Analysis date (UTC): 29 January 2024, 11:40Analysis environment: Ubuntu 22.04.2

http://45.95.147.236/x

MD5:70896A6ACAF32F6BC974BBA0F8E51259
SHA1:EE1B6ED12209BF4B1CC1545106DA1CE621018B19
SHA256:1F0D06A39F9F6BF1CD8A858F745C7A445595D72307838E9B683CDA08D29B09EF

Analysis result

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Executes commands using command-line interpreter

  • gnome-terminal-server (PID: 7400)

Reads /proc/mounts (likely used to find writable filesystems)

  • firefox (PID: 6853)

INFO

No info indicators.

Threats

PIDProcessClassMessage
——Misc AttackET COMPROMISED Known Compromised or Hostile Host Traffic group 17
——Misc AttackET 3CORESec Poor Reputation IP group 17
——Misc AttackET COMPROMISED Known Compromised or Hostile Host Traffic group 17
——Potentially Bad TrafficET INFO X86_64 File Download Request from IP Address
——Potentially Bad TrafficET INFO x86 File Download Request from IP Address
——Potentially Bad TrafficET HUNTING Suspicious GET Request for .x86
——Potentially Bad TrafficET HUNTING Suspicious GET Request for .i686 File

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN