File name:

Hola-Setup-C-HPE.exe

Full analysis: https://app.any.run/tasks/765309e6-6bbc-49f7-be3c-ac420b2d6929
Verdict: Malicious activity
Analysis date: June 11, 2024, 20:28:32
OS: Ubuntu 22.04.2
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

01378CE7D7581FAEE8E6C0849919DBF2

SHA1:

0F076CFE189EAD5B63D16B0670DD2B7207D97FE3

SHA256:

9FE6545E529986657024890FFD53751FEF32F0DA7AEF5B67AD9845CEE2C91C35

SSDEEP:

98304:zgINMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMC:06

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Checks DMI information (probably VM detection)

      • systemd-hostnamed (PID: 12465)

    • Checks the user who created the process

      • cron (PID: 13037)

    • Executes commands using command-line interpreter

      • cron (PID: 13037)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2050:01:30 10:42:03+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 2918400
InitializedDataSize: 414208
UninitializedDataSize: -
EntryPoint: 0x2ca62a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.226.366.0
ProductVersionNumber: 1.226.366.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Hola VPN Ltd.
FileDescription: Hola VPN App Setup
FileVersion: 1.226.366.0
InternalName: hola_setup.exe
LegalCopyright: Copyright © 2023 Hola VPN Ltd.
LegalTrademarks: -
OriginalFileName: hola_setup.exe
ProductName: Hola Setup
ProductVersion: 1.226.366.0
AssemblyVersion: 1.226.366.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
381
Monitored processes
167
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
sh no specs file no specs sh no specs sudo no specs nautilus no specs locale-check no specs systemd-hostnamed no specs nautilus no specs file-roller no specs 7z no specs nautilus no specs file-roller no specs 7z no specs firefox snap-seccomp no specs snap-confine no specs dumpe2fs no specs 5 no specs dumpe2fs no specs snap-confine no specs mkdir no specs realpath no specs realpath no specs xdg-user-dirs-update no specs bash no specs bash no specs realpath no specs realpath no specs bash no specs bash no specs realpath no specs realpath no specs bash no specs realpath no specs bash no specs bash no specs realpath no specs realpath no specs bash no specs realpath no specs ln no specs mkdir no specs ln no specs rm no specs ln no specs firefox no specs snapctl no specs snapctl no specs glxtest no specs snap no specs firefox no specs firefox no specs systemd-timedated no specs firefox no specs firefox no specs xdg-settings no specs dbus-send no specs cut no specs dbus-daemon no specs snap no specs xdg-settings no specs which no specs dash no specs basename no specs dash no specs grep no specs cut no specs dash no specs which no specs readlink no specs dash no specs xdg-mime no specs which no specs dash no specs dash no specs tr no specs dash no specs dash no specs dash no specs tr no specs awk no specs cut no specs dash no specs basename no specs dash no specs which no specs readlink no specs grep no specs cut no specs dash no specs firefox no specs firefox no specs xdg-settings no specs dbus-send no specs cut no specs xdg-settings no specs which no specs dash no specs basename no specs dash no specs which no specs grep no specs cut no specs dash no specs readlink no specs dash no specs xdg-mime no specs which no specs dash no specs dash no specs dash no specs tr no specs dash no specs tr no specs dash no specs dash no specs awk no specs cut no specs basename no specs dash no specs grep no specs cut no specs dash no specs which no specs readlink no specs xdg-settings no specs dbus-send no specs cut no specs xdg-settings no specs which no specs dash no specs basename no specs dash no specs grep no specs cut no specs dash no specs which no specs readlink no specs dash no specs xdg-mime no specs which no specs dash no specs dash no specs tr no specs dash no specs dash no specs tr no specs dash no specs awk no specs cut no specs dash no specs basename no specs dash no specs grep no specs cut no specs dash no specs which no specs readlink no specs firefox no specs firefox no specs firefox no specs firefox no specs firefox no specs firefox no specs firefox no specs cron no specs sh no specs

Process information

PID
CMD
Path
Indicators
Parent process
12447sh -c "file --mime-type /tmp/Hola-Setup-C-HPE\.exe"/bin/sh—any-guest-agent
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
12448file --mime-type /tmp/Hola-Setup-C-HPE.exe/usr/bin/file—sh
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
12449/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus /tmp/Hola-Setup-C-HPE\.exe "/bin/sh—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
12475
12450sudo -iu user nautilus /tmp/Hola-Setup-C-HPE.exe/usr/bin/sudo—sh
User:
user
Integrity Level:
UNKNOWN
Exit code:
12475
12451nautilus /tmp/Hola-Setup-C-HPE.exe/usr/bin/nautilus—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
12475
12452/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
12465/lib/systemd/systemd-hostnamed/lib/systemd/systemd-hostnamed—systemd
User:
root
Integrity Level:
UNKNOWN
Exit code:
12451
12474nautilus /tmp/Hola-Setup-C-HPE.exe/usr/bin/nautilus—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
482
12475file-roller /tmp/Hola-Setup-C-HPE.exe/usr/bin/file-roller—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
12475
12492/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/Hola-Setup-C-HPE.exe/usr/lib/p7zip/7z—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
482
Executable files
0
Suspicious files
2
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
12451nautilus/home/user/.local/share/nautilus/tags/meta.dbsqlite
MD5:—
SHA256:—
12451nautilus/home/user/.local/share/recently-used.xbelxml
MD5:—
SHA256:—
12451nautilus/home/user/.config/mimeapps.listtext
MD5:—
SHA256:—
12451nautilus/home/user/.local/share/recently-used.xbel.AF77O2xml
MD5:—
SHA256:—
12451nautilus/home/user/.local/share/nautilus/tags/meta.db-shm (deleted)binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
42
DNS requests
91
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
12525
firefox
POST
200
2.21.97.26:80
http://r3.o.lencr.org/
unknown
—
—
unknown
12525
firefox
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
unknown
12525
firefox
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
unknown
12525
firefox
POST
200
2.21.97.26:80
http://r3.o.lencr.org/
unknown
—
—
unknown
12525
firefox
POST
200
2.21.97.26:80
http://r3.o.lencr.org/
unknown
—
—
unknown
12525
firefox
POST
200
2.21.97.11:80
http://r3.o.lencr.org/
unknown
—
—
unknown
12525
firefox
POST
200
2.21.97.26:80
http://r3.o.lencr.org/
unknown
—
—
unknown
12525
firefox
POST
200
2.21.97.26:80
http://r3.o.lencr.org/
unknown
—
—
unknown
12525
firefox
POST
200
142.250.186.67:80
http://o.pki.goog/wr2
unknown
—
—
unknown
12525
firefox
POST
200
142.250.186.67:80
http://o.pki.goog/wr2
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
470
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
12525
firefox
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
12525
firefox
34.117.188.166:443
contile.services.mozilla.com
—
—
unknown
12525
firefox
2.21.97.26:80
r3.o.lencr.org
Akamai International B.V.
SE
unknown
12525
firefox
2.21.97.11:80
r3.o.lencr.org
Akamai International B.V.
SE
unknown
12525
firefox
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
unknown
12525
firefox
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
api.snapcraft.io
  • 185.125.188.55
  • 185.125.188.54
  • 185.125.188.59
  • 185.125.188.58
unknown
connectivity-check.ubuntu.com
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::97
  • 2001:67c:1562::23
  • 2620:2d:4000:1::22
  • 2001:67c:1562::24
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::98
  • 2620:2d:4002:1::196
  • 2620:2d:4002:1::197
  • 185.125.190.49
  • 91.189.91.97
  • 91.189.91.48
  • 185.125.190.17
  • 91.189.91.98
  • 185.125.190.98
  • 91.189.91.96
  • 185.125.190.18
  • 185.125.190.48
  • 91.189.91.49
  • 185.125.190.97
  • 185.125.190.96
unknown
189.100.168.192.in-addr.arpa
  • —
unknown
detectportal.firefox.com
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 93.184.215.14
  • 2606:2800:21f:cb07:6820:80da:af6b:8b2c
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
contile.services.mozilla.com
  • 34.117.188.166
whitelisted
spocs.getpocket.com
  • 34.117.188.166
shared
prod.ads.prod.webservices.mozgcp.net
  • —
unknown
r3.o.lencr.org
  • 2.21.97.26
  • 2.21.97.11
  • 2a02:26f0:7100::1720:eee1
  • 2a02:26f0:7100::1720:eeeb
  • 2a02:26f0:7100::1720:eeaa
  • 2a02:26f0:7100::1720:eee9
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Hola-Setup-C-HPE.exe