3 ms·
Look at other tabs https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7/behavior https://www.virustotal.com/gui/
by forensicnoob 2y ago
Look at other tabs https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9db1f09ac8983aa5bd96243c417edf7c0c00627d7/behavior https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9... at the bottom you can see the commands that looks like the program trying to delete down syslogs.
Look also in the relations tab that shows some tor nodes.
- blueflow 2y agoThis is not "shutting down" rsyslog. The kill command sends a SIGHUP to rsyslog, which causes it to reopen its log files - what you are seeing is a normal logrotation, not an attempt to terminate the process. I suspect virustotal did the check in a container with a logrotation job still running, and it happened to run right in the moment when yt-dlp was being tested.
- viraptor 2y agoI don't see anything trying to delete syslogs. There's a line for reloading new configuration (kill -HUP ...) - is that what you meant?
- Faaak 2y agoYou mean this `systemctl kill -s HUP rsyslog.service` ? This just tells syslog to reload itself
- FergusArgyll 2y agoWhy would yt-dlp tell syslog to reload?
- netsharc 2y agoIt seems VirusTotal spins up a virtual machine/container to run the program, and monitors what happens inside that environment. And it further seems that during that time syslog (or something else, probably the distribution) reloaded itself. And some other process tried to connect to the TOR IPs. And since we're all amateurs here who don't understand what VirusTotal is doing, some of us think "ZOMG yt-dlp compromised?!?". If you look at the process tree, the process that reloaded rsyslog wasn't spawned from the yt-dlp_linux process.