:— | |||
| 38747 | chrome | /home/user/.config/google-chrome/Default/History | binary | |
MD5:— | SHA256:— | |||
| 38747 | chrome | /home/user/.config/google-chrome/Default/DawnWebGPUCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
| 38747 | chrome | /home/user/.config/google-chrome/Default/DawnWebGPUCache/data_2 | binary | |
MD5:— | SHA256:— | |||
| 38747 | chrome | /home/user/.config/google-chrome/Default/DawnWebGPUCache/data_0 | binary | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.18:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
39160 | http | GET | 304 | 185.125.188.87:80 | http://archive.canonical.com/ubuntu/dists/jammy/InRelease | unknown | — | — | whitelisted |
39161 | http | GET | 304 | 91.189.91.82:80 | http://archive.ubuntu.com/ubuntu/dists/jammy/InRelease | unknown | — | — | whitelisted |
39161 | http | GET | 200 | 91.189.91.82:80 | http://archive.ubuntu.com/ubuntu/dists/jammy-updates/InRelease | unknown | — | — | whitelisted |
39161 | http | GET | — | 91.189.91.82:80 | http://archive.ubuntu.com/ubuntu/dists/jammy-updates/main/binary-i386/by-hash/SHA256/a41ce2150efb74acb2776760feb3ea0d238f43e869fa32fb136604ff8736d5ef | unknown | — | — | whitelisted |
39161 | http | GET | 200 | 91.189.91.82:80 | http://archive.ubuntu.com/ubuntu/dists/jammy-backports/InRelease | unknown | — | — | whitelisted |
39161 | http | GET | 200 | 91.189.91.82:80 | http://archive.ubuntu.com/ubuntu/dists/jammy-security/InRelease | unknown | — | — | whitelisted |
39161 | http | GET | — | 91.189.91.82:80 | http://archive.ubuntu.com/ubuntu/dists/jammy-updates/main/binary-amd64/by-hash/SHA256/cbc5d8cf34638b3512b198680dac2536d335435cfee70e437698544b6f919599 | unknown | — | — | whitelisted |
39161 | http | GET | — | 91.189.91.82:80 | http://archive.ubuntu.com/ubuntu/dists/jammy-updates/main/i18n/by-hash/SHA256/7e32d9a39f2ee99dc985b9606d6a30625201ac8e9e3927e88304f720fc32a444 | unknown | — | — | whitelisted |
39161 | http | GET | — | 91.189.91.82:80 | http://archive.ubuntu.com/ubuntu/dists/jammy-updates/main/dep11/by-hash/SHA256/060d436d5b85a1ae75e51e3b06f168a05ff9a290f51a10f9964212e3d4cdef75 | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.190.18:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
— | — | 195.181.175.41:443 | odrs.gnome.org | Datacamp Limited | DE | whitelisted |
512 | snapd | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
38795 | chrome | 216.58.206.67:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
38795 | chrome | 142.250.185.202:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | whitelisted |
38795 | chrome | 13.32.99.123:443 | dl.brave.com | AMAZON-02 | US | whitelisted |
38795 | chrome | 142.250.153.84:443 | accounts.google.com | GOOGLE | US | whitelisted |
512 | snapd | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
Domain | IP | Reputation |
|---|---|---|
odrs.gnome.org |
| whitelisted |
google.com |
| whitelisted |
connectivity-check.ubuntu.com |
| whitelisted |
api.snapcraft.io |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
safebrowsingohttpgateway.googleapis.com |
| whitelisted |
dl.brave.com |
| whitelisted |
d1fakx6bn3adcj.cloudfront.net |
| whitelisted |
accounts.google.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
38795 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
38795 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
38795 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
38795 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
38795 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39160 | http | Not Suspicious Traffic | ET INFO GNU/Linux APT User-Agent Outbound likely related to package management |
39161 | http | Not Suspicious Traffic | ET INFO GNU/Linux APT User-Agent Outbound likely related to package management |
39161 | http | Not Suspicious Traffic | ET INFO GNU/Linux APT User-Agent Outbound likely related to package management |
39161 | http | Not Suspicious Traffic | ET INFO GNU/Linux APT User-Agent Outbound likely related to package management |
39161 | http | Not Suspicious Traffic | ET INFO GNU/Linux APT User-Agent Outbound likely related to package management |