| File name: | oldtimes-1c2c1fdd85d5bc9d0e30e708ef3e93ec.jpeg |
| Full analysis: | https://app.any.run/tasks/caec9743-e542-444b-9f76-07475a82a09d |
| Verdict: | Malicious activity |
| Analysis date: | April 10, 2024, 07:34:05 |
| OS: | Ubuntu 22.04.2 |
| MIME: | image/jpeg |
| File info: | JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, model=3dail8q, xresolution=82, yresolution=90, resolutionunit=2], progressive, precision 8, 2250x1500, components 3 |
| MD5: | 1C2C1FDD85D5BC9D0E30E708EF3E93EC |
| SHA1: | 65AC6FE9AF1430756B8C797DCB6BB791D8A56144 |
| SHA256: | B06EF5E4F8FA252E6B94DD74B7FFD15ED4F3FA62F47B13C88CFEA75D856FD4C8 |
| SSDEEP: | 12288:qbs8xtX8VO3jdAGbhjTRgr2vXERxqeG4JJrh:c7tsUTKGbhjTRgq2xqeG4JJrh |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executes commands using command-line interpreter
- gnome-terminal-server (PID: 9510)
- sudo (PID: 9264)
- dpkg-preconfigure (PID: 9647)
- apt (PID: 9599)
- apt (PID: 9720)
Reads information about logins, logouts, and login attempts
- bash (PID: 9528)
Creates or rewrites file in the "bin" folder
- dpkg (PID: 9662)
Executes the "rm" command to delete files or directories
- dpkg (PID: 9662)
- update-motd-updates-available (PID: 9726)
Changes time attribute to hide new files or make changes to the existing one
- sh (PID: 9724)
Uses base64 (probably to encode stolen data or decode malicious payload)
- bash (PID: 9528)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .jpg | | | JFIF-EXIF JPEG Bitmap (38.4) |
|---|---|---|
| .jpg | | | JFIF JPEG bitmap (30.7) |
| .jpg | | | JPEG bitmap (23) |
| .mp3 | | | MP3 audio (7.6) |
EXIF
JFIF
| JFIFVersion: | 1.01 |
|---|---|
| ResolutionUnit: | inches |
| XResolution: | 72 |
| YResolution: | 72 |
EXIF
| Model: | 3dail8q |
|---|---|
| XResolution: | 72 |
| YResolution: | 72 |
| ResolutionUnit: | inches |
| YCbCrPositioning: | Centered |
XMP
| XMPToolkit: | Image::ExifTool 11.91 |
|---|---|
| Rights: | 2012 VVIDM1VSQDN3dwIiiCd3M2aDNmI= , all rights reserved |
ICC_Profile
| ProfileCMMType: | Little CMS |
|---|---|
| ProfileVersion: | 2.1.0 |
| ProfileClass: | Display Device Profile |
| ColorSpaceData: | RGB |
| ProfileConnectionSpace: | XYZ |
| ProfileDateTime: | 2012:01:25 03:41:57 |
| ProfileFileSignature: | acsp |
| PrimaryPlatform: | Apple Computer Inc. |
| CMMFlags: | Not Embedded, Independent |
| DeviceManufacturer: | - |
| DeviceModel: | - |
| DeviceAttributes: | Reflective, Glossy, Positive, Color |
| RenderingIntent: | Perceptual |
| ConnectionSpaceIlluminant: | 0.9642 1 0.82491 |
| ProfileCreator: | Little CMS |
| ProfileID: | - |
| ProfileDescription: | c2 |
| ProfileCopyright: | IX |
| MediaWhitePoint: | 0.9642 1 0.82491 |
| MediaBlackPoint: | 0.01205 0.0125 0.01031 |
| RedMatrixColumn: | 0.43607 0.22249 0.01392 |
| GreenMatrixColumn: | 0.38515 0.71687 0.09708 |
| BlueMatrixColumn: | 0.14307 0.06061 0.7141 |
| RedTRC: | (Binary data 64 bytes, use -b option to extract) |
| GreenTRC: | (Binary data 64 bytes, use -b option to extract) |
| BlueTRC: | (Binary data 64 bytes, use -b option to extract) |
Composite
| ImageSize: | 2250x1500 |
|---|---|
| Megapixels: | 3.4 |
Total processes
610
Monitored processes
381
Malicious processes
0
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 9263 | /bin/sh -c "DISPLAY=:0 sudo -iu user /usr/bin/google-chrome-stable /tmp/oldtimes-1c2c1fdd85d5bc9d0e30e708ef3e93ec\.jpeg " | /bin/sh | — | any-guest-agent |
User: user Integrity Level: UNKNOWN Exit code: 9265 | ||||
| 9264 | sudo -iu user /usr/bin/google-chrome-stable /tmp/oldtimes-1c2c1fdd85d5bc9d0e30e708ef3e93ec.jpeg | /usr/bin/sudo | — | sh |
User: user Integrity Level: UNKNOWN Exit code: 9265 | ||||
| 9265 | /usr/bin/google-chrome-stable /tmp/oldtimes-1c2c1fdd85d5bc9d0e30e708ef3e93ec.jpeg | /opt/google/chrome/chrome | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 9265 | ||||
| 9266 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 9267 | readlink -f /usr/bin/google-chrome-stable | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 9268 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 9269 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 9270 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 9265 | ||||
| 9271 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 9265 | ||||
| 9272 | "/opt/google/chrome/chrome /tmp/oldtimes-1c2c1fdd85d5bc9d0e30e708ef3e93ec\.jpeg" | /opt/google/chrome/chrome | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 9265 | chrome | /9265/fd/63 | — | |
MD5:— | SHA256:— | |||
| 9265 | chrome | /home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-661640F4-2431.pma | — | |
MD5:— | SHA256:— | |||
| 9265 | chrome | /.com.google.Chrome.qAtFhQ | — | |
MD5:— | SHA256:— | |||
| 9265 | chrome | /.com.google.Chrome.FaBh09 | — | |
MD5:— | SHA256:— | |||
| 9265 | chrome | /.com.google.Chrome.2850Yz | — | |
MD5:— | SHA256:— | |||
| 9265 | chrome | /.com.google.Chrome.7ae8rO | — | |
MD5:— | SHA256:— | |||
| 9265 | chrome | /.com.google.Chrome.OhDFHe | — | |
MD5:— | SHA256:— | |||
| 9265 | chrome | /.com.google.Chrome.krS4x9 | — | |
MD5:— | SHA256:— | |||
| 9265 | chrome | /.com.google.Chrome.DS5zqA | — | |
MD5:— | SHA256:— | |||
| 9265 | chrome | /home/user/.config/google-chrome/Default/Session Storage/LOG | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
20
DNS requests
27
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 91.189.91.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
— | — | GET | — | 91.189.91.82:80 | http://ie.archive.ubuntu.com/ubuntu/pool/universe/libi/libimage-exiftool-perl/libimage-exiftool-perl_12.40%2bdfsg-1_all.deb | unknown | — | — | unknown |
— | — | GET | — | 91.189.91.82:80 | http://ie.archive.ubuntu.com/ubuntu/pool/universe/libm/libmime-charset-perl/libmime-charset-perl_1.012.2-1_all.deb | unknown | — | — | unknown |
— | — | GET | 200 | 91.189.91.82:80 | http://ie.archive.ubuntu.com/ubuntu/pool/main/liba/libarchive-zip-perl/libarchive-zip-perl_1.68-1_all.deb | unknown | binary | 88.0 Kb | unknown |
— | — | GET | — | 91.189.91.82:80 | http://ie.archive.ubuntu.com/ubuntu/pool/universe/s/sombok/libsombok3_2.4.0-2_amd64.deb | unknown | — | — | unknown |
— | — | GET | 200 | 91.189.91.82:80 | http://ie.archive.ubuntu.com/ubuntu/pool/universe/libu/libunicode-linebreak-perl/libunicode-linebreak-perl_0.0.20190101-1build3_amd64.deb | unknown | binary | 30.1 Kb | unknown |
— | — | GET | 204 | 185.125.190.96:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 91.189.91.98:80 | connectivity-check.ubuntu.com | Canonical Group Limited | US | unknown |
— | — | 91.189.91.48:80 | connectivity-check.ubuntu.com | Canonical Group Limited | US | unknown |
— | — | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 172.217.18.3:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
— | — | 74.125.71.84:443 | accounts.google.com | GOOGLE | US | unknown |
— | — | 216.58.206.67:443 | update.googleapis.com | GOOGLE | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
api.snapcraft.io |
| unknown |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
update.googleapis.com |
| whitelisted |
131.100.168.192.in-addr.arpa |
| unknown |
www.google.com |
| whitelisted |
optimizationguide-pa.googleapis.com |
| whitelisted |
connectivity-check.ubuntu.com |
| unknown |
_http._tcp.ie.archive.ubuntu.com |
| unknown |
ie.archive.ubuntu.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Not Suspicious Traffic | ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management |
— | — | Not Suspicious Traffic | ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management |
— | — | Not Suspicious Traffic | ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management |
— | — | Not Suspicious Traffic | ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management |
— | — | Not Suspicious Traffic | ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management |