Malware analysis http://103.188.82.218/x/x86 Malicious activity

Add for printing

URL:	http://103.188.82.218/x/x86
Full analysis:	https://app.any.run/tasks/7a21f680-8f86-4981-97fc-9ceff117bb08
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	January 19, 2025, 10:27:30
OS:	Ubuntu 22.04.2 LTS
Tags:	auto mirai botnet
Indicators:
MD5:	256501D8500429157114E7FB92BFF31F
SHA1:	C3327543983E986606A8D62F674A2D6F947C2A0B
SHA256:	44F537DB41CDECE148983A733386EB82DE10210EAD9E3F5E12DEDFDCD0354034
SSDEEP:	3:N1KtMEd9EKdKT:CCE8K+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - sudo (PID: 38753)
- Potential Corporate Privacy Violation
  - chrome (PID: 38799)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

294

Monitored processes

85

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38752	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome http://103\.188\.82\.218/x/x86 "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN
38753	sudo -iu user google-chrome http://103.188.82.218/x/x86	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
38754	/usr/bin/google-chrome http://103.188.82.218/x/x86	/opt/google/chrome/chrome	—	sudo
User: user Integrity Level: UNKNOWN
38755	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
38756	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
38757	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
38758	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
38759	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
38760	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
38761	"/opt/google/chrome/chrome http://103\.188\.82\.218/x/x"	/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

40

Text files

2

Unknown types

15

Dropped files

PID	Process	Filename		Type
38754	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		vxd
		MD5:—	SHA256:—
38754	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		vxd
		MD5:—	SHA256:—
38754	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		vxd
		MD5:—	SHA256:—
38754	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:—	SHA256:—
38754	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:—	SHA256:—
38754	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:—	SHA256:—
38754	chrome	/home/user/.config/google-chrome/Default/History		sqlite
		MD5:—	SHA256:—
38754	chrome	/home/user/.config/google-chrome/Default/DawnWebGPUCache/data_3		vxd
		MD5:—	SHA256:—
38754	chrome	/home/user/.config/google-chrome/Default/DawnWebGPUCache/data_2		vxd
		MD5:—	SHA256:—
38754	chrome	/home/user/.config/google-chrome/Default/DawnWebGPUCache/data_0		vxd
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

2

TCP/UDP connections

21

DNS requests

24

Threats

1

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
488	NetworkManager	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38799	chrome	GET	200	103.188.82.218:80	http://103.188.82.218/x/x86	unknown	—	—	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
488	NetworkManager	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
1178	snap-store	195.181.175.41:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
38799	chrome	142.250.185.99:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
38799	chrome	172.217.18.10:443	safebrowsingohttpgateway.googleapis.com	GOOGLE	US	whitelisted
38799	chrome	103.188.82.218:80	—	Bach Kim Network solutions Join stock company	VN	malicious
38799	chrome	142.250.153.84:443	accounts.google.com	GOOGLE	US	whitelisted
38799	chrome	103.188.82.218:443	—	Bach Kim Network solutions Join stock company	VN	malicious

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2620:2d:4000:1::2b 2620:2d:4002:1::197 2620:2d:4002:1::196 2620:2d:4000:1::98 2620:2d:4000:1::23 2001:67c:1562::24 2620:2d:4000:1::2a 2620:2d:4002:1::198 2620:2d:4000:1::96 2001:67c:1562::23 2620:2d:4000:1::22 2620:2d:4000:1::97 185.125.190.17 91.189.91.97 185.125.190.48 185.125.190.18 91.189.91.96 91.189.91.48 185.125.190.96 91.189.91.98 91.189.91.49 185.125.190.49 185.125.190.98 185.125.190.97	whitelisted
google.com	142.250.186.78 2a00:1450:4001:828::200e	whitelisted
odrs.gnome.org	195.181.175.41 37.19.194.80 207.211.211.27 212.102.56.179 169.150.255.183 195.181.170.19 169.150.255.181 2a02:6ea0:c700::101 2a02:6ea0:c700::21 2a02:6ea0:c700::107 2a02:6ea0:c700::112 2a02:6ea0:c700::19 2a02:6ea0:c700::18 2a02:6ea0:c700::11	whitelisted
clientservices.googleapis.com	142.250.185.99	whitelisted
safebrowsingohttpgateway.googleapis.com	172.217.18.10 216.58.212.138 142.250.185.74 142.250.185.234 216.58.206.42 172.217.16.202 142.250.185.202 142.250.186.106 172.217.16.138 142.250.181.234 172.217.23.106 142.250.184.202 142.250.185.170 142.250.185.106 142.250.186.138 142.250.186.170	whitelisted
accounts.google.com	142.250.153.84	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.55 185.125.188.59 185.125.188.54 2620:2d:4000:1010::117 2620:2d:4000:1010::42 2620:2d:4000:1010::6d 2620:2d:4000:1010::2e6	whitelisted
google-ohttp-relay-safebrowsing.fastly-edge.com	151.101.129.91 151.101.1.91 151.101.193.91 151.101.65.91	unknown
update.googleapis.com	172.217.18.3	whitelisted
10.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
38799	chrome	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP

Add for printing

No debug info

General Info

http://103.188.82.218/x/x86

256501D8500429157114E7FB92BFF31F

C3327543983E986606A8D62F674A2D6F947C2A0B

44F537DB41CDECE148983A733386EB82DE10210EAD9E3F5E12DEDFDCD0354034

3:N1KtMEd9EKdKT:CCE8K+

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Potential Corporate Privacy Violation

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings