Malware analysis gorgon-stress-1.9.2.deb Malicious activity

Add for printing

File name:	gorgon-stress-1.9.2.deb
Full analysis:	https://app.any.run/tasks/c35034d7-2f5d-469f-870e-0b978d5800d4
Verdict:	Malicious activity
Analysis date:	March 18, 2024, 18:37:53
OS:	Ubuntu 22.04.2
Indicators:
MIME:	application/vnd.debian.binary-package
File info:	Debian binary package (format 2.0), with control.tar.xz, data compression xz
MD5:	892BCFC2EC67C1C03188F6D7F6050717
SHA1:	C0CA00CFCFBB4867D0D46D4D1585DCF55F2E48E0
SHA256:	B8F15100C529E06F78593CFC4C93C07947D1D88A58C839793AB09A59A9FAF1BC
SSDEEP:	98304:l2UCWOyR6N1cIrDjxCCtYJ7995HXgbAfIN6tsu5VWc6LhHrFGrJ95hA1UAf1XNf/:Dp+LQSuzAwgFX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 9317)
  - apt (PID: 9306)
  - dpkg-preconfigure (PID: 9445)
  - apt (PID: 9397)
  - apt (PID: 9631)
- Modifies file or directory owner
  - tor.postinst (PID: 9500)
- Executes the "rm" command to delete files or directories
  - dpkg (PID: 9460)
  - dpkg (PID: 9842)
  - update-motd-updates-available (PID: 9637)
- Reads information about logins, logouts, and login attempts
  - invoke-rc.d (PID: 9609)
  - bash (PID: 9337)
- Reads /proc/mounts (likely used to find writable filesystems)
  - apparmor_parser (PID: 9544)
  - aa-enabled (PID: 9543)
- Creates or rewrites file in the "bin" folder
  - dpkg (PID: 9460)
- Changes time attribute to hide new files or make changes to the existing one
  - sh (PID: 9635)
- Writes to Systemd service files (likely for persistence achievement)
  - sudo (PID: 9841)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.deb	\|	Debian Linux Package (65.7)
.ar	\|	ar archive (19.1)
.kap	\|	MapInfo Sea Chart (15)

EXIF

EXE

CreateDate:	2024:03:16 07:47:58+00:00

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

696

Monitored processes

469

Malicious processes

0

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9304	/bin/sh -c "sudo apt install tor "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 9304
9305	sudo apt install tor	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 9304
9306	apt install tor	/usr/bin/apt	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 1
9307	/usr/bin/dpkg --print-foreign-architectures	/usr/bin/dpkg	—	apt
User: root Integrity Level: UNKNOWN Exit code: 0
9308	/usr/bin/dpkg --print-foreign-architectures	/usr/bin/dpkg	—	apt
User: root Integrity Level: UNKNOWN Exit code: 0
9310	/usr/bin/python3 /usr/bin/gnome-terminal	/usr/bin/gnome-terminal	—	gnome-shell
User: user Integrity Level: UNKNOWN Exit code: 0
9312	/usr/bin/gnome-terminal.real	/usr/bin/gnome-terminal.real	—	gnome-terminal
User: user Integrity Level: UNKNOWN Exit code: 0
9317	/usr/libexec/gnome-terminal-server	/usr/libexec/gnome-terminal-server	—	systemd
User: user Integrity Level: UNKNOWN Exit code: 0
9337	bash	/bin/bash	—	gnome-terminal-server
User: user Integrity Level: UNKNOWN Exit code: 0
9338	/bin/sh /usr/bin/lesspipe	/usr/bin/lesspipe	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9397	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.MWAmTs		—
		MD5:—	SHA256:—
9397	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.DMjFID		—
		MD5:—	SHA256:—
9397	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.z06u6z		—
		MD5:—	SHA256:—
9443	http	/var/cache/apt/archives/partial/tor_0.4.6.10-1_amd64.deb		—
		MD5:—	SHA256:—
9443	http	/var/cache/apt/archives/partial/torsocks_2.3.0-3_amd64.deb		—
		MD5:—	SHA256:—
9443	http	/var/cache/apt/archives/partial/tor-geoipdb_0.4.6.10-1_all.deb		—
		MD5:—	SHA256:—
9397	apt	/var/log/apt/eipp.log.xz		—
		MD5:—	SHA256:—
9397	apt	/var/lib/apt/extended_states.WtFXAb		—
		MD5:—	SHA256:—
9397	apt	/var/log/apt/term.log		—
		MD5:—	SHA256:—
9397	apt	/var/log/apt/history.log		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

3

TCP/UDP connections

12

DNS requests

8

Threats

8

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	—	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/t/torsocks/torsocks_2.3.0-3_amd64.deb	unknown	—	—	unknown
—	—	GET	200	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/t/tor/tor_0.4.6.10-1_amd64.deb	unknown	binary	1.59 Mb	unknown
—	—	GET	200	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/t/tor/tor-geoipdb_0.4.6.10-1_all.deb	unknown	binary	1.05 Mb	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	195.181.175.40:443	—	Datacamp Limited	DE	unknown
—	—	156.146.33.140:443	—	Datacamp Limited	DE	unknown
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	91.189.91.81:80	ie.archive.ubuntu.com	Canonical Group Limited	US	unknown
—	—	80.98.81.157:9001	—	Vodafone Hungary Ltd.	HU	unknown
—	—	192.160.102.164:9001	—	HEXTET	CA	unknown
—	—	146.59.234.220:443	—	OVH SAS	FR	unknown
—	—	5.79.93.243:9001	—	LeaseWeb Netherlands B.V.	NL	unknown
—	—	129.152.8.9:443	—	ORACLE-BMC-31898	IT	unknown

DNS requests

Domain	IP	Reputation
88.100.168.192.in-addr.arpa	—	unknown
api.snapcraft.io	185.125.188.58 185.125.188.55 185.125.188.54 185.125.188.59	unknown
connectivity-check.ubuntu.com	2620:2d:4000:1::98 2001:67c:1562::23 2001:67c:1562::24 2620:2d:4002:1::198 2620:2d:4000:1::22 2620:2d:4002:1::197 2620:2d:4000:1::2a 2620:2d:4000:1::96 2620:2d:4000:1::97 2620:2d:4000:1::23 2620:2d:4000:1::2b 2620:2d:4002:1::196	unknown
_http._tcp.ie.archive.ubuntu.com	—	unknown
ie.archive.ubuntu.com	91.189.91.81 185.125.190.36 91.189.91.83 91.189.91.82 185.125.190.39 2620:2d:4000:1::19 2620:2d:4000:1::16 2620:2d:4002:1::102 2620:2d:4002:1::101 2620:2d:4002:1::103	unknown

Threats

PID	Process	Class	Message
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 292
—	—	Misc activity	ET POLICY TLS possible TOR SSL traffic
—	—	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 193
—	—	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 153
—	—	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 137

Add for printing

No debug info

General Info

gorgon-stress-1.9.2.deb

892BCFC2EC67C1C03188F6D7F6050717

C0CA00CFCFBB4867D0D46D4D1585DCF55F2E48E0

B8F15100C529E06F78593CFC4C93C07947D1D88A58C839793AB09A59A9FAF1BC

98304:l2UCWOyR6N1cIrDjxCCtYJ7995HXgbAfIN6tsu5VWc6LhHrFGrJ95hA1UAf1XNf/:Dp+LQSuzAwgFX

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Modifies file or directory owner

Executes the "rm" command to delete files or directories

Reads information about logins, logouts, and login attempts

Reads /proc/mounts (likely used to find writable filesystems)

Creates or rewrites file in the "bin" folder

Changes time attribute to hide new files or make changes to the existing one

Writes to Systemd service files (likely for persistence achievement)

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings