File name: | 64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.zip |
Full analysis: | https://app.any.run/tasks/33fb89d4-33e6-4d46-95a5-bb5129775c89 |
Verdict: | Malicious activity |
Analysis date: | May 21, 2024, 21:09:00 |
OS: | Ubuntu 22.04.2 |
MIME: | application/zip |
File info: | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
MD5: | 39205AD995217A89B9DBAFEE5734E29C |
SHA1: | A5C8C9774ADB8015E860CC9388EF347C3F26858F |
SHA256: | A1618F87B7480E42405F3D6DAF2331A4B696C96DE998F7DBDDB025960D674D48 |
SSDEEP: | 1536:aoihqF3z3YzMWqo2TYIIRtIt9mrTYp6zDiumFfXC8PblCyfsxj6mgzlck:fihCD3IFYGsIrZzD+CmlyLk |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | 64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.elf |
---|---|
ZipUncompressedSize: | 197427 |
ZipCompressedSize: | 61748 |
ZipCRC: | 0x4933ee29 |
ZipModifyDate: | 2024:05:21 21:08:42 |
ZipCompression: | Unknown (99) |
ZipBitFlag: | 0x0003 |
ZipRequiredVersion: | 51 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
6177 | /bin/sh -c "DISPLAY=:0 sudo -iu user file-roller /tmp/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f\.zip " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 418 | ||||
6178 | sudo -iu user file-roller /tmp/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.zip | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN Exit code: 6179 | ||||
6179 | file-roller /tmp/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.zip | /usr/bin/file-roller | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 6179 | ||||
6180 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
6194 | /usr/lib/p7zip/7z l -slt -bd -y -- /tmp/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.zip | /usr/lib/p7zip/7z | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 6179 | ||||
6195 | /usr/lib/p7zip/7z x -bd -bb1 -y -o/home/user/.cache/.fr-hHNP7i -- /tmp/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.zip 64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.elf | /usr/lib/p7zip/7z | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 6179 | ||||
6200 | /usr/lib/p7zip/7z x -bd -bb1 -y -pinfected -o/home/user/.cache/.fr-VVqEwg -- /tmp/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.zip 64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.elf | /usr/lib/p7zip/7z | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 482 | ||||
6209 | file-roller /tmp/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.zip | /usr/bin/file-roller | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 482 | ||||
6210 | eog /home/user/.cache/.fr-VVqEwg/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.elf | /usr/bin/eog | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 482 | ||||
6241 | /usr/libexec/gvfsd-network --spawner :1.6 /org/gtk/gvfs/exec_spaw/1 | /usr/libexec/gvfsd-network | — | gvfsd |
User: user Integrity Level: UNKNOWN |
PID | Process | Filename | Type | |
---|---|---|---|---|
6195 | 7z | /home/user/.cache/.fr-hHNP7i/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.elf | — | |
MD5:— | SHA256:— | |||
6200 | 7z | /home/user/.cache/.fr-VVqEwg/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.elf | — | |
MD5:— | SHA256:— | |||
6179 | file-roller | /home/user/.config/mimeapps.list.FH9TN2 | — | |
MD5:— | SHA256:— | |||
6264 | 7z | /home/user/Desktop/64864ada3748e9c2577c91090b3477e628000265f7aa7c2025f8fca7c807222f.elf | — | |
MD5:— | SHA256:— | |||
6179 | file-roller | /home/user/.local/share/recently-used.xbel.6R50N2 | — | |
MD5:— | SHA256:— | |||
6276 | nautilus | /home/user/.local/share/nautilus/tags/meta.db-wal | — | |
MD5:— | SHA256:— | |||
6276 | nautilus | /home/user/.local/share/nautilus/tags/meta.db-shm | — | |
MD5:— | SHA256:— | |||
6276 | nautilus | /home/user/.local/share/nautilus/tags/.meta.isrunning | — | |
MD5:— | SHA256:— | |||
6179 | file-roller | /home/user/.local/share/recently-used.xbel.CPDON2 | — | |
MD5:— | SHA256:— | |||
6276 | nautilus | /home/user/.local/share/recently-used.xbel.6UY1N2 | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.97:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
6405 | firefox | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | unknown |
6405 | firefox | POST | 200 | 95.101.54.107:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
6405 | firefox | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | unknown |
6405 | firefox | POST | 200 | 142.250.185.131:80 | http://o.pki.goog/wr2 | unknown | — | — | unknown |
6405 | firefox | POST | 200 | 95.101.54.107:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
6405 | firefox | POST | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/ | unknown | — | — | unknown |
6405 | firefox | POST | 200 | 95.101.54.107:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
6405 | firefox | POST | 200 | 142.250.185.131:80 | http://o.pki.goog/wr2 | unknown | — | — | unknown |
6405 | firefox | POST | 200 | 95.101.54.107:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 185.125.190.97:80 | — | Canonical Group Limited | GB | unknown |
— | — | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
470 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
6248 | gvfsd-smb-browse | 192.168.100.255:137 | — | — | — | whitelisted |
485 | snapd | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
485 | snapd | 185.125.188.55:443 | api.snapcraft.io | Canonical Group Limited | GB | malicious |
6405 | firefox | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
6405 | firefox | 34.117.188.166:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | unknown |
6405 | firefox | 95.101.54.107:80 | r3.o.lencr.org | Akamai International B.V. | DE | unknown |
6405 | firefox | 142.250.184.234:443 | safebrowsing.googleapis.com | — | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
api.snapcraft.io |
| unknown |
connectivity-check.ubuntu.com |
| unknown |
124.100.168.192.in-addr.arpa |
| unknown |
detectportal.firefox.com |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
prod.ads.prod.webservices.mozgcp.net |
| unknown |
r3.o.lencr.org |
| shared |