URL: | http://conpf50fece72sf3jtb0h9pyz3zp7s8a8.oast.site |
Full analysis: | https://app.any.run/tasks/c92f08ed-99cb-41eb-a884-d4ac6948e7ff |
Verdict: | Malicious activity |
Analysis date: | May 07, 2024, 19:31:34 |
OS: | Ubuntu 22.04.2 |
MD5: | AA64B45BE3861BDD809AC3E449624402 |
SHA1: | 8042EFDE29BBC53B1722163F011F085FB2177F2C |
SHA256: | 02D57FC6680712E233CE84A20A080B902128B57AEB246665540C0AB960DD1FAA |
SSDEEP: | 3:N1KdKL+J3XWUR1+wRuLLm:CIoGUj+wRELm |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
9265 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome http://conpf50fece72sf3jtb0h9pyz3zp7s8a8\.oast\.site " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN | ||||
9266 | sudo -iu user google-chrome http://conpf50fece72sf3jtb0h9pyz3zp7s8a8.oast.site | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN | ||||
9267 | /usr/bin/google-chrome http://conpf50fece72sf3jtb0h9pyz3zp7s8a8.oast.site | /opt/google/chrome/chrome | — | sudo |
User: user Integrity Level: UNKNOWN | ||||
9268 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
9269 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
9270 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
9271 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
9272 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
9273 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
9274 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
9267 | chrome | /9267/fd/63 | — | |
MD5:— | SHA256:— | |||
9267 | chrome | /home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-663A819B-2433.pma | — | |
MD5:— | SHA256:— | |||
9267 | chrome | /home/user/.config/google-chrome/Default/commerce_subscription_db/LOG | — | |
MD5:— | SHA256:— | |||
9267 | chrome | /home/user/.config/google-chrome/Default/discounts_db/LOG | — | |
MD5:— | SHA256:— | |||
9267 | chrome | /home/user/.config/google-chrome/Default/parcel_tracking_db/LOG | — | |
MD5:— | SHA256:— | |||
9267 | chrome | /home/user/.config/google-chrome/Default/chrome_cart_db/LOG | — | |
MD5:— | SHA256:— | |||
9267 | chrome | /home/user/.config/google-chrome/Default/coupon_db/LOG | — | |
MD5:— | SHA256:— | |||
9267 | chrome | /home/user/.config/google-chrome/Default/LOG | — | |
MD5:— | SHA256:— | |||
9267 | chrome | /home/user/.config/google-chrome/Default/Local Storage/leveldb/LOG | — | |
MD5:— | SHA256:— | |||
9267 | chrome | /home/user/.config/google-chrome/Default/PersistentOriginTrials/LOG | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 91.189.91.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adam6jzl2pkozp76ha3hgwh6rduq_445/lmelglejhemejginpboagddgdfbepgmp_445_all_ZZ_jsbez7gzstuxyaaq3ttxsu4bhe.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jmsxukfcf2675ixsjr37no2j2y_2024.5.6.0/niikhdgajlphfehepabhhblakbdgeefj_2024.05.06.00_all_oe5q6mnjt6jmc4hxq5347dctq4.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/ggkkehgbnfjpeggfpleeakpidbkibbmn/1.905f83845e25579fd4c6ae4bdc81a2740a216023f856918045ced4508329c941/1.c45cd56a0a8da0883c8f9757b31891d6c628f38cb80724015ffdf33b419a73f3/0e81ca17ff2d8fc4645b4dd59216b1ad6413403ef03bae5dc24f1bbb977f7a5a.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jmaarj3zzn5i3bp5agmrb7k3pu_3028/jflookgnkcckhobaglndicnbbgbonegd_3028_all_adtsy74lce7u5mtzcrq4jm4azpia.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/advl4j5xlyubuklan5hcu3lwxopq_8741/hfnkpimlhhgieaddgfemjhofmfblmnib_8741_all_nlexmv4orajfnrrasxtrrompoy.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ackutwdkr46o4ftaoou3dlon4lnq_2024.5.6.1/jflhchccmppkfebkiaminageehmchikm_2024.05.06.01_all_b3h2fqlcenej3jpbsoxd7wwtpy.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dc3rpcsihcsrtsulvj4bjxagvm_945/efniojlnjndmcbiieegkicadnoecjjef_945_all_adsqsz22citodwgow75c5rfakxqa.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.153e9301be7e862a33e2cab936a0a97e2f8bdf2dae1be516d6fe8a5f184ce028/1.4a6508925b2ffec931c1e3931ddeb15ca41d820a8264cd5a962b526e9932bcdf/1bbd0eca21eb9c81cf6ffb73afcdf08d70ee6d920b87e2e731f03dc4ac0a6cf8.puff | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 91.189.91.98:80 | — | Canonical Group Limited | US | unknown |
— | — | 91.189.91.49:80 | — | Canonical Group Limited | US | unknown |
— | — | 185.125.188.55:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 66.102.1.84:443 | accounts.google.com | GOOGLE | US | unknown |
— | — | 142.250.185.163:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
— | — | 178.128.16.97:443 | conpf50fece72sf3jtb0h9pyz3zp7s8a8.oast.site | DIGITALOCEAN-ASN | SG | unknown |
— | — | 178.128.16.97:80 | conpf50fece72sf3jtb0h9pyz3zp7s8a8.oast.site | DIGITALOCEAN-ASN | SG | unknown |
— | — | 142.250.186.131:443 | update.googleapis.com | GOOGLE | US | unknown |
Domain | IP | Reputation |
---|---|---|
api.snapcraft.io |
| unknown |
accounts.google.com |
| shared |
clientservices.googleapis.com |
| whitelisted |
conpf50fece72sf3jtb0h9pyz3zp7s8a8.oast.site |
| unknown |
update.googleapis.com |
| unknown |
44.100.168.192.in-addr.arpa |
| unknown |
www.google.com |
| whitelisted |
optimizationguide-pa.googleapis.com |
| whitelisted |
connectivity-check.ubuntu.com |
| unknown |
edgedl.me.gvt1.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .online) |
— | — | Potentially Bad Traffic | ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .online) |
— | — | Misc activity | ET INFO Interactsh Domain (.oast .site in TLS SNI) |
— | — | Misc activity | ET INFO Interactsh Domain (.oast .site in TLS SNI) |
— | — | Misc activity | ET INFO Interactsh Domain (.oast .site in TLS SNI) |