URL: | https://mega.nz/folder/NT1g1D6C#YwgMY1EgxEn8HAb1y_6qqg |
Full analysis: | https://app.any.run/tasks/e943e18a-3452-4779-a35d-b306b9097c9b |
Verdict: | Malicious activity |
Analysis date: | April 08, 2024, 02:42:11 |
OS: | Ubuntu 22.04.2 |
MD5: | F714A8C868334213CBC0100302455996 |
SHA1: | 480A9025CCC5C0FC626CA05A50585331C8BD67A7 |
SHA256: | E9EA4E7EF9AEF1937A412CF1F21B1B8382E58E318031C6F4BD3A7E8224413B14 |
SSDEEP: | 3:N8X/iuyKUmVNtpCn:26zmVNWn |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
9289 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome \"https://mega\.nz/folder/NT1g1D6C#YwgMY1EgxEn8HAb1y_6qqg\" " | /bin/sh | — | any-guest-agent |
User: user Integrity Level: UNKNOWN | ||||
9290 | sudo -iu user google-chrome https://mega.nz/folder/NT1g1D6C#YwgMY1EgxEn8HAb1y_6qqg | /usr/bin/sudo | — | sh |
User: user Integrity Level: UNKNOWN | ||||
9291 | /usr/bin/google-chrome https://mega.nz/folder/NT1g1D6C#YwgMY1EgxEn8HAb1y_6qqg | /opt/google/chrome/chrome | — | sudo |
User: user Integrity Level: UNKNOWN | ||||
9292 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
9293 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
9294 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
9295 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
9296 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
9297 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
9298 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
9291 | chrome | /9291/fd/63 | — | |
MD5:— | SHA256:— | |||
9291 | chrome | /home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-66135989-244B.pma | — | |
MD5:— | SHA256:— | |||
9291 | chrome | /.com.google.Chrome.MgaB3O | — | |
MD5:— | SHA256:— | |||
9291 | chrome | /.com.google.Chrome.l8d0jf | — | |
MD5:— | SHA256:— | |||
9291 | chrome | /.com.google.Chrome.LsM00P | — | |
MD5:— | SHA256:— | |||
9291 | chrome | /.com.google.Chrome.DaFfpX | — | |
MD5:— | SHA256:— | |||
9291 | chrome | /.com.google.Chrome.8C8DDX | — | |
MD5:— | SHA256:— | |||
9291 | chrome | /.com.google.Chrome.pDJBEg | — | |
MD5:— | SHA256:— | |||
9291 | chrome | /.com.google.Chrome.C9CvuE | — | |
MD5:— | SHA256:— | |||
9291 | chrome | /.com.google.Chrome.G2b42T | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqd6fue3v2wbae5o47rdgdgzsiq_441/lmelglejhemejginpboagddgdfbepgmp_441_all_ZZ_bxdub6eycravb226lszju6umqm.crx3 | unknown | binary | 46.8 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx | unknown | binary | 3.07 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.90b91aaa463ef666bf030c7f14b7046738dee86d64321b28cb834d04bbfea4b3/1.4a6508925b2ffec931c1e3931ddeb15ca41d820a8264cd5a962b526e9932bcdf/e7212b90bb1f0ff6252449bbddc556675aa725f13d46408fb87016facb011e35.puff | unknown | binary | 3.21 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/jflookgnkcckhobaglndicnbbgbonegd/1.0d7ae8d89e34c06da40cf00c682307af3cb63c62318011a392effd9fdb955322/1.ab8da5b849ba36382f26992fe1b52d72aa457549f31246a0c386d6880fca8afc/faf82174b06a8e7bb61c7b66667a7b87dd1e00c85ba2d7581600b0e3f3995bce.puff | unknown | binary | 54.9 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclkrvzt3ph5qxof6xr7vwyfywmq_2024.4.1.0/niikhdgajlphfehepabhhblakbdgeefj_2024.04.01.00_all_cpyun4p2h7yxax6e2dt45dteja.crx3 | unknown | binary | 5.89 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/nq45t5xzdggv6sl7awdc23d7aq_8651/hfnkpimlhhgieaddgfemjhofmfblmnib_8651_all_acglit5ckh54sywfxfvvd5hei5da.crx3 | unknown | binary | 25.3 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k7rbu6qq7sptqxm7nwht4n7u5e_2024.4.6.1/jflhchccmppkfebkiaminageehmchikm_2024.04.06.01_all_adunmwmt2tc7st25ib2ro74bujhq.crx3 | unknown | binary | 9.34 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.38d01effb9f02c3d201ba10492bdd903a464d5facba4a0ecfb2f7425ea1d1db9/1.6fcc02a365d39485c49c9da8679a9fd979832315b2d47ff7f0ab395b10e303bd/46b11ec2cff16eaf5f1e6f5a34ea987cad9c35fe29615d0c221358f11073da1b.puff | unknown | binary | 24.5 Kb | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0/gonpemdgkjcecdgbnaabipppbmgfggbe_2024.03.27.00_all_fzhjrlg32de6xv4dkmgkgvwxsq.crx3 | unknown | binary | 6.51 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 216.58.206.35:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
— | — | 108.177.96.84:443 | accounts.google.com | GOOGLE | US | unknown |
— | — | 31.216.145.5:443 | mega.nz | Datacenter Luxembourg S.A. | LU | unknown |
— | — | 142.250.186.74:443 | content-autofill.googleapis.com | GOOGLE | US | unknown |
— | — | 66.203.124.37:443 | eu.static.mega.co.nz | Datacenter Luxembourg S.A. | LU | unknown |
— | — | 66.203.125.14:443 | g.api.mega.co.nz | Datacenter Luxembourg S.A. | LU | unknown |
— | — | 142.250.185.196:443 | www.google.com | — | — | unknown |
— | — | 142.250.185.227:443 | update.googleapis.com | GOOGLE | US | unknown |
Domain | IP | Reputation |
---|---|---|
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
mega.nz |
| whitelisted |
content-autofill.googleapis.com |
| whitelisted |
eu.static.mega.co.nz |
| shared |
g.api.mega.co.nz |
| shared |
lu.api.mega.co.nz |
| whitelisted |
123.100.168.192.in-addr.arpa |
| unknown |
www.google.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO File Sharing Related Domain in DNS Lookup (mega .nz) |
— | — | Misc activity | ET INFO File Sharing Related Domain in DNS Lookup (mega .nz) |
— | — | Misc activity | ET INFO File Sharing Domain Observed in TLS SNI (mega .nz) |
— | — | Misc activity | ET INFO File Sharing Domain Observed in TLS SNI (mega .nz) |
— | — | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
— | — | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
— | — | Misc activity | ET INFO File Sharing Domain Observed in TLS SNI (mega .nz) |
— | — | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
— | — | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
— | — | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |