| File name: | stego.jpeg.zip |
| Full analysis: | https://app.any.run/tasks/17f83afe-1706-42c1-8cd7-a9f7cf4a3f4f |
| Verdict: | Malicious activity |
| Analysis date: | May 16, 2025, 13:30:31 |
| OS: | Ubuntu 22.04.2 |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | 4858BEBD2766581A6652B0B4AA26A39C |
| SHA1: | CA37C262CEA522C8F3911C5F350F4F364FB2A4D5 |
| SHA256: | 1B88B0B00AFD965967B6AA5F670FECA0C168C08178024DD9E70CB8CAC055CEE8 |
| SSDEEP: | 3072:NSNdhS4iStiedc9ZRCqcYaMDtbbESm8NeMmHyL98e/XKlx++p:MS9aIZIhMDtMS9NHmHK/XSxPp |
| .zip | | | ZIP compressed archive (100) |
|---|
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0008 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2025:03:13 23:19:00 |
| ZipCRC: | 0x3741b454 |
| ZipCompressedSize: | 123507 |
| ZipUncompressedSize: | 131345 |
| ZipFileName: | stego.jpeg |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 41028 | /bin/sh -c "DISPLAY=:0 sudo -iu user file-roller /tmp/stego\.jpeg\.zip " | /usr/bin/dash | — | IntiFjKCklFyPMJr | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41029 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41030 | sudo -iu user file-roller /tmp/stego.jpeg.zip | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41031 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41032 | file-roller /tmp/stego.jpeg.zip | /usr/bin/file-roller | — | sudo | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41033 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | file-roller | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41038 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41039 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41049 | /usr/lib/p7zip/7z l -slt -bd -y -- /tmp/stego.jpeg.zip | /usr/lib/p7zip/7z | — | file-roller | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41050 | /usr/sbin/cron -f -P | /usr/sbin/cron | — | cron | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 41153 | nautilus | /home/user/.local/share/nautilus/tags/meta.db | binary | |
MD5:— | SHA256:— | |||
| 41244 | perl | /var/cache/debconf/config.dat | text | |
MD5:— | SHA256:— | |||
| 41244 | perl | /var/cache/debconf/templates.dat | text | |
MD5:— | SHA256:— | |||
| 41405 | chrome | /home/user/.config/google-chrome/ShaderCache/data_2 | binary | |
MD5:— | SHA256:— | |||
| 41405 | chrome | /home/user/.config/google-chrome/ShaderCache/data_3 | binary | |
MD5:— | SHA256:— | |||
| 41405 | chrome | /home/user/.config/google-chrome/ShaderCache/data_0 | binary | |
MD5:— | SHA256:— | |||
| 41405 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
| 41405 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_2 | binary | |
MD5:— | SHA256:— | |||
| 41405 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
| 41405 | chrome | /home/user/.config/google-chrome/Default/History | binary | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
41242 | http | GET | 200 | 91.189.91.83:80 | http://archive.ubuntu.com/ubuntu/pool/universe/libm/libmcrypt/libmcrypt4_2.5.8-7_amd64.deb | unknown | — | — | whitelisted |
488 | NetworkManager | GET | 204 | 185.125.190.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
41242 | http | GET | 200 | 91.189.91.83:80 | http://archive.ubuntu.com/ubuntu/pool/universe/s/steghide/steghide_0.5.1-15_amd64.deb | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.190.98:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
1178 | snap-store | 212.102.56.178:443 | odrs.gnome.org | Datacamp Limited | DE | whitelisted |
512 | snapd | 185.125.188.57:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
41070 | gvfsd-smb-browse | 192.168.100.255:137 | — | — | — | whitelisted |
41242 | http | 91.189.91.83:80 | archive.ubuntu.com | Canonical Group Limited | US | whitelisted |
41451 | chrome | 142.250.185.67:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
41451 | chrome | 142.250.184.202:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
connectivity-check.ubuntu.com |
| whitelisted |
odrs.gnome.org |
| whitelisted |
api.snapcraft.io |
| whitelisted |
9.100.168.192.in-addr.arpa |
| unknown |
_http._tcp.archive.ubuntu.com |
| whitelisted |
archive.ubuntu.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
safebrowsingohttpgateway.googleapis.com |
| whitelisted |
duckduckgo.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
41242 | http | Not Suspicious Traffic | ET INFO GNU/Linux APT User-Agent Outbound likely related to package management |
41242 | http | Not Suspicious Traffic | ET INFO GNU/Linux APT User-Agent Outbound likely related to package management |
41451 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
41451 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
41451 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
41451 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
41451 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
41451 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
41451 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
41451 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |