Linux Analysis Report
https://correros.top/es

Overview

General Information

Sample URL: https://correros.top/es
Analysis ID: 1428122
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false

Signatures

Creates hidden files and/or directories
Creates hidden files without content (potentially used as a mutex)
Queries the installed Ubuntu/CentOS release
Reads the 'hosts' file potentially containing internal network hosts
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.20:58536 version: TLS 1.2
Reads the 'hosts' file potentially containing internal network hosts
Source: /usr/lib/firefox/firefox (PID: 4754) Reads hosts file: /etc/hosts Jump to behavior
Source: global traffic HTTP traffic detected: GET /es HTTP/1.1Host: correros.topUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic HTTP traffic detected: GET /6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/ HTTP/1.1Host: snippets.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: correros.topUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: image/webp,*/*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /us-west/bundles-pregen/Firefox/en-us/default.json HTTP/1.1Host: snippets.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /update/3/GMP/66.0.3/20190410113011/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/update.xml HTTP/1.1Host: aus5.mozilla.orgUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: unknown DNS traffic detected: queries for: correros.top
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 18 Apr 2024 13:34:35 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeAccess-Control-Allow-Origin: *ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hHIT1h5p0dt%2FC%2FO1Rt%2FWGBNiVHfRADC1D5oW8IQyc1JFgDVCPkvZoqBZMeQzj4qBkwmEE5PCborde1MIzOycCXKJGoZrfgvn4U6AuaPcCGFFn%2BfgOTZknnK6tAYVwz4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 87650878ea57b077-ATLalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 18 Apr 2024 13:34:36 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeAccess-Control-Allow-Origin: *ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Cache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1uVz7sZ4vUtQ5SDB2y8xVMCoZBbVxfXiKpUq7WxzmkjDCFPr%2BER%2B1o5KMCdyoDnxj%2BdOelOw8wzD3QGa5jJZlwemyQlEwSpjv3gbaBUGRlnkawfV9lEsdG6r0vGooNg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 876508813a8812d2-ATLalt-svc: h3=":443"; ma=86400
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://%(server)s/dummy/blocklist/)signon.autofillForms-signon.rememberSignons9startup.homepage_welc
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://%(server)s/dummy/healthreport/cdatareporting.healthreport.logging.consoleEnabledUdatareportin
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/I
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/Ihttp://a9.com/-/spec/opensearch/1.1/_http://a9.com/-/spec/opens
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/_
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/_
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: scriptCache-child-new.bin.34.dr String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: places.sqlite-wal.34.dr String found in binary or memory: http://wiki.ubuntu.com
Source: places.sqlite-wal.34.dr String found in binary or memory: http://wiki.ubuntu.com/moc.utnubu.ikiw.
Source: places.sqlite-wal.34.dr String found in binary or memory: http://www.debian.org
Source: places.sqlite-wal.34.dr String found in binary or memory: http://www.debian.org/gro.naibed.www.
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://www.mozilla.org/2006/addons-blocklist
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul-
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul-getElementsByTagNameNS
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: scriptCache-new.bin.34.dr String found in binary or memory: http://www.openh264.org/
Source: places.sqlite-wal.34.dr String found in binary or memory: http://www.ubuntu.com
Source: places.sqlite-wal.34.dr String found in binary or memory: http://www.ubuntu.com/moc.utnubu.www.
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://amazon.com
Source: places.sqlite-wal.34.dr String found in binary or memory: https://answers.launchpad.net
Source: places.sqlite-wal.34.dr String found in binary or memory: https://answers.launchpad.net/ubuntu/
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://baidu.com
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1243643
Source: places.sqlite-wal.34.dr String found in binary or memory: https://correros.top
Source: 34240C7DC72E83783C59D6BD827D189D629A4F48.34.dr String found in binary or memory: https://correros.top/
Source: 6636573CF5AFDF8A7F35DFA2B3C8E197EF2C586A.34.dr, recovery.jsonlz4.tmp.34.dr String found in binary or memory: https://correros.top/es
Source: places.sqlite-wal.34.dr String found in binary or memory: https://correros.top/espot.sorerroc.
Source: 1219C48A0A068C2295F75CE8A52C12FE06F6C10B.34.dr String found in binary or memory: https://correros.top/favicon.ico
Source: 34240C7DC72E83783C59D6BD827D189D629A4F48.34.dr String found in binary or memory: https://correros.top/predictor::seen1
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://developer.mozilla.org/docs/JavaScript_OS.File
Source: scriptCache-child-new.bin.34.dr String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes/
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes/_
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIBrowserSearchService#async_war
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://discovery.addons-dev.allizom.org
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://discovery.addons.allizom.orgQ
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://discovery.addons.allizom.orgQhttps://discovery.addons-dev.allizom.org
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://discovery.addons.mozilla.org
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://duckduckgo.com
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://ebay.com
Source: webext.sc.lz4.tmp.34.dr String found in binary or memory: https://github.com/
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://google.com
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/37ecfd08ffee9924609121aaec3f101598f8a84e
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: https://pki.goog/repository/0
Source: 4098689E1EA45FF0094F1C8088E49251FFFF7585.34.dr String found in binary or memory: https://snippets.cdn.mozilla.net/6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck
Source: C389DE279BF5275924497D5B33D1F1900116E591.34.dr, 4098689E1EA45FF0094F1C8088E49251FFFF7585.34.dr String found in binary or memory: https://snippets.cdn.mozilla.net/us-west/bundles-pregen/Firefox/en-us/default.json
Source: places.sqlite-wal.34.dr String found in binary or memory: https://support.mozilla.org
Source: places.sqlite-wal.34.dr String found in binary or memory: https://support.mozilla.org/en-US/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire
Source: places.sqlite-wal.34.dr String found in binary or memory: https://support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://support.mozilla.org/kb/flash-protected-mode-autodisabled
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://support.mozilla.org/kb/reset-firefox-easily-fix-most-problems
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://twitter.com
Source: cert9.db-journal.34.dr, cert9.db.34.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://www.google.com/policies/privacy/3
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://www.google.com/policies/privacy/3https://www.widevine.com/
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/en-US/about/gro.allizom.www.
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/en-US/contribute/gro.allizom.www.
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/en-US/firefox/central/gro.allizom.www.
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: places.sqlite-wal.34.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://www.widevine.com/
Source: scriptCache-new.bin.34.dr String found in binary or memory: https://yandex.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 48400
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 48398
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 40580
Source: unknown Network traffic detected: HTTP traffic on port 40580 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 48394
Source: unknown Network traffic detected: HTTP traffic on port 58536 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58536
Source: unknown Network traffic detected: HTTP traffic on port 48400 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 48394 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 40584 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 40584
Source: unknown Network traffic detected: HTTP traffic on port 48398 -> 443
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.20:58536 version: TLS 1.2
Source: classification engine Classification label: clean2.lin@0/70@18/0
Creates hidden files and/or directories
Source: /usr/bin/exo-open (PID: 4739) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/bin/exo-open (PID: 4739) Directory: /home/james/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747) Directory: /home/james/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747) Directory: /home/james/.local Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747) Directory: /home/james/.config Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) File: /tmp/firefox_james/.parentlock Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) File: /home/james/.mozilla/firefox/5zxot757.default/.parentlock Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) File: /home/james/.cache/mozilla/firefox/5zxot757.default/.startup-incomplete Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Directory: /home/james/.Xdefaults-ubuntu Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Directory: /home/james/.mime.types Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Directory: /home/james/.mozilla/firefox/5zxot757.default/storage/permanent/chrome/.metadata-v2 Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Directory: /home/james/.mailcap Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Directory: /home/james/.cache Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4782) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4782) Directory: /home/james/.drirc Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4816) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4879) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4924) Directory: /home/james/.Xauthority Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4964) Directory: /home/james/.Xauthority Jump to behavior
Creates hidden files without content (potentially used as a mutex)
Source: /usr/lib/firefox/firefox (PID: 4754) Empty hidden file: /tmp/firefox_james/.parentlock Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Empty hidden file: /home/james/.cache/mozilla/firefox/5zxot757.default/.startup-incomplete Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Empty hidden file: /home/james/.mozilla/firefox/5zxot757.default/.parentlock Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /usr/bin/exo-open (PID: 4739) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4782) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4816) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4879) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4924) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4964) Queries kernel information via 'uname': Jump to behavior
Queries the installed Ubuntu/CentOS release
Source: /usr/lib/firefox/firefox (PID: 4796) Arguments: /usr/bin/lsb_release -> /usr/bin/python3 -Es /usr/bin/lsb_release -idrc Jump to behavior
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.163.115.80
 d228z91au11ukj.cloudfront.net United States
16509 AMAZON-02US false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
104.21.53.159
 correros.top United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
correros.top 104.21.53.159 true
d228z91au11ukj.cloudfront.net 3.163.115.80 true
push.services.mozilla.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://correros.top/es false
    		unknown
    https://correros.top/favicon.ico false
      		unknown