Malware analysis https://www.efffcd.com/ Malicious activity

Add for printing

URL:	https://www.efffcd.com/
Full analysis:	https://app.any.run/tasks/6c95ca9f-967d-41a5-8582-c242dfb9ce16
Verdict:	Malicious activity
Analysis date:	May 18, 2025, 10:25:35
OS:	Ubuntu 22.04.2
MD5:	D3E8864846A61EFFAF961FE01F48E0D1
SHA1:	586DF9D20BA222D6CCA84353108D8222B5B296C8
SHA256:	B12933F72F63DA7627AB6D6E231957C49C8E9831018E988AE9D849E32203C7F2
SSDEEP:	3:N8DSLtB2Kn:2OLtUKn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - sudo (PID: 39859)
  - chrome (PID: 39861)
  - gnome-terminal-server (PID: 40097)
- Check the Environment Variables Related to System Identification (os-release)
  - snap (PID: 40129)
  - snap (PID: 40148)
  - snap (PID: 40247)
INFO
- Checks timezone
  - python3.10 (PID: 40089)
  - chrome (PID: 39861)
  - python3.10 (PID: 40128)
  - python3.10 (PID: 40147)
  - python3.10 (PID: 40246)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

245

Monitored processes

116

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

39858

/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://www\.efffcd\.com/ "

/usr/bin/dash

—

oF5qt7VjSoEVMhQn

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39859

sudo -iu user google-chrome https://www.efffcd.com/

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

39861

/usr/bin/google-chrome https://www.efffcd.com/

/opt/google/chrome/chrome

—

sudo

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libdl.so.2
/usr/lib/x86_64-linux-gnu/libpthread.so.0
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libnss3.so
/usr/lib/x86_64-linux-gnu/libnssutil3.so
/usr/lib/x86_64-linux-gnu/libsmime3.so
/usr/lib/x86_64-linux-gnu/libnspr4.so

39862

/usr/bin/locale-check C.UTF-8

/usr/bin/locale-check

—

chrome

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39863

readlink -f /usr/bin/google-chrome

/usr/bin/readlink

—

chrome

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39864

dirname /opt/google/chrome/google-chrome

/usr/bin/dirname

—

chrome

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39865

mkdir -p /home/user/.local/share/applications

/usr/bin/mkdir

—

chrome

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4

39866

cat

/usr/bin/cat

—

chrome

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39867

cat

/usr/bin/cat

—

chrome

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39868

"/opt/google/chrome/chrome https://www\.efffcd\.co"

/opt/google/chrome/chrome

—

chrome

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Add for printing

Executable files

12

Suspicious files

213

Text files

32

Unknown types

0

Dropped files

PID	Process	Filename		Type
39861	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
39861	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
39861	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
39861	chrome	/home/user/.config/google-chrome/Default/Sync Data/LevelDB/MANIFEST-000001		binary
		MD5:—	SHA256:—
39861	chrome	/home/user/.config/google-chrome/Default/shared_proto_db/metadata/MANIFEST-000001		binary
		MD5:—	SHA256:—
39861	chrome	/home/user/.config/google-chrome/Default/Extension State/MANIFEST-000001		binary
		MD5:—	SHA256:—
39861	chrome	/home/user/.config/google-chrome/Default/shared_proto_db/MANIFEST-000001		binary
		MD5:—	SHA256:—
39861	chrome	/home/user/.config/google-chrome/GrShaderCache/data_3		binary
		MD5:—	SHA256:—
39861	chrome	/home/user/.config/google-chrome/GrShaderCache/data_2		binary
		MD5:—	SHA256:—
39861	chrome	/home/user/.config/google-chrome/GrShaderCache/data_0		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

14

TCP/UDP connections

29

DNS requests

29

Threats

33

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
39909	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aevtvjsxpcrwhjvp5w32fej6zq_9.56.0/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.56.0_all_acq3rupi4ymeq53so4pzqroatfea.crx3	unknown	—	—	whitelisted
39909	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclxnidwwkj5di3vduduj2gqpgpq_4.10.2891.0/oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_linux_b4hin3q5s66ws2322cyyfp35lu.crx3	unknown	—	—	whitelisted
—	—	GET	204	91.189.91.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
39909	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acduabwvto2ryjkf3l66uk27zaxa_20250427.755145031.14/obedbbhbpmojnkanicioggnmelmoomoc_20250427.755145031.14_all_ENGB500000_acw2lwbx6cqtps7a7s4zuvcd56ca.crx3	unknown	—	—	whitelisted
39909	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adwdqefnrh6jcp5ptk2i66n6jgmq_509/lmelglejhemejginpboagddgdfbepgmp_509_all_ZZ_acp4huqh7tmiljgxwbhvehnsy56a.crx3	unknown	—	—	whitelisted
39909	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acdvcifl2ztime6bsz3eijtcfeaq_2025.5.15.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2025.05.15.01_all_ehum5zzx5qnqq3vyyhyi6ytrfq.crx3	unknown	—	—	whitelisted
39909	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aca4j7naijrf65juvpzj5lv43una_2025.4.30.0/niikhdgajlphfehepabhhblakbdgeefj_2025.04.30.00_all_pi2vwi5t776kda42vjlunrgh5u.crx3	unknown	—	—	whitelisted
39909	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3y43ahr5t46zb4jvbpjdtqh7fa_9793/hfnkpimlhhgieaddgfemjhofmfblmnib_9793_all_hnyonowsya6k4sm5gperuoam4q.crx3	unknown	—	—	whitelisted
39909	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/lnu3li27zsanbe2hcsfjuvm5fq_1.0.7.1744928549/laoigpblnllgcgjnjnllmfolckpjlhki_1.0.7.1744928549_all_ady56p6vtubsna6mhkx6lu2qml3a.crx3	unknown	—	—	whitelisted
39909	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/h26xvwhuftpziwnfucve6pheoe_3069/jflookgnkcckhobaglndicnbbgbonegd_3069_all_jd5jon3opnt3ka3niwggalpawu.crx3	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.48:80	—	Canonical Group Limited	GB	unknown
—	—	195.181.170.19:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
—	—	91.189.91.48:80	—	Canonical Group Limited	US	unknown
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.57:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
39909	chrome	142.250.186.163:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
39909	chrome	216.58.206.42:443	safebrowsingohttpgateway.googleapis.com	GOOGLE	US	whitelisted
39909	chrome	142.250.110.84:443	accounts.google.com	GOOGLE	US	whitelisted
39909	chrome	144.91.103.66:443	www.efffcd.com	Contabo GmbH	DE	unknown

DNS requests

Domain	IP	Reputation
google.com	172.217.16.142 2a00:1450:4001:808::200e	whitelisted
odrs.gnome.org	195.181.170.19 195.181.175.41 169.150.255.184 169.150.255.181 207.211.211.26 212.102.56.179 37.19.194.80 2a02:6ea0:c700::19 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::11 2a02:6ea0:c700::101 2a02:6ea0:c700::107 2a02:6ea0:c700::18	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.57 185.125.188.54 185.125.188.59 2620:2d:4000:1010::42 2620:2d:4000:1010::344 2620:2d:4000:1010::117 2620:2d:4000:1010::2e6	whitelisted
clientservices.googleapis.com	142.250.186.163	whitelisted
safebrowsingohttpgateway.googleapis.com	216.58.206.42 216.58.212.170 172.217.16.138 142.250.185.74 142.250.184.202 142.250.185.202 142.250.181.234 142.250.185.106 142.250.184.234 142.250.185.138 172.217.23.106 172.217.18.10 142.250.185.170 216.58.206.74 172.217.16.202 142.250.185.234	whitelisted
www.efffcd.com	144.91.103.66	unknown
accounts.google.com	142.250.110.84	whitelisted
cdnjs.cloudflare.com	104.17.25.14 104.17.24.14	whitelisted
content-autofill.googleapis.com	142.250.181.234 216.58.206.74 142.250.185.234 216.58.206.42 142.250.185.138 142.250.185.106 172.217.16.138 142.250.185.74 142.250.185.170 142.250.186.42 216.58.212.170 142.250.185.202 142.250.186.106 142.250.186.74 172.217.18.10 172.217.16.202	whitelisted
9.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
39909	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
39909	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
39909	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
39909	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
39909	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
39909	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
39909	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
39909	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt

Add for printing

No debug info

General Info

https://www.efffcd.com/

D3E8864846A61EFFAF961FE01F48E0D1

586DF9D20BA222D6CCA84353108D8222B5B296C8

B12933F72F63DA7627AB6D6E231957C49C8E9831018E988AE9D849E32203C7F2

3:N8DSLtB2Kn:2OLtUKn

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Check the Environment Variables Related to System Identification (os-release)

INFO

Checks timezone

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings