File name:

Minecraft.deb

Full analysis: https://app.any.run/tasks/312887ce-d9d2-4c33-9125-bf98c90c81d1
Verdict: Malicious activity
Analysis date: April 26, 2025, 09:50:41
OS: Ubuntu 22.04.2
MIME: application/vnd.debian.binary-package
File info: Debian binary package (format 2.0), with control.tar.xz , data compression xz
MD5:

E101E48887FA89BE95695171F81DBFCC

SHA1:

D1D58B6F8112455397F01213E19B11117C048BF6

SHA256:

DE839E5221B215B2C9D39EC9D9DCAC9B143ED43E994E1160A31F7F81C91BE9EE

SSDEEP:

24576:9ITj2BBdFURAsIV15uA8wxNAsPHGfpx0zrwkh6cZxbJ3RLfU0apuSlMsh/dcFYQB:STj2BBdFUmsIV1YA8wxNAOHCx0zrwkhp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • sudo (PID: 40670)

    • Creates or rewrites file in the "bin" folder

      • dpkg (PID: 40673)

    • Reads passwd file

      • tar (PID: 40678)
      • dpkg (PID: 40673)

    • Executes the "rm" command to delete files or directories

      • dpkg (PID: 40673)

  • INFO

    • Checks timezone

      • dpkg (PID: 40673)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.deb | Debian Linux Package (77.4)
.ar | ar archive (22.5)

EXIF

EXE

CreateDate: 2024:09:25 21:29:29+00:00
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
245
Monitored processes
22
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs sudo no specs locale-check no specs dpkg no specs dpkg-split no specs dpkg-deb no specs dpkg-deb no specs dpkg-deb no specs tar no specs dpkg-deb no specs dpkg-deb no specs dpkg-deb no specs rm no specs dash no specs perl no specs dash no specs update-desktop-database no specs dash no specs dash no specs dash no specs gtk-update-icon-cache no specs

Process information

PID
CMD
Path
Indicators
Parent process
40669/bin/sh -c "DISPLAY=:0 sudo -iu user sudo dpkg -i /home/user/Desktop/Minecraft\.deb "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
256
40670sudo -iu user sudo dpkg -i /home/user/Desktop/Minecraft.deb/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
40671sudo dpkg -i /home/user/Desktop/Minecraft.deb/usr/bin/sudo—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
40672/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40673dpkg -i /home/user/Desktop/Minecraft.deb/usr/bin/dpkg—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
40674dpkg-split -Qao /var/lib/dpkg/reassemble.deb /home/user/Desktop/Minecraft.deb/usr/bin/dpkg-split—dpkg
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
40675dpkg-deb --control /home/user/Desktop/Minecraft.deb /var/lib/dpkg/tmp.ci/usr/bin/dpkg-deb—dpkg
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40676dpkg-deb --control /home/user/Desktop/Minecraft.deb /var/lib/dpkg/tmp.ci/usr/bin/dpkg-deb—dpkg-deb
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40677dpkg-deb --control /home/user/Desktop/Minecraft.deb /var/lib/dpkg/tmp.ci/usr/bin/dpkg-deb—dpkg-deb
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40678tar -x -f - --warning=no-timestamp/usr/bin/tar—dpkg-deb
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
2
Text files
26
Unknown types
0

Dropped files

PID
Process
Filename
Type
40673dpkg/var/lib/dpkg/tmp.ci/controltext
MD5:—
SHA256:—
40678tar/var/lib/dpkg/tmp.ci/controltext
MD5:—
SHA256:—
40673dpkg/var/lib/dpkg/updates/0000text
MD5:—
SHA256:—
40673dpkg/usr/bin/minecraft-launcherbinary
MD5:—
SHA256:—
40673dpkg/usr/share/applications/minecraft-launcher.desktoptext
MD5:—
SHA256:—
40673dpkg/usr/share/icons/hicolor/symbolic/apps/minecraft-launcher.svgimage
MD5:—
SHA256:—
40673dpkg/var/lib/dpkg/info/minecraft-launcher.listtext
MD5:—
SHA256:—
40673dpkg/var/lib/dpkg/info/minecraft-launcher.md5sumstext
MD5:—
SHA256:—
40685perl/etc/mailcaptext
MD5:—
SHA256:—
40687update-desktop-database/usr/share/applications/mimeinfo.cachetext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
14
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.18:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
91.189.91.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
91.189.91.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
POST
200
185.125.188.54:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.5 Kb
whitelisted
—
—
POST
200
185.125.188.58:443
https://api.snapcraft.io/api/v1/snaps/auth/nonces
unknown
binary
54 b
whitelisted
—
—
POST
200
185.125.188.55:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.5 Kb
whitelisted
—
—
POST
200
185.125.188.55:443
https://api.snapcraft.io/api/v1/snaps/auth/sessions
unknown
binary
587 b
whitelisted
—
—
GET
200
185.125.188.54:443
https://api.snapcraft.io/v2/snaps/info/curl?architecture=amd64&fields=architectures%2Cbase%2Cconfinement%2Clinks%2Ccontact%2Ccreated-at%2Cdescription%2Cdownload%2Cepoch%2Clicense%2Cname%2Cprices%2Cprivate%2Cpublisher%2Crevision%2Csnap-id%2Csummary%2Ctitle%2Ctype%2Cversion%2Cwebsite%2Cstore-url%2Cmedia%2Ccommon-ids%2Ccategories
unknown
binary
3.07 Kb
whitelisted
—
—
POST
200
185.125.188.58:443
https://api.snapcraft.io/api/v1/snaps/auth/sessions
unknown
—
—
whitelisted
—
—
POST
200
185.125.188.59:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
91.189.91.98:80
—
Canonical Group Limited
US
unknown
—
—
91.189.91.96:80
—
Canonical Group Limited
US
unknown
—
—
37.19.194.81:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
—
—
169.150.255.183:443
odrs.gnome.org
—
GB
whitelisted
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.190.18:80
—
Canonical Group Limited
GB
unknown
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted

DNS requests

Domain
IP
Reputation
odrs.gnome.org
  • 37.19.194.81
  • 212.102.56.179
  • 169.150.255.180
  • 195.181.175.41
  • 207.211.211.26
  • 169.150.255.183
  • 195.181.170.18
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::19
whitelisted
api.snapcraft.io
  • 185.125.188.55
  • 185.125.188.58
  • 185.125.188.54
  • 185.125.188.59
  • 2620:2d:4000:1010::6d
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::42
whitelisted
google.com
  • 142.250.185.238
  • 2a00:1450:4001:829::200e
whitelisted
9.100.168.192.in-addr.arpa
  • —
unknown
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::96
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::98
  • 2001:67c:1562::24
  • 2001:67c:1562::23
  • 2620:2d:4002:1::198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Minecraft.deb