Malware analysis http://temp.sh/BiiFr/server.zip Malicious activity

Add for printing

URL:	http://temp.sh/BiiFr/server.zip
Full analysis:	https://app.any.run/tasks/9c91fd68-32e9-41da-bc73-51be6cda15f2
Verdict:	Malicious activity
Analysis date:	May 10, 2024, 09:45:40
OS:	Ubuntu 22.04.2
MD5:	3A0606E6BD484DBDD46078C47C2FF7C3
SHA1:	B4E3465805AE99899A0E0C7A92C45D8F34FACDEC
SHA256:	3BE8F5DD95BA38C5DA7690943B85C4664E47A263BF02AD84742944513361DE05
SSDEEP:	3:N1KKAr8MiXKWAm4n:CKOidAp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Modifies hosts file
  - 7z (PID: 9707)
SUSPICIOUS
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 9536)
  - sudo (PID: 9782)
  - sudo (PID: 9745)
  - sudo (PID: 9795)
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 9700)
  - systemd-hostnamed (PID: 9774)
- Creates shell script file
  - 7z (PID: 9707)
- Reads information about logins, logouts, and login attempts
  - bash (PID: 9554)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

367

Monitored processes

146

Malicious processes

0

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9263	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome http://temp\.sh/BiiFr/server\.zip "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN
9264	sudo -iu user google-chrome http://temp.sh/BiiFr/server.zip	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN
9265	/usr/bin/google-chrome http://temp.sh/BiiFr/server.zip	/opt/google/chrome/chrome	—	sudo
User: user Integrity Level: UNKNOWN
9266	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9267	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9268	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9269	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9270	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
9271	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
9272		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9265	chrome	/9265/fd/63		—
		MD5:—	SHA256:—
9265	chrome	/home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-663DECC9-2431.pma		—
		MD5:—	SHA256:—
9265	chrome	/.com.google.Chrome.cdLqL8		—
		MD5:—	SHA256:—
9265	chrome	/home/user/.config/google-chrome/Default/Sync Data/LevelDB/LOG		—
		MD5:—	SHA256:—
9265	chrome	/.com.google.Chrome.bNgo7h		—
		MD5:—	SHA256:—
9265	chrome	/.com.google.Chrome.tvAsO1		—
		MD5:—	SHA256:—
9265	chrome	/.com.google.Chrome.JmAsbc		—
		MD5:—	SHA256:—
9265	chrome	/home/user/.config/google-chrome/Default/Site Characteristics Database/LOG		—
		MD5:—	SHA256:—
9265	chrome	/home/user/.config/google-chrome/Default/discounts_db/LOG		—
		MD5:—	SHA256:—
9265	chrome	/home/user/.config/google-chrome/Default/parcel_tracking_db/LOG		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

14

TCP/UDP connections

38

DNS requests

40

Threats

0

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	204	185.125.190.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	204	185.125.190.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/itl7uwtsfz7vnn4d74jypsljqu_446/lmelglejhemejginpboagddgdfbepgmp_446_all_ZZ_mhw6ymh4ime4hiuauibc4z2ory.crx3	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/ggkkehgbnfjpeggfpleeakpidbkibbmn/1.905f83845e25579fd4c6ae4bdc81a2740a216023f856918045ced4508329c941/1.c45cd56a0a8da0883c8f9757b31891d6c628f38cb80724015ffdf33b419a73f3/0e81ca17ff2d8fc4645b4dd59216b1ad6413403ef03bae5dc24f1bbb977f7a5a.puff	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acsw37w25fqab5rcsrlp3tkbfvta_2024.5.8.0/niikhdgajlphfehepabhhblakbdgeefj_2024.05.08.00_all_bu4qbfgg7omsnmys6ef5u6hwem.crx3	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jmaarj3zzn5i3bp5agmrb7k3pu_3028/jflookgnkcckhobaglndicnbbgbonegd_3028_all_adtsy74lce7u5mtzcrq4jm4azpia.crx3	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adwf5kywp7h6uj6cmkt7uqsll2eq_20240404.625479014.14/obedbbhbpmojnkanicioggnmelmoomoc_20240404.625479014.14_all_ENGB500000_incvymraubxlb6ke6cnqmodupm.crx3	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.153e9301be7e862a33e2cab936a0a97e2f8bdf2dae1be516d6fe8a5f184ce028/1.4a6508925b2ffec931c1e3931ddeb15ca41d820a8264cd5a962b526e9932bcdf/1bbd0eca21eb9c81cf6ffb73afcdf08d70ee6d920b87e2e731f03dc4ac0a6cf8.puff	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	212.102.56.179:443	odrs.gnome.org	Datacamp Limited	DE	unknown
—	—	64.233.166.84:443	accounts.google.com	GOOGLE	US	unknown
—	—	172.217.18.3:443	clientservices.googleapis.com	GOOGLE	US	unknown
—	—	239.255.255.250:1900	—	—	—	unknown
—	—	51.91.79.17:80	temp.sh	OVH SAS	FR	unknown
—	—	51.91.79.17:443	temp.sh	OVH SAS	FR	unknown
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	142.250.185.195:443	update.googleapis.com	GOOGLE	US	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.48 185.125.190.96 91.189.91.49 91.189.91.98 185.125.190.98 91.189.91.97 91.189.91.48 91.189.91.96 185.125.190.17 185.125.190.97 185.125.190.49 185.125.190.18 2620:2d:4000:1::97 2620:2d:4000:1::2a 2620:2d:4002:1::198 2620:2d:4002:1::197 2001:67c:1562::23 2620:2d:4000:1::96 2001:67c:1562::24 2620:2d:4000:1::22 2620:2d:4000:1::2b 2620:2d:4000:1::23 2620:2d:4000:1::98 2620:2d:4002:1::196	unknown
odrs.gnome.org	2a02:6ea0:c700::10 2a02:6ea0:c700::19 2a02:6ea0:c700::21 2a02:6ea0:c700::11 2a02:6ea0:c700::18 2a02:6ea0:c700::22 2a02:6ea0:c700::17 212.102.56.179 195.181.175.41 195.181.170.19 156.146.33.140 195.181.175.16 212.102.56.181 156.146.33.137	unknown
clientservices.googleapis.com	172.217.18.3	whitelisted
accounts.google.com	64.233.166.84	shared
temp.sh	51.91.79.17	unknown
api.snapcraft.io	185.125.188.55 185.125.188.54 185.125.188.59 185.125.188.58	unknown
update.googleapis.com	142.250.185.195	unknown
199.100.168.192.in-addr.arpa	—	unknown
www.google.com	216.58.206.68	whitelisted
optimizationguide-pa.googleapis.com	142.250.185.170 172.217.23.106 142.250.185.106 142.250.185.138 142.250.186.74 142.250.185.74 142.250.185.234 142.250.181.234 216.58.206.42 142.250.186.170 216.58.212.138 142.250.184.234 142.250.186.42 142.250.185.202 172.217.16.202 216.58.206.74	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

http://temp.sh/BiiFr/server.zip

3A0606E6BD484DBDD46078C47C2FF7C3

B4E3465805AE99899A0E0C7A92C45D8F34FACDEC

3BE8F5DD95BA38C5DA7690943B85C4664E47A263BF02AD84742944513361DE05

3:N1KKAr8MiXKWAm4n:CKOidAp

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Modifies hosts file

SUSPICIOUS

Executes commands using command-line interpreter

Checks DMI information (probably VM detection)

Creates shell script file

Reads information about logins, logouts, and login attempts

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings