File name:

425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.zip

Full analysis: https://app.any.run/tasks/59acbaeb-8e8c-46c7-880e-475fa3d76bda
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: June 03, 2025, 10:36:58
OS: Ubuntu 22.04.2
Tags:
auto
botnet
gafgyt
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

5C5B3C154E4F0557EC8BF1548B77590C

SHA1:

CECB578169EC1E9E89BC655D6D37FC5852F9CCF1

SHA256:

F24B244EDB3217144A285F74EC1735EA629459FEFFEDEB0FFEE5C911BBF4FB68

SSDEEP:

1536:h7a5XZtqKlOWff6lLQRCh5449IiPMWgSuHHte1:h7mXZcK/3KLQROkWWHg1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GAFGYT has been found (auto)

      • 7z (PID: 41091)
      • 7z (PID: 41104)

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • sudo (PID: 41036)
      • gnome-terminal-server (PID: 41143)
      • bash (PID: 41161)

  • INFO

    • Checks timezone

      • 7z (PID: 41052)
      • 7z (PID: 41091)
      • file-roller (PID: 41037)
      • 7z (PID: 41104)
      • python3.10 (PID: 41135)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:06:03 10:32:50
ZipCRC: 0x42e00e6a
ZipCompressedSize: 41747
ZipUncompressedSize: 94679
ZipFileName: 425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.elf
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
35
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
dash no specs sudo no specs file-roller no specs locale-check no specs 7z no specs systemctl no specs systemctl no specs systemctl no specs systemd-hostnamed no specs gvfsd-network no specs gvfsd-smb-browse gvfsd-dnssd no specs #GAFGYT 7z no specs tracker-extract-3 no specs #GAFGYT 7z no specs dbus-daemon no specs nautilus no specs python3.10 no specs gnome-terminal.real no specs gnome-terminal-server no specs bash no specs dash no specs dircolors no specs basename no specs dash no specs dirname no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs sudo no specs

Process information

PID
CMD
Path
Indicators
Parent process
41035/bin/sh -c "DISPLAY=:0 sudo -iu user file-roller /home/user/Desktop/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a\.zip "/usr/bin/dash—IntiFjKCklFyPMJr
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41036sudo -iu user file-roller /home/user/Desktop/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.zip/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41037file-roller /home/user/Desktop/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.zip/usr/bin/file-roller—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgtk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libgdk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libpango-1.0.so.0.5000.6
/usr/lib/x86_64-linux-gnu/libcairo.so.2.11600.0
/usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4200.8
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.7200.4
41038/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41052/usr/lib/p7zip/7z l -slt -bd -y -- /home/user/Desktop/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.zip/usr/lib/p7zip/7z—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpthread.so.0
/usr/lib/x86_64-linux-gnu/libdl.so.2
/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30
/usr/lib/x86_64-linux-gnu/libgcc_s.so.1
/usr/lib/x86_64-linux-gnu/libm.so.6
/usr/lib/p7zip/7z.so
/usr/lib/p7zip/codecs/rar.so
41054systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
/usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1
41055systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
/usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1
41056systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
/usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1
41063/lib/systemd/systemd-hostnamed/usr/lib/systemd/systemd-hostnamed—systemd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/systemd/libsystemd-shared-249.so
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libcrypt.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libip4tc.so.2.0.0
/usr/lib/x86_64-linux-gnu/libkmod.so.2.3.7
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
41064/usr/libexec/gvfsd-network --spawner :1.6 /org/gtk/gvfs/exec_spaw/1/usr/libexec/gvfsd-network—gvfsd
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/gvfs/libgvfsdaemon.so
/usr/lib/x86_64-linux-gnu/gvfs/libgvfscommon.so
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libgcr-base-3.so.1.0.0
/usr/lib/x86_64-linux-gnu/libsecret-1.so.0.0.0
/usr/lib/x86_64-linux-gnu/libgmodule-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
Executable files
0
Suspicious files
0
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
41037file-roller/home/user/.local/share/recently-used.xbel.AKZ862xml
MD5:—
SHA256:—
41037file-roller/home/user/.local/share/recently-used.xbelxml
MD5:—
SHA256:—
410917z/home/user/Desktop/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.elfo
MD5:—
SHA256:—
411047z/home/user/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.elfo
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
10
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
195.181.172.6:443
odrs.gnome.org
Datacamp Limited
NL
whitelisted
512
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
41072
gvfsd-smb-browse
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.251.39.110
  • 2a00:1450:400e:811::200e
whitelisted
odrs.gnome.org
  • 195.181.172.6
  • 2a02:6ea0:c000::24
whitelisted
api.snapcraft.io
  • 185.125.188.59
  • 2620:2d:4000:1010::117
whitelisted
6.100.168.192.in-addr.arpa
  • —
unknown
connectivity-check.ubuntu.com
  • 2620:2d:4002:1::198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.zip