Malware analysis google.com Malicious activity | ANY.RUN

Add for printing

URL:	google.com
Full analysis:	https://app.any.run/tasks/9dfa086d-8965-4c47-b936-803d59c7a67b
Verdict:	Malicious activity
Analysis date:	March 17, 2024, 16:12:27
OS:	Ubuntu 22.04.2
MD5:	1D5920F4B44B27A802BD77C4F0536F5A
SHA1:	BAEA954B95731C68AE6E45BD1E252EB4560CDC45
SHA256:	D4C9D9027326271A89CE51FCAF328ED673F17BE33469FF979E8AB8DD501E664F
SSDEEP:	3:duK:IK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Reads information about logins, logouts, and login attempts
  - bash (PID: 9576)
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 9685)
  - gnome-control-center (PID: 9661)
- Executes the "rm" command to delete files or directories
  - bash (PID: 9576)
  - sudo (PID: 9719)
  - sudo (PID: 9740)
  - sudo (PID: 9743)
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 9558)
  - apt (PID: 9588)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

527

Monitored processes

301

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9302	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome \"google\.com\" "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 9304
9303	sudo -iu user google-chrome google.com	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 9304
9304	/usr/bin/google-chrome google.com	/opt/google/chrome/chrome	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 9304
9305	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9306	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9307	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9308	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9309	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 9304
9310	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 9304
9311		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9304	chrome	/9304/fd/63		—
		MD5:—	SHA256:—
9304	chrome	/home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-65F71672-2458.pma		—
		MD5:—	SHA256:—
9304	chrome	/.com.google.Chrome.F7BmJb		—
		MD5:—	SHA256:—
9304	chrome	/.com.google.Chrome.llWorb		—
		MD5:—	SHA256:—
9304	chrome	/.com.google.Chrome.wzNG7Q		—
		MD5:—	SHA256:—
9304	chrome	/.com.google.Chrome.KY9jHi		—
		MD5:—	SHA256:—
9304	chrome	/.com.google.Chrome.tJomTB		—
		MD5:—	SHA256:—
9304	chrome	/.com.google.Chrome.OfLU8G		—
		MD5:—	SHA256:—
9304	chrome	/.com.google.Chrome.qls0GM		—
		MD5:—	SHA256:—
9304	chrome	/.com.google.Chrome.dB1hSc		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

34

TCP/UDP connections

27

DNS requests

29

Threats

33

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/a/aom/libaom3_3.3.0-1_amd64.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/d/dav1d/libdav1d5_0.9.2-1_amd64.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/libd/libde265/libde265-0_1.0.8-1_amd64.deb	unknown	—	—	unknown
—	—	GET	200	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/f/fftw3/libfftw3-double3_3.3.8-2ubuntu8_amd64.deb	unknown	binary	751 Kb	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/libh/libheif/libheif1_1.12.0-2build1_amd64.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/x/x265/libx265-199_3.5-2_amd64.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/libl/liblqr/liblqr-1-0_0.4.2-2.1_amd64.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/i/imagemagick/imagemagick-6-common_6.9.11.60%2bdfsg-1.3ubuntu0.22.04.3_all.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/i/imagemagick/libmagickcore-6.q16-6_6.9.11.60%2bdfsg-1.3ubuntu0.22.04.3_amd64.deb	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.49:80	—	Canonical Group Limited	US	unknown
—	—	185.125.190.17:80	—	Canonical Group Limited	GB	unknown
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	142.250.184.227:443	clientservices.googleapis.com	GOOGLE	US	unknown
—	—	142.250.185.78:443	google.com	—	—	unknown
—	—	239.255.255.250:1900	—	—	—	unknown
—	—	108.177.96.84:443	accounts.google.com	GOOGLE	US	unknown
—	—	142.250.185.78:80	google.com	GOOGLE	US	unknown
—	—	142.250.185.131:443	www.gstatic.com	GOOGLE	US	unknown

DNS requests

Domain	IP	Reputation
api.snapcraft.io	185.125.188.55 185.125.188.58 185.125.188.59 185.125.188.54	unknown
clientservices.googleapis.com	142.250.184.227	whitelisted
accounts.google.com	108.177.96.84	shared
google.com	142.250.185.78	whitelisted
www.google.com	172.217.16.196	whitelisted
www.gstatic.com	142.250.185.131	whitelisted
content-autofill.googleapis.com	172.217.16.202 142.250.184.202 142.250.186.74 142.250.186.106 142.250.184.234 142.250.185.74 142.250.186.138 172.217.18.106 142.250.74.202 172.217.23.106 172.217.16.138 172.217.18.10 216.58.206.42 216.58.206.74 216.58.212.138 216.58.212.170	whitelisted
fonts.gstatic.com	142.250.185.67	whitelisted
update.googleapis.com	142.250.181.227	whitelisted
152.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management

Add for printing

No debug info

General Info

google.com

1D5920F4B44B27A802BD77C4F0536F5A

BAEA954B95731C68AE6E45BD1E252EB4560CDC45

D4C9D9027326271A89CE51FCAF328ED673F17BE33469FF979E8AB8DD501E664F

3:duK:IK

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Reads information about logins, logouts, and login attempts

Checks DMI information (probably VM detection)

Executes the "rm" command to delete files or directories

Executes commands using command-line interpreter

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings