Malware analysis xz-utils_5.6.1+really5.4.5-1_amd64.deb Malicious activity

Add for printing

File name:	xz-utils_5.6.1+really5.4.5-1_amd64.deb
Full analysis:	https://app.any.run/tasks/2a7a1d33-4687-45dd-b2d6-dce422aa26f9
Verdict:	Malicious activity
Analysis date:	March 31, 2024, 11:53:34
OS:	Ubuntu 22.04.2
Tags:	opendir
MIME:	application/vnd.debian.binary-package
File info:	Debian binary package (format 2.0), with control.tar.zs, data compression zst
MD5:	B0D48759E30A4B6EDA9A11B8137D6AFE
SHA1:	02DEAFD2B1550AAF762CFA60FAFCC70DC80B442C
SHA256:	E9B203A056BE748BF343812C5527B27DDBEF0B57B2B925EEE2E07D4F08452E5F
SSDEEP:	12288:SDdECvZx6Dq7e82wdjVRKG9iDjj54nWUm1:SD6CvZx6DeT2wdRRKG9cjjOnm1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes the "rm" command to delete files or directories
  - dpkg (PID: 9303)
  - dpkg (PID: 10043)
  - dpkg (PID: 9965)
- Creates or rewrites file in the "bin" folder
  - dpkg (PID: 9303)
  - dpkg (PID: 9965)
  - dpkg (PID: 10043)
- Reads /proc/mounts (likely used to find writable filesystems)
  - firefox (PID: 9318)
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 9912)
- Reads information about logins, logouts, and login attempts
  - bash (PID: 9930)
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 9956)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.deb	\|	Debian Linux Package (77.4)
.ar	\|	ar archive (22.5)

EXIF

EXE

CreateDate:	2024:03:28 14:59:38+00:00

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

470

Monitored processes

248

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9299	/bin/sh -c "DISPLAY=:0 sudo -iu user sudo dpkg -i \"/tmp/xz-utils_5\.6\.1+really5\.4\.5-1_amd64\.deb\" "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 9303
9300	sudo -iu user sudo dpkg -i /tmp/xz-utils_5.6.1+really5.4.5-1_amd64.deb	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 9303
9301	sudo dpkg -i /tmp/xz-utils_5.6.1+really5.4.5-1_amd64.deb	/usr/bin/sudo	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 9303
9302	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
9303	dpkg -i /tmp/xz-utils_5.6.1+really5.4.5-1_amd64.deb	/usr/bin/dpkg	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 9303
9304	dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/xz-utils_5.6.1+really5.4.5-1_amd64.deb	/usr/bin/dpkg-split	—	dpkg
User: root Integrity Level: UNKNOWN Exit code: 0
9305	dpkg-deb --control /tmp/xz-utils_5.6.1+really5.4.5-1_amd64.deb /var/lib/dpkg/tmp.ci	/usr/bin/dpkg-deb	—	dpkg
User: root Integrity Level: UNKNOWN Exit code: 0
9306	dpkg-deb --control /tmp/xz-utils_5.6.1+really5.4.5-1_amd64.deb /var/lib/dpkg/tmp.ci	/usr/bin/dpkg-deb	—	dpkg-deb
User: root Integrity Level: UNKNOWN Exit code: 0
9307	dpkg-deb --control /tmp/xz-utils_5.6.1+really5.4.5-1_amd64.deb /var/lib/dpkg/tmp.ci	/usr/bin/dpkg-deb	—	dpkg-deb
User: root Integrity Level: UNKNOWN Exit code: 0
9308	tar -x -f - --warning=no-timestamp	/usr/bin/tar	—	dpkg-deb
User: root Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9303	dpkg	/var/lib/dpkg/updates/tmp.i		—
		MD5:—	SHA256:—
9303	dpkg	/var/lib/dpkg/triggers/Lock		—
		MD5:—	SHA256:—
9303	dpkg	/var/log/dpkg.log		—
		MD5:—	SHA256:—
9308	tar	/var/lib/dpkg/tmp.ci/control		—
		MD5:—	SHA256:—
9308	tar	/var/lib/dpkg/tmp.ci/md5sums		—
		MD5:—	SHA256:—
9308	tar	/var/lib/dpkg/tmp.ci/postinst		—
		MD5:—	SHA256:—
9308	tar	/var/lib/dpkg/tmp.ci/prerm		—
		MD5:—	SHA256:—
9303	dpkg	/usr/bin/lzmainfo.dpkg-new		—
		MD5:—	SHA256:—
9303	dpkg	/usr/bin/xz.dpkg-new		—
		MD5:—	SHA256:—
9303	dpkg	/usr/bin/xzdiff.dpkg-new		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

32

TCP/UDP connections

102

DNS requests

124

Threats

0

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	200	34.107.221.82:80	http://detectportal.firefox.com/success.txt?ipv4	unknown	text	8 b	unknown
—	—	POST	200	184.24.77.54:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown
—	—	POST	200	184.24.77.54:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown
—	—	POST	200	142.250.186.35:80	http://ocsp.pki.goog/gts1c3	unknown	binary	472 b	unknown
—	—	POST	200	184.24.77.54:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown
—	—	POST	200	142.250.186.35:80	http://ocsp.pki.goog/gts1c3	unknown	binary	472 b	unknown
—	—	GET	200	34.107.221.82:80	http://detectportal.firefox.com/canonical.html	unknown	text	90 b	unknown
—	—	POST	200	184.24.77.54:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown
—	—	POST	200	184.24.77.54:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.96:80	—	Canonical Group Limited	US	unknown
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.48:80	—	Canonical Group Limited	US	unknown
—	—	34.107.221.82:80	detectportal.firefox.com	GOOGLE	US	unknown
—	—	34.117.237.239:443	contile.services.mozilla.com	GOOGLE-CLOUD-PLATFORM	US	unknown
—	—	34.117.188.166:443	spocs.getpocket.com	GOOGLE-CLOUD-PLATFORM	US	unknown
—	—	172.217.18.106:443	safebrowsing.googleapis.com	—	—	whitelisted
—	—	184.24.77.54:80	r3.o.lencr.org	Akamai International B.V.	DE	unknown
—	—	34.160.144.191:443	content-signature-2.cdn.mozilla.net	GOOGLE	US	unknown
—	—	142.250.186.35:80	ocsp.pki.goog	GOOGLE	US	unknown

DNS requests

Domain	IP	Reputation
175.100.168.192.in-addr.arpa	—	unknown
detectportal.firefox.com	34.107.221.82 2600:1901:0:38d7::	whitelisted
example.org	93.184.216.34 2606:2800:220:1:248:1893:25c8:1946	whitelisted
ipv4only.arpa	192.0.0.171 192.0.0.170	whitelisted
contile.services.mozilla.com	34.117.237.239	whitelisted
spocs.getpocket.com	34.117.188.166	shared
prod.ads.prod.webservices.mozgcp.net	—	unknown
r3.o.lencr.org	184.24.77.54 184.24.77.46 184.24.77.53 2a02:26f0:2100::215:6d20 2a02:26f0:2100::215:6d23 184.24.77.56 184.24.77.79 184.24.77.65 184.24.77.74 184.24.77.71 184.24.77.76 2a02:26f0:2100::215:6d11 184.24.77.45 184.24.77.77 2a02:26f0:2100::215:6d21 2a02:26f0:2100::215:6d12	shared
www.youtube.com	142.250.185.238 142.250.185.78 172.217.16.142 172.217.18.14 142.250.184.238 172.217.16.206 142.250.181.238 142.250.185.110 142.250.185.174 142.250.185.206 142.250.186.46 142.250.185.142 142.250.186.78 216.58.206.78 142.250.184.206 142.250.186.110 2a00:1450:4001:80e::200e 2a00:1450:4001:80f::200e 2a00:1450:4001:810::200e 2a00:1450:4001:811::200e	whitelisted
www.facebook.com	157.240.0.35 2a03:2880:f177:185:face:b00c:0:25de	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

xz-utils_5.6.1+really5.4.5-1_amd64.deb

B0D48759E30A4B6EDA9A11B8137D6AFE

02DEAFD2B1550AAF762CFA60FAFCC70DC80B442C

E9B203A056BE748BF343812C5527B27DDBEF0B57B2B925EEE2E07D4F08452E5F

12288:SDdECvZx6Dq7e82wdjVRKG9iDjj54nWUm1:SD6CvZx6DeT2wdRRKG9cjjOnm1

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes the "rm" command to delete files or directories

Creates or rewrites file in the "bin" folder

Reads /proc/mounts (likely used to find writable filesystems)

Executes commands using command-line interpreter

Reads information about logins, logouts, and login attempts

Checks DMI information (probably VM detection)

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings