| download: | / |
| Full analysis: | https://app.any.run/tasks/c8abc6aa-ee0b-4735-92fb-cb286523aba7 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 05, 2026, 10:34:34 |
| OS: | Ubuntu 22.04.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, not stripped |
| MD5: | E73BD680241328CD905BE91DDC46A078 |
| SHA1: | 4DA3392D16580C1D6A23ED3C23D397784F6DAA5F |
| SHA256: | 2A9A7FB534604A54B850F3E8B671706D42033DC00C7F0FAF438B9CCC0C1DC045 |
| SSDEEP: | 96:GjCTdJKWLo72che6eNSrAs/3tlb0yof7meaamBFBp8hB2Sdix:G+PKWM7Phe6ZAs/7b0yof2Tr8hw |
MALICIOUS
Connects to the CnC server
- memfd:a (deleted) (PID: 1865)
SNOWLIGHT has been detected
- sudo (PID: 1864)
SUSPICIOUS
Modifies file or directory owner
- sudo (PID: 1861)
Reads passwd file
- memfd:a (deleted) (PID: 1865)
Connects to unusual port
- memfd:a (deleted) (PID: 1865)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .o | | | ELF Executable and Linkable format (generic) (49.8) |
|---|
EXIF
EXE
| CPUArchitecture: | 64 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | AMD x86-64 |
Total processes
133
Monitored processes
13
Malicious processes
1
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1860 | /bin/sh -c "sudo chown user /tmp/c8abc6aa-ee0b-4735-92fb-cb286523aba7\.elf && chmod +x /tmp/c8abc6aa-ee0b-4735-92fb-cb286523aba7\.elf && DISPLAY=:0 sudo -i /tmp/c8abc6aa-ee0b-4735-92fb-cb286523aba7\.elf " | /usr/bin/dash | — | peEEN66OX3861XH4 | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1861 | sudo chown user /tmp/c8abc6aa-ee0b-4735-92fb-cb286523aba7.elf | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1862 | chown user /tmp/c8abc6aa-ee0b-4735-92fb-cb286523aba7.elf | /usr/bin/chown | — | sudo | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1863 | chmod +x /tmp/c8abc6aa-ee0b-4735-92fb-cb286523aba7.elf | /usr/bin/chmod | — | dash | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1864 | sudo -i /tmp/c8abc6aa-ee0b-4735-92fb-cb286523aba7.elf | /usr/bin/sudo | dash | ||||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1865 | [kworker/0:2] | /memfd:a (deleted) | sudo | ||||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1866 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | memfd:a (deleted) | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1867 | -bash --login -c \/tmp\/c8abc6aa-ee0b-4735-92fb-cb286523aba7\.elf | /usr/bin/bash | — | memfd:a (deleted) | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
| 1868 | sh -c "cat /usr/etc/debuginfod/*\.urls 2>/dev/null" | /usr/bin/dash | — | bash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 256 Modules
| |||||||||||||||
| 1869 | tr \n " " | /usr/bin/tr | — | bash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
15
DNS requests
12
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.18:80 | http://connectivity-check.ubuntu.com/ | GB | — | — | unknown |
1865 | memfd:a (deleted) | GET | 101 | 168.100.8.179:8084 | http://168.100.8.179:8084/w | US | — | — | unknown |
1865 | memfd:a (deleted) | GET | 101 | 168.100.8.179:8084 | http://168.100.8.179:8084/w | US | — | — | unknown |
1865 | memfd:a (deleted) | GET | 101 | 168.100.8.179:8084 | http://168.100.8.179:8084/w | US | — | — | unknown |
1865 | memfd:a (deleted) | GET | 200 | 168.100.8.179:8084 | http://168.100.8.179:8084/?a=l64&h=168.100.8.179&t=ws_&p=8084 | US | binary | 7.71 Mb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 195.181.170.19:443 | odrs.gnome.org | CDN77 _ | GB | whitelisted |
459 | avahi-daemon | 224.0.0.251:5353 | — | — | — | whitelisted |
— | — | 185.125.190.48:80 | — | CANONICAL-AS | GB | whitelisted |
— | — | 185.125.190.17:80 | — | CANONICAL-AS | GB | whitelisted |
— | — | 185.125.188.58:443 | api.snapcraft.io | CANONICAL-AS | GB | whitelisted |
— | — | 185.125.188.57:443 | api.snapcraft.io | CANONICAL-AS | GB | whitelisted |
— | — | 185.125.188.54:443 | api.snapcraft.io | CANONICAL-AS | GB | whitelisted |
— | — | 185.125.190.18:80 | — | CANONICAL-AS | GB | whitelisted |
1865 | memfd:a (deleted) | 168.100.8.179:8084 | — | BLNWX | US | unknown |
424 | systemd-timesyncd | 185.125.190.56:123 | ntp.ubuntu.com | CANONICAL-AS | GB | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
odrs.gnome.org |
| whitelisted |
google.com |
| whitelisted |
api.snapcraft.io |
| whitelisted |
8.100.168.192.in-addr.arpa |
| whitelisted |
ntp.ubuntu.com |
| whitelisted |
connectivity-check.ubuntu.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1865 | memfd:a (deleted) | A Network Trojan was detected | ET MALWARE SNOWLIGHT C2 HTTP Requests |
1865 | memfd:a (deleted) | Not Suspicious Traffic | INFO [ANY.RUN] Websocket Upgrade Request |
1865 | memfd:a (deleted) | Not Suspicious Traffic | INFO [ANY.RUN] Websocket Upgrade Request |
1865 | memfd:a (deleted) | Not Suspicious Traffic | INFO [ANY.RUN] Websocket Upgrade Request |