Malware analysis UniKeyNT.exe Malicious activity | ANY.RUN

Add for printing

File name:	UniKeyNT.exe
Full analysis:	https://app.any.run/tasks/911da7d3-be17-4dd8-8fef-f3443607fa13
Verdict:	Malicious activity
Analysis date:	March 12, 2024, 10:09:30
OS:	Ubuntu 22.04.2
MIME:	application/x-dosexec
File info:	PE32+ executable (GUI) x86-64, for MS Windows
MD5:	95633564353DA11C2553DF08AD4A6A85
SHA1:	379A90B9C161C380906BE26B210DB35AA911216E
SHA256:	B732B1C198E7B0EBFCB0EF2F5D99F1888B5900460C1FA36EA27D47E8386684B1
SSDEEP:	49152:QnEO4SSh6OGcvbzaxsao4fbTuSqfb87GR5ndG:Qn4SSPvfaxsao4DGfJRm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - apt (PID: 9398)
  - gnome-terminal-server (PID: 9325)
  - su (PID: 9367)
  - apt-get (PID: 9458)
  - apt-get (PID: 9832)
- Executes the "rm" command to delete files or directories
  - apt-key (PID: 9479)
  - update-motd-updates-available (PID: 9847)
  - apt-key (PID: 9547)
  - apt-key (PID: 9554)
  - apt-key (PID: 9710)
  - apt-key (PID: 9625)
- Reads information about logins, logouts, and login attempts
  - sudo (PID: 9366)
  - bash (PID: 9343)
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 9319)
- Creates shell script file
  - apt-key (PID: 9710)
  - apt-key (PID: 9625)
  - apt-key (PID: 9479)
  - apt-key (PID: 9554)
  - apt-key (PID: 9547)
INFO
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 9351)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (87.3)
.exe	\|	Generic Win/DOS Executable (6.3)
.exe	\|	DOS Executable Generic (6.3)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2023:09:18 18:44:56+00:00
ImageFileCharacteristics:	No relocs, Executable, Large address aware
PEType:	PE32+
LinkerVersion:	14.37
CodeSize:	951808
InitializedDataSize:	1645056
UninitializedDataSize:	-
EntryPoint:	0x2b220
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI
FileVersionNumber:	4.6.2.0
ProductVersionNumber:	4.6.2.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
CompanyName:	unikey.org
FileDescription:	UniKey Program
FileVersion:	4.6.2.0
InternalName:	UniKeyNT.exe
LegalCopyright:	Copyright (C) 2000-2023 Pham Kim Long
OriginalFileName:	UniKeyNT.exe
ProductName:	UniKey
ProductVersion:	4.6 RC2 - Build 230919

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

903

Monitored processes

672

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9300	/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus \"/tmp/UniKeyNT\.exe\" "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 0
9301	sudo -iu user nautilus /tmp/UniKeyNT.exe	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 0
9302	nautilus /tmp/UniKeyNT.exe	/usr/bin/nautilus	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
9303	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	nautilus
User: user Integrity Level: UNKNOWN Exit code: 0
9319	/lib/systemd/systemd-hostnamed	/lib/systemd/systemd-hostnamed	—	systemd
User: root Integrity Level: UNKNOWN Exit code: 9319
9325	/usr/libexec/gnome-terminal-server	/usr/libexec/gnome-terminal-server	—	systemd
User: user Integrity Level: UNKNOWN Exit code: 0
9343	bash	/bin/bash	—	gnome-terminal-server
User: user Integrity Level: UNKNOWN Exit code: 0
9344	/bin/sh /usr/bin/lesspipe	/usr/bin/lesspipe	—	bash
User: user Integrity Level: UNKNOWN Exit code: 496
9345	basename /usr/bin/lesspipe	/usr/bin/basename	—	lesspipe
User: user Integrity Level: UNKNOWN Exit code: 496
9346	/bin/sh /usr/bin/lesspipe	/usr/bin/dash	—	lesspipe
User: user Integrity Level: UNKNOWN Exit code: 496

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9302	nautilus	/home/user/.local/share/nautilus/tags/meta.db-wal		—
		MD5:—	SHA256:—
9302	nautilus	/home/user/.local/share/nautilus/tags/meta.db-shm		—
		MD5:—	SHA256:—
9302	nautilus	/home/user/.local/share/nautilus/tags/.meta.isrunning		—
		MD5:—	SHA256:—
9377	apt-get	/var/cache/apt/archives/partial/.apt-acquire-privs-test.ymFVwn		—
		MD5:—	SHA256:—
9377	apt-get	/var/cache/apt/archives/partial/.apt-acquire-privs-test.TdQvTo		—
		MD5:—	SHA256:—
9377	apt-get	/var/cache/apt/archives/partial/.apt-acquire-privs-test.rO9Yk6		—
		MD5:—	SHA256:—
9377	apt-get	/var/cache/apt/archives/partial/.apt-acquire-privs-test.Xqv1OX		—
		MD5:—	SHA256:—
9377	apt-get	/var/cache/apt/archives/partial/.apt-acquire-privs-test.aT0TwC		—
		MD5:—	SHA256:—
9377	apt-get	/var/cache/apt/archives/partial/.apt-acquire-privs-test.GdU53m		—
		MD5:—	SHA256:—
9377	apt-get	/var/cache/apt/archives/partial/.apt-acquire-privs-test.ixwDqr		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

195

TCP/UDP connections

26

DNS requests

28

Threats

292

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/g/gcc-12/libgcc-s1_12.3.0-1ubuntu1%7e22.04_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/libc/libcap2/libcap2_2.44-1ubuntu0.22.04.1_i386.deb	unknown	—	—	unknown
—	—	GET	200	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/g/gcc-12/gcc-12-base_12.3.0-1ubuntu1%7e22.04_i386.deb	unknown	binary	19.6 Kb	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/g/glibc/libc6_2.35-0ubuntu3.5_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/libx/libxcrypt/libcrypt1_4.4.27-1_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/x/xz-utils/liblzma5_5.2.5-2ubuntu1_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/libg/libgpg-error/libgpg-error0_1.43-3_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/libg/libgcrypt20/libgcrypt20_1.9.4-3ubuntu3_i386.deb	unknown	—	—	unknown
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/l/lz4/liblz4-1_1.9.3-2build2_i386.deb	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	91.189.91.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	unknown
—	—	195.181.170.19:443	—	Datacamp Limited	DE	unknown
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	156.146.33.140:443	—	Datacamp Limited	DE	unknown
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	91.189.91.81:80	ie.archive.ubuntu.com	Canonical Group Limited	US	unknown

DNS requests

Domain	IP	Reputation
api.snapcraft.io	185.125.188.54 185.125.188.59 185.125.188.58 185.125.188.55	unknown
142.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4002:1::197 2620:2d:4000:1::22 2620:2d:4000:1::98 2001:67c:1562::23 2620:2d:4000:1::96 2620:2d:4000:1::23 2620:2d:4000:1::2b 2001:67c:1562::24 2620:2d:4000:1::2a 2620:2d:4000:1::97 2620:2d:4002:1::196 2620:2d:4002:1::198 185.125.190.48 91.189.91.48 185.125.190.17 91.189.91.98 185.125.190.98 185.125.190.97 91.189.91.49 91.189.91.96 91.189.91.97 185.125.190.18 185.125.190.49 185.125.190.96	unknown
_http._tcp.ie.archive.ubuntu.com	—	unknown
ie.archive.ubuntu.com	91.189.91.81 91.189.91.83 185.125.190.36 185.125.190.39 91.189.91.82 2620:2d:4002:1::103 2620:2d:4000:1::16 2620:2d:4002:1::102 2620:2d:4000:1::19 2620:2d:4002:1::101	unknown
_https._tcp.dl.google.com	—	unknown
dl.google.com	216.58.206.78 2a00:1450:4001:80f::200e	whitelisted
_https._tcp.motd.ubuntu.com	—	unknown
motd.ubuntu.com	54.217.10.153 54.247.62.1 34.243.160.129 34.254.182.186 54.171.230.55 2a05:d018:91c:3200:d8b6:37bc:63f9:703c 2a05:d018:91c:3200:c887:2f22:290f:a7c 2a05:d018:91c:3200:5e0d:21a9:26ca:90b5 2a05:d018:91c:3200:2846:99fb:81b6:1e11 2a05:d018:91c:3200:c8f:1a06:a2dd:450f	unknown
_https._tcp.esm.ubuntu.com	—	unknown

Threats

PID	Process	Class	Message
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management

Add for printing

No debug info

General Info

UniKeyNT.exe

95633564353DA11C2553DF08AD4A6A85

379A90B9C161C380906BE26B210DB35AA911216E

B732B1C198E7B0EBFCB0EF2F5D99F1888B5900460C1FA36EA27D47E8386684B1

49152:QnEO4SSh6OGcvbzaxsao4fbTuSqfb87GR5ndG:Qn4SSPvfaxsao4DGfJRm

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Executes the "rm" command to delete files or directories

Reads information about logins, logouts, and login attempts

Checks DMI information (probably VM detection)

Creates shell script file

INFO

Manipulating modules (likely to execute programs on system boot)

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings