File name:

SoulseekQt-2024-2-1-64bit.exe

Full analysis: https://app.any.run/tasks/488ff651-9791-4cd3-8014-a6f6b86f1f61
Verdict: Malicious activity
Analysis date: February 11, 2024, 06:42:17
OS: Ubuntu 22.04.2
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

09C7CDAD1062AE2CAE3685279441A99B

SHA1:

8ADF2A418693B17926F2134FF4989895B0336D62

SHA256:

F58B2B908062C893A82186A09B7892E85F78256A3EEC53BA95AD001E99268206

SSDEEP:

98304:J+cl4dnJPDzrgrXvoFfC+v5tTUSaN5ZU4GlvsC2lYPqxR2FkTEK04YYJ0tXmbUwW:voZlwIs6PzX44OvyJw2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads /proc/mounts (likely used to find writable filesystems)

      • snap-store (PID: 7987)

    • Uses pkexec (likely to bypass security restrictions)

      • sh (PID: 7960)

    • Checks DMI information (probably VM detection)

      • systemd-hostnamed (PID: 7950)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 16:10:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
274
Monitored processes
53
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sh no specs sudo no specs nautilus no specs locale-check no specs systemd-hostnamed no specs sh no specs pkexec no specs polkit-agent-helper-1 no specs snap-store no specs snap-seccomp no specs snap-confine no specs snap-confine no specs 5 no specs date no specs chmod no specs bash no specs cat no specs bash no specs md5sum no specs md5sum no specs cat no specs grep no specs snapctl no specs snapctl no specs xdg-user-dirs-update no specs bash no specs realpath no specs bash no specs bash no specs realpath no specs realpath no specs bash no specs bash no specs realpath no specs realpath no specs bash no specs realpath no specs bash no specs bash no specs realpath no specs realpath no specs ln no specs rm no specs ln no specs bash no specs grep no specs awk no specs rm no specs mkdir no specs basename no specs ln no specs snapctl no specs snapctl no specs

Process information

PID
CMD
Path
Indicators
Parent process
7929/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus \"/tmp/SoulseekQt-2024-2-1-64bit\.exe\" "/bin/sh—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
209
7930sudo -iu user nautilus /tmp/SoulseekQt-2024-2-1-64bit.exe/usr/bin/sudo—sh
User:
user
Integrity Level:
UNKNOWN
Exit code:
209
7931nautilus /tmp/SoulseekQt-2024-2-1-64bit.exe/usr/bin/nautilus—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
209
7932/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
7950/lib/systemd/systemd-hostnamed/lib/systemd/systemd-hostnamed—systemd
User:
root
Integrity Level:
UNKNOWN
Exit code:
496
7960/bin/sh -c "pkexec /usr/libexec/gvfsd-admin \"\$@\" --address \$DBUS_SESSION_BUS_ADDRESS --dir \$XDG_RUNTIME_DIR" gvfsd-admin --spawner :1.6 /org/gtk/gvfs/exec_spaw/4/bin/sh—gvfsd
User:
user
Integrity Level:
UNKNOWN
Exit code:
7931
7961pkexec /usr/libexec/gvfsd-admin --spawner :1.6 /org/gtk/gvfs/exec_spaw/4 --address unix:path=/run/user/1000/bus --dir /run/user/1000/usr/bin/pkexec—sh
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
7964/usr/libexec/polkit-agent-helper-1 user/usr/libexec/polkit-agent-helper-1—gnome-shell
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
7987/snap/snap-store/959/usr/bin/snap-store/snap/snap-store/959/usr/bin/snap-store—gnome-shell
User:
user
Integrity Level:
UNKNOWN
Exit code:
209
8000/snap/snapd/20290/usr/lib/snapd/snap-seccomp version-info/snap/snapd/20290/usr/lib/snapd/snap-seccomp—snap-store
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7931nautilus/home/user/.local/share/nautilus/tags/meta.db-wal —
MD5:—
SHA256:—
7931nautilus/home/user/.local/share/nautilus/tags/meta.db-shm —
MD5:—
SHA256:—
7931nautilus/home/user/.local/share/nautilus/tags/.meta.isrunning —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
13
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.96:80
—
Canonical Group Limited
GB
unknown
—
—
224.0.0.251:5353
—
—
—
unknown
—
—
212.102.56.181:443
—
Datacamp Limited
DE
unknown
—
—
195.181.175.41:443
—
Datacamp Limited
DE
unknown
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.62:443
dashboard.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.61:443
dashboard.snapcraft.io
Canonical Group Limited
GB
unknown

DNS requests

Domain
IP
Reputation
210.100.168.192.in-addr.arpa
  • —
unknown
api.snapcraft.io
  • 185.125.188.54
  • 185.125.188.55
  • 185.125.188.58
  • 185.125.188.59
unknown
connectivity-check.ubuntu.com
  • 2001:67c:1562::24
  • 2620:2d:4000:1::22
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::23
  • 2001:67c:1562::23
  • 2620:2d:4000:1::96
  • 2620:2d:4002:1::197
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::98
unknown
dashboard.snapcraft.io
  • 185.125.188.62
  • 185.125.188.61
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SoulseekQt-2024-2-1-64bit.exe