| File name: | 425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.zip |
| Full analysis: | https://app.any.run/tasks/8cfcae7f-448c-4fed-9c84-b71c1c6b297f |
| Verdict: | Malicious activity |
| Threats: | A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. |
| Analysis date: | June 03, 2025, 10:33:56 |
| OS: | Ubuntu 22.04.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| MD5: | 5C5B3C154E4F0557EC8BF1548B77590C |
| SHA1: | CECB578169EC1E9E89BC655D6D37FC5852F9CCF1 |
| SHA256: | F24B244EDB3217144A285F74EC1735EA629459FEFFEDEB0FFEE5C911BBF4FB68 |
| SSDEEP: | 1536:h7a5XZtqKlOWff6lLQRCh5449IiPMWgSuHHte1:h7mXZcK/3KLQROkWWHg1 |
| .zip | | | ZIP compressed archive (100) |
|---|
| ZipRequiredVersion: | 51 |
|---|---|
| ZipBitFlag: | 0x0003 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2025:06:03 10:32:50 |
| ZipCRC: | 0x42e00e6a |
| ZipCompressedSize: | 41747 |
| ZipUncompressedSize: | 94679 |
| ZipFileName: | 425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.elf |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 41023 | /bin/sh -c "DISPLAY=:0 sudo -iu user file-roller /tmp/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a\.zip " | /usr/bin/dash | — | IntiFjKCklFyPMJr | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41024 | sudo -iu user file-roller /tmp/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.zip | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41025 | file-roller /tmp/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.zip | /usr/bin/file-roller | — | sudo | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41026 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | file-roller | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41040 | /usr/lib/p7zip/7z l -slt -bd -y -- /tmp/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.zip | /usr/lib/p7zip/7z | — | file-roller | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41044 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41045 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41046 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41054 | /lib/systemd/systemd-hostnamed | /usr/lib/systemd/systemd-hostnamed | — | systemd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 41055 | /usr/libexec/gvfsd-network --spawner :1.6 /org/gtk/gvfs/exec_spaw/1 | /usr/libexec/gvfsd-network | — | gvfsd | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 41025 | file-roller | /home/user/.local/share/recently-used.xbel.VQM662 | xml | |
MD5:— | SHA256:— | |||
| 41086 | 7z | /home/user/Desktop/425a0a8c30db2392ee0417bbc358e2d981a91bf019b120ad1c26232dfbcd786a.elf | o | |
MD5:— | SHA256:— | |||
| 41025 | file-roller | /home/user/.local/share/recently-used.xbel | xml | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
— | — | GET | 204 | 185.125.190.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.190.98:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
1178 | snap-store | 207.211.213.89:443 | odrs.gnome.org | — | US | whitelisted |
512 | snapd | 185.125.188.57:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
41064 | gvfsd-smb-browse | 192.168.100.255:137 | — | — | — | whitelisted |
Domain | IP | Reputation |
|---|---|---|
connectivity-check.ubuntu.com |
| whitelisted |
google.com |
| whitelisted |
odrs.gnome.org |
| whitelisted |
api.snapcraft.io |
| whitelisted |
3.100.168.192.in-addr.arpa |
| unknown |