Malware analysis https://ngrok.com/download Malicious activity

Add for printing

URL:	https://ngrok.com/download
Full analysis:	https://app.any.run/tasks/02fdbe0a-4d44-4195-9d98-475f4cf87c4c
Verdict:	Malicious activity
Analysis date:	October 26, 2024, 21:18:49
OS:	Ubuntu 22.04.2 LTS
MD5:	03B1D5721AE8BCDF7936344741CE1E9B
SHA1:	51849760B31BA1E0DF222C3932E9764FAD775446
SHA256:	E16AE00D24483C75D6930A191949F08D491D221FA995B948AE88C02AA9036FE2
SSDEEP:	3:N8mKBM:2mKBM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 36068)
- Reads /proc/mounts (likely used to find writable filesystems)
  - python3.10 (PID: 36067)
- Checks DMI information (probably VM detection)
  - udevadm (PID: 36431)
  - udevadm (PID: 36432)
- Writes to Systemd service files (likely for persistence achievement)
  - systemd (PID: 36408)
  - systemd (PID: 36320)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

442

Monitored processes

225

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
35787	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://ngrok\.com/download "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN
35788	sudo -iu user google-chrome https://ngrok.com/download	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
35789	/usr/bin/google-chrome https://ngrok.com/download	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
35790	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
35791	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
35792	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
35793	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
35794	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
35795	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
35796	"/opt/google/chrome/chrome https://ngrok\.com/downlo"	/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

229

Text files

17

Unknown types

0

Dropped files

PID	Process	Filename		Type
35789	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
35789	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
35789	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
35789	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:—	SHA256:—
35789	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:—	SHA256:—
35789	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:—	SHA256:—
35789	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_3		vxd
		MD5:—	SHA256:—
35789	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_2		vxd
		MD5:—	SHA256:—
35789	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_0		vxd
		MD5:—	SHA256:—
35789	chrome	/home/user/.config/google-chrome/Default/History		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

16

TCP/UDP connections

100

DNS requests

127

Threats

6

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.98:80	http://connectivity-check.ubuntu.com/	GB	—	—	whitelisted
—	—	GET	204	185.125.190.98:80	http://connectivity-check.ubuntu.com/	GB	—	—	whitelisted
35836	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx	US	binary	3.07 Kb	whitelisted
35836	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gcmjkmgdlgnkkcocmoeiminaijmmjnii/1.b48b30af5ce18c96128bfff9d2755c7932a1f32adc66f68322f7dd505db9626f/1.cd1978742a4afdbaaa15bf712d5c90bef4144caa99024df98f6a9ad58043ae85/e37724369d5fcfa19bd2ac306e20a9a48dc3fe425aeaacd2bf30802908e3be66	US	binary	30.6 Kb	whitelisted
35836	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/o4te3zc44ua3b7bnufe4tqgrua_9244/hfnkpimlhhgieaddgfemjhofmfblmnib_9244_all_acq3ymusqo67ohdgpyw2ccefrwva.crx3	US	binary	25.4 Kb	whitelisted
35836	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dky4k5cqejbvc527ovvrovnn3a_20241014.687946955.14/obedbbhbpmojnkanicioggnmelmoomoc_20241014.687946955.14_all_ENGB500000_oxt6ptbqih2nq76bomdxea5wwq.crx3	US	binary	5.13 Mb	whitelisted
35836	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pjnu5jyln4kujhcmwstuyyvyyu_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_linux_ace35m3jiw32bj5wzzow5nia7yta.crx3	US	binary	13.5 Mb	whitelisted
35836	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ktfctmqcgi5lerrbitdm4lh3e4_3047/jflookgnkcckhobaglndicnbbgbonegd_3047_all_adx3tbgjs74dkv5d776s6cin6wyq.crx3	US	binary	76.0 Kb	whitelisted
35836	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/khaoiebndkojlmppeemjhbpbandiljpe/1.05399c5840405f4af2454470ceccaa3d097f07e271705cf37c1e5559ce793eeb/1.1471c6c104c7e11f08fd446f83dcdb396b1fef335f4e3c744007c2272064f538/44367e7bc13464ae48fa3a83edb9a1fc3258aa32540abba470d2ff291e5eaf0e	US	binary	2.11 Kb	whitelisted
35836	chrome	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adng7vqdoitx2e27efi7jcjaoipq_2024.10.23.0/niikhdgajlphfehepabhhblakbdgeefj_2024.10.23.00_all_ad744qa7yafkbbjy7mmxdtbjzb5a.crx3	US	binary	6.57 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.98:80	—	Canonical Group Limited	GB	unknown
—	—	195.181.170.18:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
35836	chrome	142.250.185.99:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
35789	chrome	239.255.255.250:1900	—	—	—	whitelisted
35836	chrome	104.18.161.117:443	cdn.prod.website-files.com	—	—	unknown
35836	chrome	142.250.153.84:443	accounts.google.com	GOOGLE	US	whitelisted
35836	chrome	104.18.34.201:443	assets.website-files.com	—	—	shared

DNS requests

Domain	IP	Reputation
odrs.gnome.org	195.181.170.18 195.181.175.40 207.211.211.26 212.102.56.178 37.19.194.80 169.150.255.181 169.150.255.183 2a02:6ea0:c700::11 2a02:6ea0:c700::19 2a02:6ea0:c700::18 2a02:6ea0:c700::21 2a02:6ea0:c700::107 2a02:6ea0:c700::101 2a02:6ea0:c700::112	whitelisted
google.com	142.250.185.238 2a00:1450:4001:830::200e	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.58 185.125.188.59 185.125.188.54 2620:2d:4000:1010::2e6 2620:2d:4000:1010::117 2620:2d:4000:1010::6d 2620:2d:4000:1010::42	whitelisted
clientservices.googleapis.com	142.250.185.99	whitelisted
accounts.google.com	142.250.153.84	whitelisted
ngrok.com	35.92.55.128	unknown
safebrowsingohttpgateway.googleapis.com	216.58.212.170 142.250.74.202 172.217.16.202 216.58.206.74 142.250.184.202 142.250.186.170 142.250.185.234 216.58.206.42 142.250.184.234 172.217.16.138 142.250.186.74 142.250.186.42 142.250.186.106 172.217.18.10 142.250.181.234 142.250.186.138	whitelisted
google-ohttp-relay-safebrowsing.fastly-edge.com	151.101.193.91 151.101.65.91 151.101.129.91 151.101.1.91	unknown
cdn.prod.website-files.com	104.18.161.117 104.18.160.117	unknown
www.googletagmanager.com	142.250.185.136	whitelisted

Threats

PID	Process	Class	Message
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)

Add for printing

No debug info

General Info

https://ngrok.com/download

03B1D5721AE8BCDF7936344741CE1E9B

51849760B31BA1E0DF222C3932E9764FAD775446

E16AE00D24483C75D6930A191949F08D491D221FA995B948AE88C02AA9036FE2

3:N8mKBM:2mKBM

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Reads /proc/mounts (likely used to find writable filesystems)

Checks DMI information (probably VM detection)

Writes to Systemd service files (likely for persistence achievement)

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings