File name:

bescrypt.zip

Full analysis: https://app.any.run/tasks/7851471c-fa85-4662-8289-e1b3fcd9ff45
Verdict: Malicious activity
Analysis date: January 26, 2024, 21:09:41
OS: Ubuntu 22.04.2
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

AB7388C8A51EA6C8B53CBC11BFD463F2

SHA1:

C1EFF4E389F6725035053989811209757753950D

SHA256:

0BD2F5C5C36CC0B9ABC8D8EB1BE4CFEC72B04FAC1DA10993C5407969B29B351F

SSDEEP:

96:JhF03W4MN2hvWaOTtBnnPovkURCLPyOZoTQlbdYozNMyQyPhp0++h/BgVxNIwz:pX92hvWaOT88z3l6GNM2peg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • gnome-terminal-server (PID: 6894)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2023:04:26 16:32:02
ZipCRC: 0x3e5d9226
ZipCompressedSize: 3702
ZipUncompressedSize: 16888
ZipFileName: bescrypt3.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
245
Monitored processes
25
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sh no specs sudo no specs file-roller no specs locale-check no specs 7z no specs nautilus no specs gnome-terminal-server no specs bash no specs lesspipe no specs dircolors no specs basename no specs dash no specs dirname no specs ls no specs ls no specs ls no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs unzip no specs

Process information

PID
CMD
Path
Indicators
Parent process
6848/bin/sh -c "DISPLAY=:0 sudo -iu user file-roller \"/tmp/bescrypt\.zip\" " /bin/sh—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
6849sudo -iu user file-roller /tmp/bescrypt.zip /usr/bin/sudo—sh
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
6850file-roller /tmp/bescrypt.zip /usr/bin/file-roller—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
6851/usr/bin/locale-check C.UTF-8 /usr/bin/locale-check—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
6865/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/bescrypt.zip /usr/lib/p7zip/7z—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
6872/usr/bin/nautilus --gapplication-service /usr/bin/nautilus—dbus-daemon
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
6894/usr/libexec/gnome-terminal-server /usr/libexec/gnome-terminal-server—systemd
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
6912bash /bin/bash—gnome-terminal-server
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
6913/bin/sh /usr/bin/lesspipe /usr/bin/lesspipe—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
6872
6914basename /usr/bin/lesspipe /usr/bin/basename—lesspipe
User:
user
Integrity Level:
UNKNOWN
Exit code:
6872
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6872nautilus/home/user/.local/share/nautilus/tags/meta.db-wal —
MD5:—
SHA256:—
6872nautilus/home/user/.local/share/nautilus/tags/meta.db-shm —
MD5:—
SHA256:—
6872nautilus/home/user/.local/share/nautilus/tags/.meta.isrunning —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
10
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.17:80
http://connectivity-check.ubuntu.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.17:80
—
Canonical Group Limited
GB
unknown
—
—
35.232.111.17:80
—
GOOGLE-CLOUD-PLATFORM
US
unknown
—
—
185.125.190.49:80
—
Canonical Group Limited
GB
unknown
—
—
195.181.170.18:443
—
Datacamp Limited
DE
unknown
—
—
224.0.0.251:5353
—
—
—
unknown
—
—
212.102.56.178:443
—
Datacamp Limited
DE
unknown
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
unknown

DNS requests

Domain
IP
Reputation
47.100.168.192.in-addr.arpa
  • —
unknown
api.snapcraft.io
  • 185.125.188.55
  • 185.125.188.54
  • 185.125.188.59
  • 185.125.188.58
unknown
connectivity-check.ubuntu.com
  • 2001:67c:1562::23
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::23
  • 2001:67c:1562::24
  • 2620:2d:4000:1::2b
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bescrypt.zip