URL: | https://w14.monkrus.ws/ |
Full analysis: | https://app.any.run/tasks/c8dc3145-8c97-49ed-8e6d-a218c962951e |
Verdict: | Malicious activity |
Analysis date: | June 21, 2024, 14:41:54 |
OS: | Ubuntu 22.04.2 |
MD5: | D59FD50DB30DFCAB959449F842E8EF0D |
SHA1: | 2EC4370D2F19BBECC4A3403F50AEC29874186BBC |
SHA256: | E7A3AC683013518472566E956A32A27A584FB0BD7647763E8F4E090532C507EE |
SSDEEP: | 3:N8rLKQ:2r |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
12926 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://w14\.monkrus\.ws/ " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN | ||||
12927 | sudo -iu user google-chrome https://w14.monkrus.ws/ | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN | ||||
12929 | /usr/bin/google-chrome https://w14.monkrus.ws/ | /opt/google/chrome/chrome | sudo | |
User: user Integrity Level: UNKNOWN | ||||
12930 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12931 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12932 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12933 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12934 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
12935 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
12936 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
12929 | chrome | /home/user/.config/google-chrome/ShaderCache/data_3 | binary | |
MD5:— | SHA256:— | |||
12929 | chrome | /home/user/.config/google-chrome/ShaderCache/data_2 | binary | |
MD5:— | SHA256:— | |||
12929 | chrome | /home/user/.config/google-chrome/ShaderCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
12929 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
12929 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
12929 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
12929 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
12929 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
12929 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
12973 | chrome | /home/user/.cache/mesa_shader_cache/index | koa | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jxqgeyodl2wb4o4hxkzt62egnm_20240429.634529504.14/obedbbhbpmojnkanicioggnmelmoomoc_20240429.634529504.14_all_ENGB500000_drh7pqj4o7a7karn7sdqrnqyte.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adxvr3jmh374zgiuunq4q5bxocma_453/lmelglejhemejginpboagddgdfbepgmp_453_all_ZZ_mkjuqf56fedszid3zk4gd42uyy.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/niikhdgajlphfehepabhhblakbdgeefj/1.62735b60bfb0bcf20eeb4cd43e45cf1b3236b5a03907949c70ba81c477064ad6/1.1dbb3990e16ba546e7367ef84c38441173fbb5a7b570bb9b183d3b6faaeb622d/26be6d3c87e63f1212d6c013f50058b3c6f7599dc2465ee343ee8678e2eae822.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/khaoiebndkojlmppeemjhbpbandiljpe/1.a9dcdb84b51dfb80ecd937f7775193f7c50fab755f256202e382db7a49207190/1.1471c6c104c7e11f08fd446f83dcdb396b1fef335f4e3c744007c2272064f538/cf7a3395d1c87e8889d87c7cfe0924969f2dfcdb282fd8d974db8069017ee67d.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.708ae5ffaec033eead63c0ad4dee17712286c8cef0bec2601286ee2040b7b67c/1.153e9301be7e862a33e2cab936a0a97e2f8bdf2dae1be516d6fe8a5f184ce028/98b72558aaaf6ec1fdd9587000d4c64d5b872b6807cf3e764901d3c604e995f4.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aciwsq245jmlgnoolf2mwg5tswqq_8865/hfnkpimlhhgieaddgfemjhofmfblmnib_8865_all_cmwsbe3ocjo2qr2uatsoqidq6a.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/lvx4ng4qhhp4kpddwmwjgzrumu_2024.6.5.140657/eeigpngbgcognadeebkilcpcaedhellh_2024.06.05.140657_all_ccj7nw5iotmqmvpbhiiji4wfca.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.2cd4293d3b710d87cf3f4674722dc2a77e76604c42912eec0aa1c6ca4101a638/1.ff0e88cc4f10c87e09be229b861a5ce2909b22d830b3634c51e29b150342eee0/410108b8bb1cf6f460d24c62d21e71371d22e47d181ed627fbf32f452c093ad5.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/jflookgnkcckhobaglndicnbbgbonegd/1.2e871143703b862fcdf558b45cfe02a93a2cb74518b30f4c1e0f07753b0823b8/1.888ebbd183d017421d0f23a0a1ea9eaedffefd772878d86c67536c138ef62ada/9d1d7c69912e231efc605fa136885de4703daed3755e6a972a7dd67b6cc15b0b.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acfmumx47pbruzbu533yrgg2kevq_2024.6.18.1/jflhchccmppkfebkiaminageehmchikm_2024.06.18.01_all_adac6jv2qt5p25kpqug2gfja7j5q.crx3 | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
470 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
485 | snapd | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 142.250.184.195:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
12929 | chrome | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 66.102.1.84:443 | accounts.google.com | — | — | unknown |
— | — | 142.250.185.202:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | unknown |
— | — | 142.250.185.83:443 | w14.monkrus.ws | GOOGLE | US | unknown |
— | — | 151.101.193.91:443 | google-ohttp-relay-safebrowsing.fastly-edge.com | FASTLY | US | unknown |
— | — | 151.101.66.137:443 | code.jquery.com | FASTLY | US | unknown |
Domain | IP | Reputation |
---|---|---|
api.snapcraft.io |
| unknown |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
w14.monkrus.ws |
| malicious |
safebrowsingohttpgateway.googleapis.com |
| unknown |
ghs.google.com |
| unknown |
google-ohttp-relay-safebrowsing.fastly-edge.com |
| unknown |
www.blogger.com |
| shared |
code.jquery.com |
| whitelisted |
lh4.googleusercontent.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com) |