Linux Analysis Report
pict.jpg

ID:	1523488
Product:	CloudBasic
Start time:	17:02:14
Start date:	01.10.2024
Sample:	pict.jpg
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)
Architecture:	LINUX
MD5:	c2c7e9be6e780a56601e686998bbf93c
SHA1:	c026533f36e6fccde39239cf4a1df926fbff0ff9
SHA256:	384d513d6c0706d93c56426e893b4582fe9861dc223ccce2f74c53d57ff2b7ce
Filetype:	Portable Network Graphics (16016/1) 100.00%

Name	Type	MD5	SHA1	SHA256

System Summary

Source: classification engine

Classification label: clean1.linJPG@0/0@0/0

Persistence and Installation Behavior

Source: /usr/bin/exo-open (PID: 4819)	Directory: /home/james/.Xauthority			Jump to behavior
Source: /usr/bin/exo-open (PID: 4819)	Directory: /home/james/.cache			Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4827)	Directory: /home/james/.Xauthority			Jump to behavior
Source: /usr/bin/ristretto (PID: 4845)	Directory: /home/james/.Xauthority			Jump to behavior
Source: /usr/bin/ristretto (PID: 4845)	Directory: /home/james/.Xdefaults-ubuntu			Jump to behavior
Source: /usr/bin/ristretto (PID: 4845)	Directory: /tmp/.X0-lock			Jump to behavior
Source: /usr/bin/ristretto (PID: 4845)	Directory: /tmp/.hidden			Jump to behavior
Source: /usr/bin/ristretto (PID: 4845)	Directory: /tmp/.xfsm-ICE-TWMPB2			Jump to behavior
Source: /usr/bin/ristretto (PID: 4845)	Directory: /home/james/.cache			Jump to behavior
Source: /usr/bin/ristretto (PID: 4845)	Directory: /home/james/.local			Jump to behavior
Source: /usr/bin/ristretto (PID: 4845)	Directory: /home/james/.config			Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4862)	Directory: /home/james/.Xauthority			Jump to behavior

Malware Analysis System Evasion

Source: /usr/bin/exo-open (PID: 4819)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4827)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ristretto (PID: 4845)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4862)	Queries kernel information via 'uname':			Jump to behavior