| URL: | google.com |
| Full analysis: | https://app.any.run/tasks/ab9a801b-a902-487d-965e-bc9775962e95 |
| Verdict: | Malicious activity |
| Analysis date: | October 28, 2024, 02:55:02 |
| OS: | Ubuntu 22.04.2 LTS |
| MD5: | 1D5920F4B44B27A802BD77C4F0536F5A |
| SHA1: | BAEA954B95731C68AE6E45BD1E252EB4560CDC45 |
| SHA256: | D4C9D9027326271A89CE51FCAF328ED673F17BE33469FF979E8AB8DD501E664F |
| SSDEEP: | 3:duK:IK |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executes commands using command-line interpreter
- gnome-terminal-server (PID: 35994)
- sudo (PID: 35781)
- su (PID: 36041)
- su (PID: 36634)
Reads /proc/mounts (likely used to find writable filesystems)
- python3.10 (PID: 36092)
- nmap (PID: 36641)
Checks DMI information (probably VM detection)
- udevadm (PID: 36300)
- udevadm (PID: 36299)
- udevadm (PID: 36502)
- udevadm (PID: 36507)
- udevadm (PID: 36506)
- udevadm (PID: 36503)
- udevadm (PID: 36508)
- udevadm (PID: 36511)
- udevadm (PID: 36504)
- udevadm (PID: 36509)
- udevadm (PID: 36510)
- udevadm (PID: 36515)
- udevadm (PID: 36513)
- udevadm (PID: 36516)
- udevadm (PID: 36512)
- udevadm (PID: 36514)
- udevadm (PID: 36505)
- udevadm (PID: 36518)
- udevadm (PID: 36525)
- udevadm (PID: 36520)
- udevadm (PID: 36527)
- udevadm (PID: 36517)
- udevadm (PID: 36524)
- udevadm (PID: 36526)
- udevadm (PID: 36523)
- udevadm (PID: 36610)
- udevadm (PID: 36519)
- udevadm (PID: 36607)
- udevadm (PID: 36521)
- udevadm (PID: 36522)
- udevadm (PID: 36608)
Writes to Systemd service files (likely for persistence achievement)
- systemd (PID: 36276)
- systemd (PID: 36187)
Connects to SSH
- nmap (PID: 36641)
- ssh (PID: 36668)
Reads network configuration
- bash (PID: 36635)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
554
Monitored processes
336
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 35780 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome google\.com " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN | ||||
| 35781 | sudo -iu user google-chrome google.com | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN | ||||
| 35782 | /usr/bin/google-chrome google.com | /opt/google/chrome/chrome | sudo | |
User: user Integrity Level: UNKNOWN | ||||
| 35783 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 35784 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 35785 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 35786 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 35787 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
| 35788 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
| 35789 | "/opt/google/chrome/chrome google\.c" | /opt/google/chrome/chrome | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
Executable files
0
Suspicious files
97
Text files
17
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 35782 | chrome | /home/user/.config/google-chrome/ShaderCache/data_3 | binary | |
MD5:— | SHA256:— | |||
| 35782 | chrome | /home/user/.config/google-chrome/ShaderCache/data_2 | binary | |
MD5:— | SHA256:— | |||
| 35782 | chrome | /home/user/.config/google-chrome/ShaderCache/data_0 | binary | |
MD5:— | SHA256:— | |||
| 35782 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
| 35782 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
| 35782 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
| 35782 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
| 35782 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
| 35782 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
| 35782 | chrome | /home/user/.config/google-chrome/Default/History | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
146
DNS requests
60
Threats
38
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 91.189.91.49:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
35827 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gcmjkmgdlgnkkcocmoeiminaijmmjnii/1.b48b30af5ce18c96128bfff9d2755c7932a1f32adc66f68322f7dd505db9626f/1.cd1978742a4afdbaaa15bf712d5c90bef4144caa99024df98f6a9ad58043ae85/e37724369d5fcfa19bd2ac306e20a9a48dc3fe425aeaacd2bf30802908e3be66 | unknown | — | — | whitelisted |
35827 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx | unknown | — | — | whitelisted |
35827 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adng7vqdoitx2e27efi7jcjaoipq_2024.10.23.0/niikhdgajlphfehepabhhblakbdgeefj_2024.10.23.00_all_ad744qa7yafkbbjy7mmxdtbjzb5a.crx3 | unknown | — | — | whitelisted |
35827 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.10.11.01_all_jzb2rltf4ebriiaz3nap6gmbai.crx3 | unknown | — | — | whitelisted |
35827 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pjnu5jyln4kujhcmwstuyyvyyu_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_linux_ace35m3jiw32bj5wzzow5nia7yta.crx3 | unknown | — | — | whitelisted |
35827 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acacdz76zgcnd233wqrwdbqp4uxa_9248/hfnkpimlhhgieaddgfemjhofmfblmnib_9248_all_adpcasohvxzyj444fnk52lpp2ohq.crx3 | unknown | — | — | whitelisted |
35827 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ozca6cm5lseccdtxhpinug4lm4_1113/efniojlnjndmcbiieegkicadnoecjjef_1113_all_acn5uue2eolxoahc4sqxn2es7tgq.crx3 | unknown | — | — | whitelisted |
35827 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad4olnpok7b6seojrqinuxmu6i4q_472/lmelglejhemejginpboagddgdfbepgmp_472_all_ZZ_acntqy7qlh5ehhbjuwt56uvxx6hq.crx3 | unknown | — | — | whitelisted |
35827 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpngbgcognadeebkilcpcaedhellh_2024.07.12.235938_all_a6r64uyugl6fjh3lupjqo6w7ai.crx3 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 91.189.91.49:80 | connectivity-check.ubuntu.com | Canonical Group Limited | US | whitelisted |
— | — | 91.189.91.98:80 | — | Canonical Group Limited | US | unknown |
35782 | chrome | 239.255.255.250:1900 | — | — | — | whitelisted |
35827 | chrome | 142.251.36.3:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
35827 | chrome | 142.250.102.84:443 | accounts.google.com | GOOGLE | US | whitelisted |
35827 | chrome | 142.251.39.110:80 | google.com | GOOGLE | US | whitelisted |
35827 | chrome | 142.250.179.170:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | whitelisted |
35827 | chrome | 142.251.39.110:443 | google.com | GOOGLE | US | whitelisted |
35827 | chrome | 151.101.37.91:443 | google-ohttp-relay-safebrowsing.fastly-edge.com | FASTLY | NL | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
connectivity-check.ubuntu.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| whitelisted |
safebrowsingohttpgateway.googleapis.com |
| whitelisted |
google-ohttp-relay-safebrowsing.fastly-edge.com |
| unknown |
www.google.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
content-autofill.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Attempted Information Leak | ET SCAN Potential SSH Scan OUTBOUND |
— | — | Attempted Information Leak | ET SCAN Potential SSH Scan OUTBOUND |
— | — | Attempted Information Leak | ET SCAN Potential SSH Scan OUTBOUND |
— | — | Attempted Information Leak | ET SCAN Potential SSH Scan OUTBOUND |
— | — | Attempted Information Leak | ET SCAN Potential SSH Scan OUTBOUND |
— | — | Generic Protocol Command Decode | SURICATA ICMPv4 unknown code |
— | — | Generic Protocol Command Decode | SURICATA ICMPv4 unknown code |
— | — | Attempted Information Leak | ET SCAN Potential SSH Scan OUTBOUND |
— | — | Generic Protocol Command Decode | SURICATA ICMPv4 unknown code |
— | — | Generic Protocol Command Decode | SURICATA ICMPv4 unknown code |