Malware analysis gorgon-stress-1.9.2.deb Malicious activity

Add for printing

File name:	gorgon-stress-1.9.2.deb
Full analysis:	https://app.any.run/tasks/0f742048-75fd-45d4-934c-28fb1d513a19
Verdict:	Malicious activity
Analysis date:	March 18, 2024, 18:44:37
OS:	Ubuntu 22.04.2
Indicators:
MIME:	application/vnd.debian.binary-package
File info:	Debian binary package (format 2.0), with control.tar.xz, data compression xz
MD5:	892BCFC2EC67C1C03188F6D7F6050717
SHA1:	C0CA00CFCFBB4867D0D46D4D1585DCF55F2E48E0
SHA256:	B8F15100C529E06F78593CFC4C93C07947D1D88A58C839793AB09A59A9FAF1BC
SSDEEP:	98304:l2UCWOyR6N1cIrDjxCCtYJ7995HXgbAfIN6tsu5VWc6LhHrFGrJ95hA1UAf1XNf/:Dp+LQSuzAwgFX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Adds/modifies system service, likely for persistence
  - dpkg (PID: 9430)
SUSPICIOUS
- Writes to Systemd service files (likely for persistence achievement)
  - sudo (PID: 9308)
  - apt (PID: 9361)
- Executes commands using command-line interpreter
  - dpkg-preconfigure (PID: 9415)
  - apt (PID: 9361)
  - gnome-terminal-server (PID: 9329)
  - apt (PID: 9724)
- Modifies Cron jobs
  - apt (PID: 9361)
- Modifies file or directory owner
  - tor.postinst (PID: 9445)
- Executes the "rm" command to delete files or directories
  - dpkg (PID: 9430)
  - dpkg (PID: 9310)
  - dpkg (PID: 9839)
  - update-motd-updates-available (PID: 9730)
- Creates or rewrites file in the "bin" folder
  - dpkg (PID: 9430)
- Reads /proc/mounts (likely used to find writable filesystems)
  - aa-enabled (PID: 9488)
- Reads information about logins, logouts, and login attempts
  - invoke-rc.d (PID: 9554)
  - bash (PID: 9347)
- Changes time attribute to hide new files or make changes to the existing one
  - sh (PID: 9728)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.deb	\|	Debian Linux Package (65.7)
.ar	\|	ar archive (19.1)
.kap	\|	MapInfo Sea Chart (15)

EXIF

EXE

CreateDate:	2024:03:16 07:47:58+00:00

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

806

Monitored processes

578

Malicious processes

1

Suspicious processes

2

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9306	/bin/sh -c "DISPLAY=:0 sudo -iu user sudo dpkg -i \"/home/user/Desktop/gorgon-stress-1\.9\.2\.deb\" "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 9310
9307	sudo -iu user sudo dpkg -i /home/user/Desktop/gorgon-stress-1.9.2.deb	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 9310
9308	sudo dpkg -i /home/user/Desktop/gorgon-stress-1.9.2.deb	/usr/bin/sudo	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 9310
9309	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
9310	dpkg -i /home/user/Desktop/gorgon-stress-1.9.2.deb	/usr/bin/dpkg	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 9310
9311	dpkg-split -Qao /var/lib/dpkg/reassemble.deb /home/user/Desktop/gorgon-stress-1.9.2.deb	/usr/bin/dpkg-split	—	dpkg
User: root Integrity Level: UNKNOWN Exit code: 0
9312	dpkg-deb --control /home/user/Desktop/gorgon-stress-1.9.2.deb /var/lib/dpkg/tmp.ci	/usr/bin/dpkg-deb	—	dpkg
User: root Integrity Level: UNKNOWN Exit code: 0
9313	dpkg-deb --control /home/user/Desktop/gorgon-stress-1.9.2.deb /var/lib/dpkg/tmp.ci	/usr/bin/dpkg-deb	—	dpkg-deb
User: root Integrity Level: UNKNOWN Exit code: 0
9314	dpkg-deb --control /home/user/Desktop/gorgon-stress-1.9.2.deb /var/lib/dpkg/tmp.ci	/usr/bin/dpkg-deb	—	dpkg-deb
User: root Integrity Level: UNKNOWN Exit code: 0
9315	tar -x -f - --warning=no-timestamp	/usr/bin/tar	—	dpkg-deb
User: root Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9310	dpkg	/var/lib/dpkg/updates/tmp.i		—
		MD5:—	SHA256:—
9310	dpkg	/var/lib/dpkg/triggers/Lock		—
		MD5:—	SHA256:—
9310	dpkg	/var/log/dpkg.log		—
		MD5:—	SHA256:—
9315	tar	/var/lib/dpkg/tmp.ci/control		—
		MD5:—	SHA256:—
9315	tar	/var/lib/dpkg/tmp.ci/postinst		—
		MD5:—	SHA256:—
9310	dpkg	/etc/systemd/system/gorgon-stress.service.dpkg-new		—
		MD5:—	SHA256:—
9310	dpkg	/opt/gorgon-stress/config.json.distr.dpkg-new		—
		MD5:—	SHA256:—
9310	dpkg	/opt/gorgon-stress/gorgon.dpkg-new		—
		MD5:—	SHA256:—
9310	dpkg	/opt/gorgon-stress/torrc.dpkg-new		—
		MD5:—	SHA256:—
9310	dpkg	/opt/gorgon-stress/url.csv.dpkg-new		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

2

TCP/UDP connections

12

DNS requests

6

Threats

5

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	200	185.125.190.36:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/t/tor/tor_0.4.6.10-1_amd64.deb	unknown	binary	1.59 Mb	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.49:80	—	Canonical Group Limited	US	unknown
—	—	185.125.190.17:80	—	Canonical Group Limited	GB	unknown
—	—	185.125.190.48:80	—	Canonical Group Limited	GB	unknown
—	—	185.125.190.36:80	ie.archive.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	107.189.12.238:9000	—	PONYNET	LU	unknown
—	—	94.100.6.30:9001	—	Telia Latvija SIA	LV	unknown
—	—	88.216.223.2:1337	—	Canopus It Solutions Pvt Ltd	LT	unknown
—	—	62.210.123.24:443	—	Online S.a.s.	FR	unknown
—	—	95.216.96.44:4443	—	Hetzner Online GmbH	FI	unknown

DNS requests

Domain	IP	Reputation
91.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4000:1::2b 2620:2d:4002:1::198 2001:67c:1562::24 2001:67c:1562::23 2620:2d:4000:1::23 2620:2d:4000:1::96 2620:2d:4000:1::22 2620:2d:4000:1::2a 2620:2d:4002:1::196 2620:2d:4000:1::97 2620:2d:4000:1::98 2620:2d:4002:1::197	unknown
_http._tcp.ie.archive.ubuntu.com	—	unknown
ie.archive.ubuntu.com	185.125.190.36 91.189.91.82 185.125.190.39 91.189.91.81 91.189.91.83 2620:2d:4000:1::16 2620:2d:4002:1::103 2620:2d:4000:1::19 2620:2d:4002:1::101 2620:2d:4002:1::102	unknown

Threats

PID	Process	Class	Message
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 822
—	—	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 708
—	—	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 791
—	—	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 836

Add for printing

No debug info

General Info

gorgon-stress-1.9.2.deb

892BCFC2EC67C1C03188F6D7F6050717

C0CA00CFCFBB4867D0D46D4D1585DCF55F2E48E0

B8F15100C529E06F78593CFC4C93C07947D1D88A58C839793AB09A59A9FAF1BC

98304:l2UCWOyR6N1cIrDjxCCtYJ7995HXgbAfIN6tsu5VWc6LhHrFGrJ95hA1UAf1XNf/:Dp+LQSuzAwgFX

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Adds/modifies system service, likely for persistence

SUSPICIOUS

Writes to Systemd service files (likely for persistence achievement)

Executes commands using command-line interpreter

Modifies Cron jobs

Modifies file or directory owner

Executes the "rm" command to delete files or directories

Creates or rewrites file in the "bin" folder

Reads /proc/mounts (likely used to find writable filesystems)

Reads information about logins, logouts, and login attempts

Changes time attribute to hide new files or make changes to the existing one

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings