| File name: | perl.alfa |
| Full analysis: | https://app.any.run/tasks/748e4e88-88cb-41fd-a637-c0aadeacca10 |
| Verdict: | No threats detected |
| Analysis date: | February 01, 2025, 01:07:29 |
| OS: | Ubuntu 22.04.2 LTS |
| MIME: | text/x-perl |
| File info: | Perl script text executable |
| MD5: | 8A3657A582AE4B798DFF61233E589069 |
| SHA1: | D476B323CAA8BE04324C59695C5A37ACFA089851 |
| SHA256: | F82FD317860454606003AA9DC7EFDE284D851424730E229F19C50D60206311B8 |
| SSDEEP: | 12:HM4w4FfewYLxgEBlhRC2Syc0eWADYWdvC6CS6txo1ZjquFgqEUVi:sJ4hwFRjjC2S6GDtqlSQovquFgqC |
MALICIOUS
No malicious indicators.SUSPICIOUS
Checks DMI information (probably VM detection)
- systemd-hostnamed (PID: 38761)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .pl | | | Perl script (36.3) |
|---|
Total processes
216
Monitored processes
5
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 38743 | /bin/sh -c "DISPLAY=:0 sudo -iu user nautilus /tmp/perl\.alfa\.pl " | /usr/bin/dash | — | any-guest-agent |
User: user Integrity Level: UNKNOWN | ||||
| 38744 | sudo -iu user nautilus /tmp/perl.alfa.pl | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN | ||||
| 38745 | nautilus /tmp/perl.alfa.pl | /usr/bin/nautilus | — | sudo |
User: user Integrity Level: UNKNOWN | ||||
| 38746 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | nautilus |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 38761 | /lib/systemd/systemd-hostnamed | /usr/lib/systemd/systemd-hostnamed | — | systemd |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
7
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 91.189.91.98:80 | http://connectivity-check.ubuntu.com/ | US | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 91.189.91.98:80 | connectivity-check.ubuntu.com | Canonical Group Limited | US | whitelisted |
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
connectivity-check.ubuntu.com |
| whitelisted |
232.100.168.192.in-addr.arpa |
| unknown |