Malware analysis 3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2 No threats detected

Add for printing

File name:	3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2
Full analysis:	https://app.any.run/tasks/32322955-6166-4ee8-9440-baa59267c993
Verdict:	No threats detected
Analysis date:	May 13, 2025, 19:17:26
OS:	Ubuntu 22.04.2
MIME:	application/x-executable
File info:	ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=156f6e2e4b7551ca3cca0626fd1e025a0d1c97aa, not stripped
MD5:	D914595407192A02C9EBB20C95D5D690
SHA1:	10C8C914EC262B6DF3D68A3BABAD5B06773DBD0D
SHA256:	3B1BE8499EC382DFAFBC496A73DEA2794F6DD201B3E46A4128C7FCD88E8C17C2
SSDEEP:	24576:lIanR8V/4iI7L+rpt066tYgR4WsKqDfNcuJ9:lbn6uiI7ct06UYg+WsKquuJ9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Reads network configuration
  - sudo (PID: 40670)
- Gets active network interfaces
  - sudo (PID: 40670)
- Executes commands using command-line interpreter
  - sudo (PID: 40670)
- Modifies file or directory owner
  - sudo (PID: 40667)
- Connects to unusual port
  - 3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf (PID: 40681)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

241

Monitored processes

18

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
40665	/bin/sh -c "sudo chown user /home/user/Downloads/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2\.elf && chmod +x /home/user/Downloads/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2\.elf && DISPLAY=:0 sudo -i /home/user/Downloads/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2\.elf "	/usr/bin/dash	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 0
40666	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
40667	sudo chown user /home/user/Downloads/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40668	chown user /home/user/Downloads/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
40669	chmod +x /home/user/Downloads/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf	/usr/bin/chmod	—	dash
User: user Integrity Level: UNKNOWN Exit code: 0
40670	sudo -i /home/user/Downloads/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40673	/home/user/Downloads/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf	/home/user/Downloads/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
40674	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf
User: root Integrity Level: UNKNOWN Exit code: 0
40675	-bash --login -c \/home\/user\/Downloads\/3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2\.elf	/usr/bin/bash	—	3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf
User: root Integrity Level: UNKNOWN Exit code: 0
40676	sh -c "cat /usr/etc/debuginfod/*\.urls 2>/dev/null"	/usr/bin/dash	—	bash
User: root Integrity Level: UNKNOWN Exit code: 256

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

11

DNS requests

11

Threats

0

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	91.189.91.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	185.125.190.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	169.150.255.183:443	odrs.gnome.org	—	GB	whitelisted
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
40681	3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2.elf	45.11.229.181:606	—	ITP-Solutions GmbH & Co. KG	PL	malicious

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2620:2d:4000:1::22 2620:2d:4000:1::96 2620:2d:4000:1::98 2620:2d:4000:1::23 2001:67c:1562::23 2001:67c:1562::24 2620:2d:4002:1::196 2620:2d:4002:1::198 2620:2d:4000:1::2a 2620:2d:4000:1::2b 2620:2d:4000:1::97 185.125.190.48 185.125.190.49 91.189.91.48 91.189.91.96 185.125.190.96 185.125.190.98 185.125.190.17 185.125.190.97 185.125.190.18 91.189.91.98 91.189.91.49	whitelisted
google.com	142.250.186.142 2a00:1450:4001:82a::200e	whitelisted
odrs.gnome.org	169.150.255.183 212.102.56.179 169.150.255.180 195.181.175.41 195.181.170.19 37.19.194.80 207.211.211.26 2a02:6ea0:c700::18 2a02:6ea0:c700::112 2a02:6ea0:c700::19 2a02:6ea0:c700::11 2a02:6ea0:c700::107 2a02:6ea0:c700::21 2a02:6ea0:c700::101	whitelisted
api.snapcraft.io	185.125.188.54 185.125.188.58 185.125.188.59 185.125.188.57 2620:2d:4000:1010::117 2620:2d:4000:1010::2e6 2620:2d:4000:1010::42 2620:2d:4000:1010::344	whitelisted
7.100.168.192.in-addr.arpa	—	unknown

Threats

No threats detected

Add for printing

No debug info

General Info

3b1be8499ec382dfafbc496a73dea2794f6dd201b3e46a4128c7fcd88e8c17c2

D914595407192A02C9EBB20C95D5D690

10C8C914EC262B6DF3D68A3BABAD5B06773DBD0D

3B1BE8499EC382DFAFBC496A73DEA2794F6DD201B3E46A4128C7FCD88E8C17C2

24576:lIanR8V/4iI7L+rpt066tYgR4WsKqDfNcuJ9:lbn6uiI7ct06UYg+WsKquuJ9

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Reads network configuration

Gets active network interfaces

Executes commands using command-line interpreter

Modifies file or directory owner

Connects to unusual port

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings