File name:

dota3.tar.gz

Full analysis: https://app.any.run/tasks/8b75f106-515d-4977-ab38-bb007d02a761
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: April 02, 2025, 16:26:35
OS: Ubuntu 22.04.2
Tags:
miner
exploit
scan
telnet
telnetscan
ssh
Indicators:
MIME: application/gzip
File info: gzip compressed data, from Unix, original size modulo 2^32 4505600
MD5:

A8AF9AF2BEDFAABA970A181074396206

SHA1:

6F7DF5E851CEF484A357BB5F8FA45B7BAC13DD02

SHA256:

5A3291A81D961053FCB5495973C5AA9755AE4B54A689947914489F7FB4FE7F71

SSDEEP:

98304:qKKVNp7ZFELTtoHBJunbeDMYNc8sYI6r7XK30l8vcQOlMvgY/Rwft4+L4oKbU70X:HJnKk+k5l

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Attempting to connect via SSH

      • kthreadadd64 (PID: 40057)

    • Attempting to scan the network

      • kthreadadd64 (PID: 40057)

    • TELNETSCAN has been detected (SURICATA)

      • kthreadadd64 (PID: 40057)

    • EXPLOIT has been detected (SURICATA)

      • kthreadadd64 (PID: 40057)

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • gnome-terminal-server (PID: 39599)

    • Reads passwd file

      • file-roller (PID: 39508)
      • ls (PID: 39624)
      • top (PID: 39719)
      • ps (PID: 39967)
      • ps (PID: 39971)
      • crontab (PID: 40027)
      • kthreadadd64 (PID: 40057)
      • crontab (PID: 40026)

    • Gets information about currently running processes

      • dash (PID: 39639)
      • dash (PID: 39718)
      • dash (PID: 39699)
      • dash (PID: 39688)
      • dash (PID: 39755)
      • dash (PID: 39892)
      • dash (PID: 40029)

    • Executes the "rm" command to delete files or directories

      • dash (PID: 39690)
      • dash (PID: 39639)
      • dash (PID: 40004)
      • dash (PID: 39892)
      • dash (PID: 39891)
      • dash (PID: 39755)
      • dash (PID: 39699)
      • dash (PID: 40041)
      • dash (PID: 40585)
      • dash (PID: 40011)

    • Checks type of computer hardware (uname)

      • dash (PID: 39708)
      • dash (PID: 40041)
      • dash (PID: 40053)

    • Uses base64 (probably to encode stolen data or decode malicious payload)

      • dash (PID: 39688)
      • dash (PID: 39891)

    • Removes file immutable attribute

      • dash (PID: 39891)
      • dash (PID: 40011)
      • dash (PID: 40004)
      • dash (PID: 39755)

    • Checks all system information (uname)

      • perl (PID: 39991)
      • perl (PID: 39986)

    • Uses tools that copy files from or to remote systems

      • dash (PID: 40053)

    • Checks DMI information (probably VM detection)

      • .kswapd00 (PID: 40602)
      • kswapd00 (PID: 40604)

    • Reads /proc/mounts (likely used to find writable filesystems)

      • .kswapd00 (PID: 40602)
      • kswapd00 (PID: 40604)

    • Modifies Cron jobs

      • dash (PID: 39639)

    • Potential Corporate Privacy Violation

      • kthreadadd64 (PID: 40057)

    • Connects to unusual port

      • kthreadadd64 (PID: 40057)

    • Connects to SSH

      • kthreadadd64 (PID: 40057)

  • INFO

    • Checks timezone

      • file-roller (PID: 39508)
      • ls (PID: 39624)
      • ps (PID: 39971)
      • ps (PID: 39967)
      • crontab (PID: 40026)
      • crontab (PID: 40027)

    • Creates file in the temporary folder

      • kswapd00 (PID: 40604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

Compression: Deflated
Flags: (none)
ModifyDate: 0000:00:00 00:00:00
ExtraFlags: (none)
OperatingSystem: Unix
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
662
Monitored processes
438
Malicious processes
8
Suspicious processes
5

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start dash no specs sudo no specs file-roller no specs locale-check no specs systemd-hostnamed no specs gvfsd-network no specs gvfsd-smb-browse gvfsd-dnssd no specs dbus-daemon no specs nautilus no specs nautilus no specs file-roller no specs gnome-terminal-server no specs bash no specs dash no specs basename no specs dash no specs dirname no specs dircolors no specs ls no specs ls no specs bash no specs bash no specs ls no specs file no specs bash no specs sleep no specs bash no specs cat no specs dash no specs pgrep no specs pgrep no specs pgrep no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs gnome-session-ctl no specs at-spi-bus-launcher no specs at-spi-bus-launcher no specs dbus-daemon no specs dash no specs ps no specs grep no specs grep no specs mawk no specs cat no specs chmod no specs rm no specs rm no specs rm no specs rm no specs rm no specs mkdir no specs cp no specs cp no specs sleep no specs dash no specs dash no specs dash no specs cat no specs crontab no specs cat no specs sleep no specs cat no specs cat no specs chmod no specs whoami no specs dash no specs killall no specs dash no specs base64 no specs dash no specs rm no specs chmod no specs chmod no specs dash no specs dash no specs grep no specs dash no specs crontab no specs grep no specs uname no specs sleep no specs dash no specs dash no specs dash no specs mawk no specs top no specs sed no specs mawk no specs killall no specs killall no specs killall no specs killall no specs killall no specs killall no specs killall no specs killall no specs killall no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs ps no specs pgrep no specs crontab no specs grep no specs crontab no specs dash no specs base64 no specs dash no specs dash no specs crontab no specs grep no specs id no specs nproc no specs pgrep no specs sysctl no specs chmod no specs chmod no specs dash no specs dash no specs dash no specs chattr no specs rm no specs pgrep no specs pgrep no specs killall no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs pgrep no specs killall no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs pgrep no specs killall no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs pgrep no specs ps no specs grep no specs grep no specs mawk no specs killall no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs pgrep no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs pgrep no specs killall no specs dash no specs ps no specs grep no specs grep no specs mawk no specs pgrep no specs pgrep no specs pgrep no specs killall no specs dash no specs ps no specs grep no specs grep no specs mawk no specs rm no specs chmod no specs chmod no specs chmod no specs chmod no specs dash no specs dash no specs sleep no specs killall no specs killall no specs killall no specs rm no specs pgrep no specs killall no specs killall no specs killall no specs killall no specs dash no specs ps no specs grep no specs grep no specs mawk no specs killall no specs killall no specs killall no specs killall no specs sleep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs grep no specs mawk no specs dash no specs ps no specs grep no specs mawk no specs dash no specs ps no specs grep no specs mawk no specs dash no specs ps no specs grep no specs mawk no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs rm no specs dash no specs base64 no specs perl no specs dash no specs base64 no specs perl no specs chattr no specs uname no specs perl uname no specs perl rm no specs mkdir no specs chmod no specs chattr no specs cat no specs kswapd00 no specs killall5 no specs kswapd00 no specs dash no specs dash no specs dash no specs chattr no specs rm no specs mkdir no specs chmod no specs chattr no specs dash no specs kswapd00 no specs chattr no specs rm no specs chattr no specs rm no specs crontab no specs crontab no specs sleep no specs dash no specs killall no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs sleep no specs sleep no specs dash no specs dash no specs uname no specs date no specs touch no specs rm no specs rm no specs rm no specs rm no specs rm no specs sleep no specs timeout no specs dash no specs dirname no specs readlink no specs uname no specs #EXPLOIT kthreadadd64 dash no specs dash no specs dash no specs rm no specs ssh-agent no specs dash no specs sort no specs mawk no specs sort no specs mawk no specs cron no specs cron no specs dash no specs dash no specs .kswapd00 no specs .kswapd00 no specs kswapd00 no specs kswapd00 no specs

Process information

PID
CMD
Path
Indicators
Parent process
39506/bin/sh -c "DISPLAY=:0 sudo -iu user file-roller /home/user/Desktop/dota3\.tar\.gz "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
9
39507sudo -iu user file-roller /home/user/Desktop/dota3.tar.gz/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
39508file-roller /home/user/Desktop/dota3.tar.gz/usr/bin/file-roller—sudo
User:
user
Integrity Level:
UNKNOWN
39509/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39542/lib/systemd/systemd-hostnamed/usr/lib/systemd/systemd-hostnamed—systemd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39544/usr/libexec/gvfsd-network --spawner :1.6 /org/gtk/gvfs/exec_spaw/1/usr/libexec/gvfsd-network—gvfsd
User:
user
Integrity Level:
UNKNOWN
39553/usr/libexec/gvfsd-smb-browse --spawner :1.6 /org/gtk/gvfs/exec_spaw/2/usr/libexec/gvfsd-smb-browse
gvfsd
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39559/usr/libexec/gvfsd-dnssd --spawner :1.6 /org/gtk/gvfs/exec_spaw/3/usr/libexec/gvfsd-dnssd—gvfsd
User:
user
Integrity Level:
UNKNOWN
39568/usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only/usr/bin/dbus-daemon—dbus-daemon
User:
user
Integrity Level:
UNKNOWN
Exit code:
9
39569/usr/bin/nautilus --gapplication-service/usr/bin/nautilus—dbus-daemon
User:
user
Integrity Level:
UNKNOWN
Executable files
0
Suspicious files
4
Text files
57
Unknown types
4

Dropped files

PID
Process
Filename
Type
39508file-roller/home/user/.local/share/recently-used.xbelxml
MD5:—
SHA256:—
39508file-roller/home/user/Desktop/.rsync/init2text
MD5:—
SHA256:—
39508file-roller/home/user/Desktop/.rsync/b/runtext
MD5:—
SHA256:—
39508file-roller/home/user/Desktop/.rsync/b/atext
MD5:—
SHA256:—
39508file-roller/home/user/Desktop/.rsync/b/stoptext
MD5:—
SHA256:—
39508file-roller/home/user/Desktop/.rsync/a/init01text
MD5:—
SHA256:—
39508file-roller/home/user/Desktop/.rsync/a/runtext
MD5:—
SHA256:—
39508file-roller/home/user/Desktop/.rsync/a/atext
MD5:—
SHA256:—
39508file-roller/home/user/Desktop/.rsync/a/kswapd00binary
MD5:—
SHA256:—
39508file-roller/home/user/Desktop/.rsync/a/stoptext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
63 004
DNS requests
21
Threats
58 474

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
91.189.91.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
488
NetworkManager
GET
204
185.125.190.48:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
488
NetworkManager
GET
204
185.125.190.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
POST
200
185.125.188.54:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
tss
45.3 Kb
whitelisted
—
—
POST
200
185.125.188.55:443
https://api.snapcraft.io/api/v1/snaps/auth/nonces
unknown
binary
53 b
whitelisted
—
—
POST
200
185.125.188.59:443
https://api.snapcraft.io/api/v1/snaps/auth/nonces
unknown
binary
54 b
whitelisted
—
—
POST
200
185.125.188.58:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
tss
45.3 Kb
whitelisted
—
—
POST
200
185.125.188.55:443
https://api.snapcraft.io/api/v1/snaps/auth/sessions
unknown
binary
587 b
whitelisted
—
—
POST
200
185.125.188.54:443
https://api.snapcraft.io/api/v1/snaps/auth/nonces
unknown
binary
54 b
whitelisted
—
—
POST
200
185.125.188.59:443
https://api.snapcraft.io/api/v1/snaps/auth/sessions
unknown
binary
587 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
169.150.255.183:443
odrs.gnome.org
—
GB
whitelisted
—
—
207.211.211.26:443
odrs.gnome.org
—
US
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
39553
gvfsd-smb-browse
192.168.100.255:137
—
—
—
whitelisted
—
—
179.43.139.84:80
—
Private Layer INC
CH
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::96
  • 2001:67c:1562::24
  • 2620:2d:4000:1::23
  • 2620:2d:4002:1::196
  • 2620:2d:4002:1::198
  • 2001:67c:1562::23
  • 2620:2d:4002:1::197
  • 91.189.91.96
  • 185.125.190.17
  • 185.125.190.18
  • 185.125.190.98
  • 91.189.91.97
  • 185.125.190.97
  • 91.189.91.49
  • 91.189.91.98
  • 185.125.190.49
  • 185.125.190.48
  • 185.125.190.96
  • 91.189.91.48
whitelisted
odrs.gnome.org
  • 169.150.255.183
  • 195.181.170.18
  • 212.102.56.178
  • 169.150.255.180
  • 37.19.194.81
  • 207.211.211.26
  • 195.181.175.40
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::19
whitelisted
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.55
  • 185.125.188.59
  • 185.125.188.54
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::6d
whitelisted
google.com
  • 172.217.18.14
  • 2a00:1450:4001:80b::200e
whitelisted
14.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO Cryptocurrency Miner Checkin
39988
perl
Misc activity
ET INFO IRC Nick change on non-standard port
39993
perl
Generic Protocol Command Decode
SURICATA HTTP request header invalid
39993
perl
Misc activity
ET INFO IRC Nick change on non-standard port
39988
perl
Generic Protocol Command Decode
SURICATA HTTP request header invalid
40057
kthreadadd64
Attempted Information Leak
ET SCAN Potential SSH Scan OUTBOUND
39993
perl
Misc activity
ET INFO IRC Nick change on non-standard port
40057
kthreadadd64
Attempted Information Leak
ET SCAN Potential SSH Scan OUTBOUND
40057
kthreadadd64
Attempted Information Leak
ET SCAN Potential SSH Scan OUTBOUND
39988
perl
Misc activity
ET INFO IRC Nick change on non-standard port
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dota3.tar.gz