Find similar analyses in TI Lookup
Analysis date (UTC): 12 December 2024, 12:17Analysis environment: Ubuntu 22.04.2 LTS

bins.sh

MD5:C2257ADEA34A60D2F7EAF875A38ED7ED
SHA1:B8C7B5044E7749A93711E60794B29F45FFB47DC4
SHA256:3F1EC37DB04269914920C6A2F6EF9997CB2A71832DAACEF812C55EC8009447F1

Analysis result

Threat level:Malicious activity
Tags:
exploitloader
Full analysis:Analysis bins.sh (MD5: C2257ADEA34A60D2F7EAF875A38ED7ED) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39672)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39696)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39675)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39676)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39680)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39683)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39679)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39684)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39689)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39693)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39692)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39697)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39701)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39700)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39705)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39706)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39671)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39709)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39710)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39713)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39714)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39717)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39718)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39722)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39723)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39761)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39743)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39739)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39742)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39746)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39751)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39747)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39752)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39760)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39756)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39757)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39764)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39765)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39738)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39770)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39769)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39773)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39778)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39774)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39781)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39777)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39782)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39785)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39786)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39792)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39791)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39803)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39799)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39800)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39688)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39804)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39731)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39750)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39730)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39795)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39796)

SUSPICIOUS

Executes commands using command-line interpreter

  • sudo (PID: 38743)

Modifies file or directory owner

  • sudo (PID: 38740)

Potential Corporate Privacy Violation

  • wget (PID: 38747)
  • curl (PID: 38754)
  • curl (PID: 38803)
  • wget (PID: 38801)
  • wget (PID: 38833)
  • wget (PID: 38867)
  • curl (PID: 38868)
  • wget (PID: 38899)
  • curl (PID: 38901)
  • wget (PID: 38932)
  • curl (PID: 38972)
  • busybox (PID: 39028)
  • wget (PID: 39136)
  • curl (PID: 39168)
  • busybox (PID: 39060)
  • busybox (PID: 39092)
  • busybox (PID: 39310)
  • curl (PID: 39102)
  • wget (PID: 39378)
  • busybox (PID: 39373)
  • busybox (PID: 39435)
  • curl (PID: 39379)
  • wget (PID: 39472)
  • busybox (PID: 39467)
  • curl (PID: 39538)
  • busybox (PID: 39532)
  • busybox (PID: 39570)
  • wget (PID: 39575)
  • busybox (PID: 39632)
  • busybox (PID: 39662)
  • wget (PID: 39667)
  • busybox (PID: 38796)
  • busybox (PID: 38894)
  • busybox (PID: 38961)
  • busybox (PID: 38927)
  • busybox (PID: 38862)
  • busybox (PID: 38997)
  • wget (PID: 39166)
  • curl (PID: 39003)
  • busybox (PID: 39195)
  • busybox (PID: 38828)
  • curl (PID: 39316)
  • busybox (PID: 39131)
  • busybox (PID: 39405)
  • wget (PID: 39315)
  • busybox (PID: 39162)
  • curl (PID: 39348)
  • busybox (PID: 39601)
  • busybox (PID: 39342)
  • busybox (PID: 39500)
  • wget (PID: 39637)
  • wget (PID: 39347)

Reads /proc/mounts (likely used to find writable filesystems)

  • curl (PID: 38803)
  • curl (PID: 38868)
  • curl (PID: 38901)
  • curl (PID: 38972)
  • curl (PID: 39003)
  • curl (PID: 39102)
  • curl (PID: 39168)
  • curl (PID: 39316)
  • curl (PID: 39348)
  • curl (PID: 39379)
  • curl (PID: 39538)

Executes the "rm" command to delete files or directories

  • bash (PID: 38744)

Uses wget to download content

  • bash (PID: 38744)

Connects to the server without a host name

  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (PID: 38967)

Connects to unusual port

  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39196)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39198)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39203)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39200)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39204)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39202)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39205)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39207)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39212)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39210)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39214)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39208)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39197)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39209)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39199)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39215)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39213)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39211)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39201)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39217)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39206)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39216)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39220)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39221)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39219)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39218)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39224)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39222)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39226)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39225)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39227)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39223)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39233)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39228)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39231)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39229)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39232)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39234)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39235)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39230)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39236)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39237)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39239)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39240)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39241)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39238)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39246)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39245)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39242)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39243)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39244)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39247)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39250)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39248)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39249)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39251)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39252)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39254)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39255)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39256)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39253)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39259)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39257)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39258)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39260)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39261)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39264)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39263)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39262)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39374)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39266)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39269)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39265)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39267)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39268)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39272)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39270)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39271)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39274)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39273)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39670)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39687)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39704)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39275)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39721)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39750)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39755)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39768)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39789)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39790)

Process requests binary or script from the Internet

  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39721)
  • hGBq7R2gDWL5n4yuvDzQZDBoqH01VZcQtE (deleted) (PID: 39789)

INFO

No info indicators.

Threats

PIDProcessClassMessage
445systemd-resolvedMisc activityET INFO Observed DNS Query to .zip TLD
445systemd-resolvedMisc activityET INFO Observed DNS Query to .zip TLD
38747wgetMisc activityET INFO HTTP Request to a *.zip Domain
38747wgetPotential Corporate Privacy ViolationET POLICY Executable and linking format (ELF) file download Over HTTP
445systemd-resolvedMisc activityET INFO Observed DNS Query to .zip TLD
38754curlMisc activityET INFO HTTP Request to a *.zip Domain
38754curlPotential Corporate Privacy ViolationET POLICY Executable and linking format (ELF) file download Over HTTP
445systemd-resolvedMisc activityET INFO Observed DNS Query to .zip TLD
445systemd-resolvedMisc activityET INFO Observed DNS Query to .zip TLD
38801wgetMisc activityET INFO HTTP Request to a *.zip Domain

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED