Malware analysis http://103.149.28.141/t Malicious activity

Add for printing

URL:	http://103.149.28.141/t
Full analysis:	https://app.any.run/tasks/0c7ae305-edee-4bee-af6c-5dd931ffcc4e
Verdict:	Malicious activity
Analysis date:	June 22, 2024, 17:27:36
OS:	Ubuntu 22.04.2
MD5:	05261F71942F9F4BEC867A6D5F1F7A94
SHA1:	8A7977B4C16F7DF0DCCD10BB58621A7EDF039D23
SHA256:	CD1AFE3E2285D83EFAE01D1B86B723BCAD49397CAB58CC1C0937F5A4E9FA9E24
SSDEEP:	3:N1KtMIcjy:CCIcG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 13237)
  - cron (PID: 13386)
  - su (PID: 13390)
  - update-notifier (PID: 13397)
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 13229)
- Connects to the server without a host name
  - chrome (PID: 12958)
- Checks the user who created the process
  - cron (PID: 13386)
- Reads /proc/mounts (likely used to find writable filesystems)
  - check-new-release-gtk (PID: 13399)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

337

Monitored processes

122

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
12911	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome http://103\.149\.28\.141/t "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN
12912	sudo -iu user google-chrome http://103.149.28.141/t	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN
12913	/usr/bin/google-chrome http://103.149.28.141/t	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
12914	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12915	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12916	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12917	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12918	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
12919	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
12920		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

8

Suspicious files

359

Text files

34

Unknown types

1

Dropped files

PID	Process	Filename		Type
12913	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
12913	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
12913	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
12913	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:—	SHA256:—
12913	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:—	SHA256:—
12913	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:—	SHA256:—
12913	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_3		vxd
		MD5:—	SHA256:—
12913	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_2		vxd
		MD5:—	SHA256:—
12913	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_0		vxd
		MD5:—	SHA256:—
13050	chrome	/home/user/.cache/mesa_shader_cache/index		koa
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

14

TCP/UDP connections

45

DNS requests

41

Threats

0

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
12958	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jxqgeyodl2wb4o4hxkzt62egnm_20240429.634529504.14/obedbbhbpmojnkanicioggnmelmoomoc_20240429.634529504.14_all_ENGB500000_drh7pqj4o7a7karn7sdqrnqyte.crx3	unknown	—	—	unknown
12958	chrome	GET	200	103.149.28.141:80	http://103.149.28.141/t	unknown	—	—	unknown
12958	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.708ae5ffaec033eead63c0ad4dee17712286c8cef0bec2601286ee2040b7b67c/1.153e9301be7e862a33e2cab936a0a97e2f8bdf2dae1be516d6fe8a5f184ce028/98b72558aaaf6ec1fdd9587000d4c64d5b872b6807cf3e764901d3c604e995f4.puff	unknown	—	—	unknown
12958	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adxvr3jmh374zgiuunq4q5bxocma_453/lmelglejhemejginpboagddgdfbepgmp_453_all_ZZ_mkjuqf56fedszid3zk4gd42uyy.crx3	unknown	—	—	unknown
12958	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/khaoiebndkojlmppeemjhbpbandiljpe/1.a9dcdb84b51dfb80ecd937f7775193f7c50fab755f256202e382db7a49207190/1.1471c6c104c7e11f08fd446f83dcdb396b1fef335f4e3c744007c2272064f538/cf7a3395d1c87e8889d87c7cfe0924969f2dfcdb282fd8d974db8069017ee67d.puff	unknown	—	—	unknown
12958	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/h5kdxdszkdbmcrjsuev236wyzi_8868/hfnkpimlhhgieaddgfemjhofmfblmnib_8868_all_acltdt7qkoyp6hlhuqrca2idnmla.crx3	unknown	—	—	unknown
12958	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/niikhdgajlphfehepabhhblakbdgeefj/1.62735b60bfb0bcf20eeb4cd43e45cf1b3236b5a03907949c70ba81c477064ad6/1.1dbb3990e16ba546e7367ef84c38441173fbb5a7b570bb9b183d3b6faaeb622d/26be6d3c87e63f1212d6c013f50058b3c6f7599dc2465ee343ee8678e2eae822.puff	unknown	—	—	unknown
12958	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.2cd4293d3b710d87cf3f4674722dc2a77e76604c42912eec0aa1c6ca4101a638/1.ff0e88cc4f10c87e09be229b861a5ce2909b22d830b3634c51e29b150342eee0/410108b8bb1cf6f460d24c62d21e71371d22e47d181ed627fbf32f452c093ad5.puff	unknown	—	—	unknown
12958	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/jflookgnkcckhobaglndicnbbgbonegd/1.2e871143703b862fcdf558b45cfe02a93a2cb74518b30f4c1e0f07753b0823b8/1.888ebbd183d017421d0f23a0a1ea9eaedffefd772878d86c67536c138ef62ada/9d1d7c69912e231efc605fa136885de4703daed3755e6a972a7dd67b6cc15b0b.puff	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	185.125.190.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	185.125.190.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
1195	snap-store	195.181.175.15:443	odrs.gnome.org	Datacamp Limited	DE	unknown
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
12958	chrome	142.250.186.131:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
12958	chrome	108.177.15.84:443	accounts.google.com	—	—	unknown
12913	chrome	239.255.255.250:1900	—	—	—	whitelisted
12958	chrome	142.250.186.138:443	safebrowsingohttpgateway.googleapis.com	GOOGLE	US	whitelisted
12958	chrome	151.101.129.91:443	google-ohttp-relay-safebrowsing.fastly-edge.com	FASTLY	US	unknown

DNS requests

Domain	IP	Reputation
odrs.gnome.org	195.181.175.15 212.102.56.178 156.146.33.138 156.146.33.140 156.146.33.14 195.181.175.41 212.102.56.182 2a02:6ea0:c700::10 2a02:6ea0:c700::11 2a02:6ea0:c700::101 2a02:6ea0:c700::18 2a02:6ea0:c700::21 2a02:6ea0:c700::22 2a02:6ea0:c700::17	unknown
clientservices.googleapis.com	142.250.186.131	whitelisted
accounts.google.com	108.177.15.84	shared
safebrowsingohttpgateway.googleapis.com	142.250.186.138 142.250.184.202 142.250.181.234 172.217.16.202 172.217.18.106 142.250.185.234 142.250.185.138 142.250.185.170 142.250.184.234 142.250.186.106 142.250.186.42 142.250.185.202 142.250.186.170 172.217.18.10 216.58.212.138 216.58.206.74	unknown
google-ohttp-relay-safebrowsing.fastly-edge.com	151.101.129.91 151.101.1.91 151.101.65.91 151.101.193.91	unknown
api.snapcraft.io	185.125.188.59 185.125.188.55 185.125.188.54 185.125.188.58	unknown
update.googleapis.com	216.58.206.67	whitelisted
www.google.com	216.58.206.36	whitelisted
43.100.168.192.in-addr.arpa	—	unknown
optimizationguide-pa.googleapis.com	216.58.206.74 142.250.185.170 142.250.181.234 142.250.185.138 142.250.186.170 142.250.184.202 142.250.185.106 142.250.185.202 142.250.185.234 142.250.186.106 142.250.186.42 142.250.186.138 172.217.16.202 172.217.18.106 172.217.18.10 216.58.212.138	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

http://103.149.28.141/t

05261F71942F9F4BEC867A6D5F1F7A94

8A7977B4C16F7DF0DCCD10BB58621A7EDF039D23

CD1AFE3E2285D83EFAE01D1B86B723BCAD49397CAB58CC1C0937F5A4E9FA9E24

3:N1KtMIcjy:CCIcG

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Checks DMI information (probably VM detection)

Connects to the server without a host name

Checks the user who created the process

Reads /proc/mounts (likely used to find writable filesystems)

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings