| URL: | https://code.visualstudio.com/docs/?dv=linux64_deb |
| Full analysis: | https://app.any.run/tasks/0a1f531a-2e31-4c7f-b513-1449e4a6f53b |
| Verdict: | Malicious activity |
| Analysis date: | February 14, 2024, 18:57:41 |
| OS: | Ubuntu 22.04.2 |
| MD5: | 80AEE7D8FED9FE652007F2EBA9E9EE33 |
| SHA1: | CDF67E28FDBD17D4A7B5CDCF4719EA5F2E39A74E |
| SHA256: | DD676A7AF49F6B61811E022FE87D4CD164DC6AC340F2067961DE34396D2EE16C |
| SSDEEP: | 3:N8X2XvWRQBLLK1HBAH:2m+RU/K1H2H |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads information about logins, logouts, and login attempts
- bash (PID: 8474)
Executes commands using command-line interpreter
- dpkg-preconfigure (PID: 8583)
- gnome-terminal-server (PID: 8456)
- dpkg (PID: 8623)
- apt (PID: 8532)
- apt (PID: 8653)
Executes the "rm" command to delete files or directories
- dpkg (PID: 8598)
- bash (PID: 8624)
- update-motd-updates-available (PID: 8659)
Reads /proc/mounts (likely used to find writable filesystems)
- snap-store (PID: 8266)
Checks DMI information (probably VM detection)
- systemd-hostnamed (PID: 8511)
Changes time attribute to hide new files or make changes to the existing one
- sh (PID: 8657)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
568
Monitored processes
339
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 7933 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome \"https://code\.visualstudio\.com/docs/?dv=linux64_deb\" " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 209 | ||||
| 7934 | sudo -iu user google-chrome https://code.visualstudio.com/docs/?dv=linux64_deb | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN Exit code: 416 | ||||
| 7935 | /usr/bin/google-chrome https://code.visualstudio.com/docs/?dv=linux64_deb | /opt/google/chrome/chrome | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 416 | ||||
| 7936 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7937 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7938 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7939 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 7940 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 8456 | ||||
| 7941 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 8456 | ||||
| 7942 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7935 | chrome | /7935/fd/63 | — | |
MD5:— | SHA256:— | |||
| 7935 | chrome | /home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-65CD0D2C-1EFF.pma | — | |
MD5:— | SHA256:— | |||
| 7935 | chrome | /home/user/.config/google-chrome/Default/commerce_subscription_db/LOG | — | |
MD5:— | SHA256:— | |||
| 7935 | chrome | /home/user/.config/google-chrome/Default/parcel_tracking_db/LOG | — | |
MD5:— | SHA256:— | |||
| 7935 | chrome | /home/user/.config/google-chrome/Default/discounts_db/LOG | — | |
MD5:— | SHA256:— | |||
| 7935 | chrome | /home/user/.config/google-chrome/Default/coupon_db/LOG | — | |
MD5:— | SHA256:— | |||
| 7935 | chrome | /home/user/.config/google-chrome/Default/LOG | — | |
MD5:— | SHA256:— | |||
| 7935 | chrome | /home/user/.config/google-chrome/Default/chrome_cart_db/LOG | — | |
MD5:— | SHA256:— | |||
| 7935 | chrome | /home/user/.config/google-chrome/Default/PersistentOriginTrials/LOG | — | |
MD5:— | SHA256:— | |||
| 7935 | chrome | /.com.google.Chrome.aRyKH7 | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
79
DNS requests
143
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 91.189.91.48:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/lmelglejhemejginpboagddgdfbepgmp/1.04dfbee1ec2fd167512805dedf3fa2a823dc28fe9fa2c97a74e664b38486110f/1.1c9ef13b7a63abd8f89d0cbad98858b9e8f54fc3951160950403c72b45812d07/981c85ca3083358ca87ef2feb8fffbeca0cb320aed30abf25d18f3abaefd482e.puff | unknown | binary | 2.28 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad5ml547gfrjgchmd5pd74nchbsa_2024.2.12.0/niikhdgajlphfehepabhhblakbdgeefj_2024.02.12.00_all_kulqr4zozsu26pceac55mcdq5a.crx3 | unknown | binary | 5.63 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/kvgfu5dyj2vfgt6ov4ftdakcza_8546/hfnkpimlhhgieaddgfemjhofmfblmnib_8546_all_acowzzmbi54lvdd5a5xssidlfgeq.crx3 | unknown | binary | 26.4 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/jflookgnkcckhobaglndicnbbgbonegd/1.af8fa6822a4a3a4aeaf78dd2b562b3b76ed3ef0b362f8ebc822df79717c996df/1.ab8da5b849ba36382f26992fe1b52d72aa457549f31246a0c386d6880fca8afc/3c8c4f546e4fa8003cf45c6c7acda068b295a9b5c871927c28fcffb32827dc42.puff | unknown | binary | 41.2 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.e73c28b8a509cae1e03f38bac15ba01879c9e48cc4cc8406b78d1e83c60ffc77/1.6fcc02a365d39485c49c9da8679a9fd979832315b2d47ff7f0ab395b10e303bd/99fa60c6981cb2be374f94175cee06c59a1cb5a1cfd90fe6e3922b64cc7e4e4e.puff | unknown | binary | 14.5 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx | unknown | binary | 3.07 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/oygsvrublgb2na3w5rjvljuzfy_2024.2.13.1/jflhchccmppkfebkiaminageehmchikm_2024.02.13.01_all_isk3wwszo5w35wqnovuc6dtffi.crx3 | unknown | binary | 7.74 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gonpemdgkjcecdgbnaabipppbmgfggbe/1.06e71f675912f15e683ea65e2a1ec902ff07d67953b8dbf4542f93baf98a29bc/1.48fecfa3c6f59eb6c34fdd5e8f19e0678699e2f27dc8ebfa7025c246d4575c68/c67e12b46a2316837ac3d7cc7035823f1e378f081e47b11a14890378f9808c6f.puff | unknown | binary | 2.60 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 91.189.91.48:80 | — | Canonical Group Limited | US | unknown |
— | — | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 91.189.91.96:80 | — | Canonical Group Limited | US | unknown |
— | — | 185.125.190.17:80 | — | Canonical Group Limited | GB | unknown |
— | — | 156.146.33.137:443 | — | Datacamp Limited | DE | unknown |
— | — | 216.58.212.131:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
— | — | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 108.177.96.84:443 | accounts.google.com | GOOGLE | US | unknown |
— | — | 13.107.246.45:443 | code.visualstudio.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
— | — | 2.17.0.227:443 | www.microsoft.com | AKAMAI-AS | DK | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
code.visualstudio.com |
| unknown |
part-0017.t-0009.t-msedge.net |
| unknown |
js.monitor.azure.com |
| whitelisted |
wcpstatic.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
c.s-microsoft.com |
| whitelisted |
e13678.dscb.akamaiedge.net |
| unknown |
e13678.dscg.akamaiedge.net |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net) |