Malware analysis email.eml Malicious activity | ANY.RUN

Add for printing

File name:	email.eml
Full analysis:	https://app.any.run/tasks/16119230-bbb6-4ce9-b4ee-2484ab522f96
Verdict:	Malicious activity
Analysis date:	March 24, 2025, 20:15:45
OS:	Ubuntu 22.04.2
Tags:	dkim-fail
MIME:	message/rfc822
File info:	RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
MD5:	7E9EE4C46E95C973BC84B2F90B7F3253
SHA1:	EAF6C261018AEC77D0A92E0C000A3154D02A119C
SHA256:	C082DD12C4C21D3B6F23D8DC7E52D1A37985D1A9AF3F29F4C7BFBBE978606887
SSDEEP:	1536:0PPekvJaY6w4o6kbhslzzTqa+0e/owGH80pYCFop9EMSddYS:0PB4o6kEfDe/ozH8xCFWiTn/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Creates files in the user directory
  - glxtest (PID: 40664)
  - thunderbird (PID: 40656)
- Reads profile file
  - thunderbird (PID: 40656)
- Reads passwd file
  - thunderbird (PID: 40656)
  - glxtest (PID: 40664)
- Check the Environment Variables Related to System Identification (os-release)
  - python3.10 (PID: 40682)
  - thunderbird (PID: 40656)
- Reads /proc/mounts (likely used to find writable filesystems)
  - thunderbird (PID: 40656)
INFO
- Checks timezone
  - python3.10 (PID: 40682)
  - thunderbird (PID: 40656)
  - chrome (PID: 40805)
  - chrome (PID: 41124)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.eml	\|	E-Mail message (Var. 5) (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

393

Monitored processes

171

Malicious processes

1

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
445	/lib/systemd/systemd-resolved	/usr/lib/systemd/systemd-resolved		systemd
User: systemd-resolve Integrity Level: UNKNOWN
40654	/bin/sh -c "DISPLAY=:0 sudo -iu user thunderbird /tmp/email\.eml "	/usr/bin/dash	—	any-guest-agent
User: user Integrity Level: UNKNOWN
40655	sudo -iu user thunderbird /tmp/email.eml	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
40656	/usr/lib/thunderbird/thunderbird /tmp/email.eml	/usr/lib/thunderbird/thunderbird		sudo
User: user Integrity Level: UNKNOWN
40657	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	thunderbird
User: user Integrity Level: UNKNOWN Exit code: 0
40658	/bin/sh /usr/bin/which /usr/bin/thunderbird	/usr/bin/dash	—	thunderbird
User: user Integrity Level: UNKNOWN Exit code: 0
40659	/usr/lib/thunderbird/thunderbird /tmp/email.eml	/usr/lib/thunderbird/thunderbird	—	thunderbird
User: user Integrity Level: UNKNOWN Exit code: 0
40664	/usr/lib/thunderbird/glxtest -f 12	/usr/lib/thunderbird/glxtest	—	thunderbird
User: user Integrity Level: UNKNOWN Exit code: 0
40682	/usr/bin/python3 -Es /usr/bin/lsb_release -idrc	/usr/bin/python3.10	—	thunderbird
User: user Integrity Level: UNKNOWN Exit code: 0
40761	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

2

Suspicious files

468

Text files

28

Unknown types

2

Dropped files

PID	Process	Filename		Type
40805	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
40805	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
40805	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
41124	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
41124	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
41124	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
40805	chrome	/home/user/.config/google-chrome/Default/Sync Data/LevelDB/MANIFEST-000001		binary
		MD5:—	SHA256:—
40805	chrome	/home/user/.config/google-chrome/Default/shared_proto_db/metadata/MANIFEST-000001		binary
		MD5:—	SHA256:—
40805	chrome	/home/user/.config/google-chrome/Default/Extension State/MANIFEST-000001		binary
		MD5:—	SHA256:—
40805	chrome	/home/user/.config/google-chrome/Default/shared_proto_db/MANIFEST-000001		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

150

DNS requests

252

Threats

221

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
1178	snap-store	195.181.175.41:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
512	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
40656	thunderbird	3.167.227.56:443	services.addons.thunderbird.net	—	US	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
40850	chrome	142.250.184.227:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
40850	chrome	172.217.23.106:443	safebrowsingohttpgateway.googleapis.com	GOOGLE	US	whitelisted
40850	chrome	52.71.28.102:443	urldefense.com	AMAZON-AES	US	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.185.78 2a00:1450:4001:81c::200e	whitelisted
connectivity-check.ubuntu.com	91.189.91.96 185.125.190.17 185.125.190.48 91.189.91.98 185.125.190.98 185.125.190.49 185.125.190.97 91.189.91.49 185.125.190.18 91.189.91.48 185.125.190.96 91.189.91.97 2620:2d:4000:1::23 2620:2d:4000:1::22 2620:2d:4002:1::198 2001:67c:1562::24 2620:2d:4002:1::196 2620:2d:4000:1::96 2620:2d:4000:1::2b 2620:2d:4000:1::97 2620:2d:4002:1::197 2620:2d:4000:1::2a 2620:2d:4000:1::98 2001:67c:1562::23	whitelisted
odrs.gnome.org	195.181.175.41 207.211.211.26 195.181.170.18 169.150.255.181 169.150.255.183 212.102.56.178 37.19.194.80 2a02:6ea0:c700::21 2a02:6ea0:c700::107 2a02:6ea0:c700::19 2a02:6ea0:c700::18 2a02:6ea0:c700::101 2a02:6ea0:c700::11 2a02:6ea0:c700::112	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.54 185.125.188.59 185.125.188.58 2620:2d:4000:1010::344 2620:2d:4000:1010::42 2620:2d:4000:1010::6d 2620:2d:4000:1010::117	whitelisted
services.addons.thunderbird.net	3.167.227.56 3.167.227.14 3.167.227.80 3.167.227.19 2600:9000:27e6:c800:c:19e4:9800:93a1 2600:9000:27e6:5c00:c:19e4:9800:93a1 2600:9000:27e6:a600:c:19e4:9800:93a1 2600:9000:27e6:d600:c:19e4:9800:93a1 2600:9000:27e6:bc00:c:19e4:9800:93a1 2600:9000:27e6:1000:c:19e4:9800:93a1 2600:9000:27e6:7800:c:19e4:9800:93a1 2600:9000:27e6:9200:c:19e4:9800:93a1	whitelisted
12.100.168.192.in-addr.arpa	—	unknown
clientservices.googleapis.com	142.250.184.227	whitelisted
safebrowsingohttpgateway.googleapis.com	172.217.23.106 142.250.186.74 142.250.186.42 142.250.181.234 142.250.186.170 142.250.185.170 142.250.185.234 142.250.185.74 142.250.185.106 216.58.212.170 142.250.185.138 142.250.186.138 142.250.186.106 172.217.16.202 142.250.185.202 216.58.206.42	whitelisted
urldefense.com	52.71.28.102 52.204.90.22 52.6.56.188	whitelisted
accounts.google.com	142.251.18.84	whitelisted

Threats

PID	Process	Class	Message
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
445	systemd-resolved	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
40850	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
40850	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
40850	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
40850	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
40850	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
40850	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
40850	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
40850	chrome	Generic Protocol Command Decode	SURICATA QUIC failed decrypt

Add for printing

No debug info

General Info

email.eml

7E9EE4C46E95C973BC84B2F90B7F3253

EAF6C261018AEC77D0A92E0C000A3154D02A119C

C082DD12C4C21D3B6F23D8DC7E52D1A37985D1A9AF3F29F4C7BFBBE978606887

1536:0PPekvJaY6w4o6kbhslzzTqa+0e/owGH80pYCFop9EMSddYS:0PB4o6kEfDe/ozH8xCFWiTn/

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Creates files in the user directory

Reads profile file

Reads passwd file

Check the Environment Variables Related to System Identification (os-release)

Reads /proc/mounts (likely used to find writable filesystems)

INFO

Checks timezone

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings