File name:

brutils-2.7-1.sles.x86_64.rpm

Full analysis: https://app.any.run/tasks/da827476-0311-4df4-9cdd-258a62a8d243
Verdict: Malicious activity
Analysis date: April 29, 2025, 11:39:50
OS: Ubuntu 22.04.2
MIME: application/x-rpm
File info: RPM v3.0 bin i386/x86_64
MD5:

5AC88C1C22930FEC57E2AA34D22B73A1

SHA1:

F2F6CAE4ED168D81229D54333CCCCAA7B389FEBF

SHA256:

DA76DC964F7C223FF88D79797598116E937191E61209282560AD5694627742D7

SSDEEP:

24576:ZKqsj7wLT3ZddhP7LfV3QMiG8112aJuIfe489/iehYVNLjvQ8QxA:O7wLT3ZddhP7LfV3QMiG8112aJlP89/I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Modifies hosts file

      • file-roller (PID: 40665)

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • sudo (PID: 40664)

    • Reads passwd file

      • file-roller (PID: 40665)

    • Reads profile file

      • file-roller (PID: 40665)

    • Creates shell script file

      • file-roller (PID: 40665)

    • Writes to Systemd service files (likely for persistence achievement)

      • sudo (PID: 40664)

  • INFO

    • Checks timezone

      • file-roller (PID: 40665)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rpm | RPM Package (generic) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
237
Monitored processes
15
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start systemctl no specs dash no specs sudo no specs file-roller no specs locale-check no specs systemctl no specs systemctl no specs systemctl no specs systemd-hostnamed no specs gvfsd-network no specs gvfsd-smb-browse gvfsd-dnssd no specs tracker-extract-3 no specs dbus-daemon no specs nautilus no specs

Process information

PID
CMD
Path
Indicators
Parent process
40662systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40663/bin/sh -c "DISPLAY=:0 sudo -iu user file-roller /tmp/brutils-2\.7-1\.sles\.x86_64\.rpm "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
40664sudo -iu user file-roller /tmp/brutils-2.7-1.sles.x86_64.rpm/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
40665file-roller /tmp/brutils-2.7-1.sles.x86_64.rpm/usr/bin/file-roller—sudo
User:
user
Integrity Level:
UNKNOWN
40666/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40671systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40672systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40680systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40690/lib/systemd/systemd-hostnamed/usr/lib/systemd/systemd-hostnamed—systemd
User:
root
Integrity Level:
UNKNOWN
40691/usr/libexec/gvfsd-network --spawner :1.6 /org/gtk/gvfs/exec_spaw/1/usr/libexec/gvfsd-network—gvfsd
User:
user
Integrity Level:
UNKNOWN
Executable files
0
Suspicious files
0
Text files
118
Unknown types
0

Dropped files

PID
Process
Filename
Type
40665file-roller/home/user/etc/brutils/local.conftext
MD5:—
SHA256:—
40665file-roller/home/user/usr/sbin/brutilstext
MD5:—
SHA256:—
40665file-roller/home/user/usr/share/brutils/backup/BORG/default/100_get_suffix.shtext
MD5:—
SHA256:—
40665file-roller/home/user/usr/share/brutils/backup/BORG/default/500_make_backup.shtext
MD5:—
SHA256:—
40665file-roller/home/user/usr/share/brutils/backup/DUPLICITY/default/100_mount_duplicity_path.shtext
MD5:—
SHA256:—
40665file-roller/home/user/usr/share/brutils/backup/DUPLICITY/default/500_make_duplicity_backup.shtext
MD5:—
SHA256:—
40665file-roller/home/user/usr/share/brutils/backup/NETFS/default/100_mount_NETFS_path.shtext
MD5:—
SHA256:—
40665file-roller/home/user/usr/share/brutils/backup/NETFS/default/150_save_copy_of_prefix_dir.shtext
MD5:—
SHA256:—
40665file-roller/home/user/usr/share/brutils/backup/NETFS/default/250_create_lock.shtext
MD5:—
SHA256:—
40665file-roller/home/user/usr/share/brutils/backup/NETFS/default/970_remove_lock.shtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
14
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.97:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
185.125.190.97:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
169.150.255.184:443
odrs.gnome.org
—
GB
whitelisted
512
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
40700
gvfsd-smb-browse
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2001:67c:1562::24
  • 2620:2d:4000:1::2a
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::98
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::2b
  • 2001:67c:1562::23
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::22
  • 2620:2d:4002:1::196
  • 185.125.190.97
  • 91.189.91.98
  • 185.125.190.48
  • 185.125.190.98
  • 91.189.91.96
  • 185.125.190.96
  • 185.125.190.49
  • 91.189.91.97
  • 185.125.190.18
  • 185.125.190.17
  • 91.189.91.48
  • 91.189.91.49
whitelisted
google.com
  • 142.250.186.142
  • 2a00:1450:4001:829::200e
whitelisted
odrs.gnome.org
  • 169.150.255.184
  • 212.102.56.178
  • 195.181.175.41
  • 37.19.194.80
  • 195.181.170.19
  • 207.211.211.27
  • 169.150.255.181
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::18
whitelisted
api.snapcraft.io
  • 185.125.188.59
  • 185.125.188.55
  • 185.125.188.54
  • 185.125.188.58
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::6d
  • 2620:2d:4000:1010::344
whitelisted
5.100.168.192.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
brutils-2.7-1.sles.x86_64.rpm