File name:

Linux.Snoopy.C.zip

Full analysis: https://app.any.run/tasks/b40888f9-b1cc-4bbf-9fca-bccd46ae015d
Verdict: Malicious activity
Analysis date: February 13, 2024, 23:37:50
OS: Ubuntu 22.04.2
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

328DA526D939473D1319004654721368

SHA1:

899F0B5009AE379EC7595C78913B60BFA2E8A58A

SHA256:

CCE7D60365078E9F3F2A766ED0F42012D953200A4E0E5EABF8B732DF955CA784

SSDEEP:

192:gqLQkJ2k7JSE5KV4D/gmW2ApKAiUyuD2JZKVqV:eHk7sB4A24Kky4wV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Checks DMI information (probably VM detection)

      • systemd-hostnamed (PID: 7980)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:01:09 22:40:54
ZipCRC: 0xfc8589d2
ZipCompressedSize: 2954
ZipUncompressedSize: 13182
ZipFileName: X23
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
228
Monitored processes
8
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sh no specs sudo no specs file-roller no specs locale-check no specs 7z no specs dbus-daemon no specs nautilus no specs systemd-hostnamed no specs

Process information

PID
CMD
Path
Indicators
Parent process
7940/bin/sh -c "DISPLAY=:0 sudo -iu user file-roller \"/tmp/Linux\.Snoopy\.C\.zip\" "/bin/sh—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
1214
7941sudo -iu user file-roller /tmp/Linux.Snoopy.C.zip/usr/bin/sudo—sh
User:
user
Integrity Level:
UNKNOWN
Exit code:
1214
7942file-roller /tmp/Linux.Snoopy.C.zip/usr/bin/file-roller—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
1214
7943/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
7957/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/Linux.Snoopy.C.zip/usr/lib/p7zip/7z—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
7942
7965/usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only/usr/bin/dbus-daemon—dbus-daemon
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
7966/usr/bin/nautilus --gapplication-service/usr/bin/nautilus—dbus-daemon
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
7980/lib/systemd/systemd-hostnamed/lib/systemd/systemd-hostnamed—systemd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7966nautilus/home/user/.local/share/nautilus/tags/meta.db-wal —
MD5:—
SHA256:—
7966nautilus/home/user/.local/share/nautilus/tags/meta.db-shm —
MD5:—
SHA256:—
7966nautilus/home/user/.local/share/nautilus/tags/.meta.isrunning —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
7
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.97:80
—
Canonical Group Limited
US
unknown
—
—
185.125.190.49:80
—
Canonical Group Limited
GB
unknown
—
—
156.146.33.140:443
—
Datacamp Limited
DE
unknown
—
—
212.102.56.182:443
—
Datacamp Limited
DE
unknown
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
unknown

DNS requests

Domain
IP
Reputation
214.100.168.192.in-addr.arpa
  • —
unknown
api.snapcraft.io
  • 185.125.188.54
  • 185.125.188.59
  • 185.125.188.58
  • 185.125.188.55
unknown
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::198
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::23
  • 2001:67c:1562::23
  • 2620:2d:4000:1::2a
  • 2001:67c:1562::24
  • 2620:2d:4000:1::98
  • 2620:2d:4002:1::197
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Linux.Snoopy.C.zip