| URL: | http://gdf.gdsfgfs |
| Full analysis: | https://app.any.run/tasks/5220fd4b-30d6-4931-b0d1-2f117d15c524 |
| Verdict: | Malicious activity |
| Analysis date: | February 13, 2024, 11:06:28 |
| OS: | Ubuntu 22.04.2 |
| MD5: | EC4D14E924DB6A4E782A1D8122758B8E |
| SHA1: | FB99EBE92E3018F1C7D9EB9C3B386FC7BA14586F |
| SHA256: | DB1CC65C2FDB74A04FB5F83FC964CEA45CD659DC29714EDC65689DF5AD5D5493 |
| SSDEEP: | 3:N1KZByEz:C9 |
MALICIOUS
Adds/modifies system service, likely for persistence
- dpkg (PID: 8258)
SUSPICIOUS
Reads information about logins, logouts, and login attempts
- bash (PID: 8176)
- invoke-rc.d (PID: 8463)
Executes commands using command-line interpreter
- gnome-terminal-server (PID: 8158)
- dpkg-preconfigure (PID: 8238)
- apt (PID: 8194)
- deb-systemd-invoke (PID: 8530)
- deb-systemd-invoke (PID: 8493)
- apt (PID: 8545)
- frontend (PID: 8336)
Executes the "rm" command to delete files or directories
- dpkg (PID: 8258)
- openssh-server.postinst (PID: 8349)
- update-motd-updates-available (PID: 8551)
Creates or rewrites file in the "bin" folder
- dpkg (PID: 8258)
Changes time attribute to hide new files or make changes to the existing one
- sh (PID: 8549)
Checks DMI information (probably VM detection)
- udevadm (PID: 8541)
Writes to Systemd service files (likely for persistence achievement)
- apt (PID: 8194)
INFO
Manipulating modules (likely to execute programs on system boot)
- modprobe (PID: 8540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
804
Monitored processes
579
Malicious processes
1
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 7930 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome \"http://gdf\.gdsfgfs\" " | /bin/sh | — | any-guest-agent |
User: user Integrity Level: UNKNOWN Exit code: 7932 | ||||
| 7931 | sudo -iu user google-chrome http://gdf.gdsfgfs | /usr/bin/sudo | — | sh |
User: user Integrity Level: UNKNOWN Exit code: 7932 | ||||
| 7932 | /usr/bin/google-chrome http://gdf.gdsfgfs | /opt/google/chrome/chrome | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 7932 | ||||
| 7933 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7934 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7935 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7936 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7937 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 7932 | ||||
| 7938 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 7932 | ||||
| 7939 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7932 | chrome | /7932/fd/63 | — | |
MD5:— | SHA256:— | |||
| 7932 | chrome | /home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-65CB4D3A-1EFC.pma | — | |
MD5:— | SHA256:— | |||
| 7932 | chrome | /.com.google.Chrome.7ASWxl | — | |
MD5:— | SHA256:— | |||
| 7932 | chrome | /.com.google.Chrome.OMvO7H | — | |
MD5:— | SHA256:— | |||
| 7932 | chrome | /.com.google.Chrome.rc64yy | — | |
MD5:— | SHA256:— | |||
| 7932 | chrome | /.com.google.Chrome.Vfr9XE | — | |
MD5:— | SHA256:— | |||
| 7932 | chrome | /.com.google.Chrome.CpuA4a | — | |
MD5:— | SHA256:— | |||
| 7932 | chrome | /.com.google.Chrome.n3cwjU | — | |
MD5:— | SHA256:— | |||
| 7932 | chrome | /home/user/.config/google-chrome/Default/Session Storage/LOG | — | |
MD5:— | SHA256:— | |||
| 7932 | chrome | /home/user/.config/google-chrome/Default/shared_proto_db/metadata/LOG | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
14
DNS requests
42
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 91.189.91.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 91.189.91.98:80 | — | Canonical Group Limited | US | unknown |
— | — | 91.189.91.48:80 | — | Canonical Group Limited | US | unknown |
— | — | 195.181.175.40:443 | — | Datacamp Limited | DE | unknown |
— | — | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 142.250.181.227:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
— | — | 74.125.71.84:443 | accounts.google.com | GOOGLE | US | unknown |
— | — | 142.250.185.131:443 | update.googleapis.com | GOOGLE | US | unknown |
— | — | 156.146.33.137:443 | — | Datacamp Limited | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
api.snapcraft.io |
| unknown |
gdf.gdsfgfs |
| unknown |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
google.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
147.100.168.192.in-addr.arpa |
| unknown |
connectivity-check.ubuntu.com |
| unknown |