Malware analysis http://45.87.154.160/shk Malicious activity

Add for printing

URL:	http://45.87.154.160/shk
Full analysis:	https://app.any.run/tasks/e62865de-4646-4d9e-9c34-14e2c5ff0ab1
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	May 07, 2024, 10:59:34
OS:	Ubuntu 22.04.2
Tags:	telnet botnet miori mirai
MD5:	93988F1BD36E5F594C451014B3A21F1E
SHA1:	27828E4C1A51AFD385AD0E162B0276D88322D5A4
SHA256:	528A04D5BE46B835E1640DB9F7172F614CFD605252622E9208EB15FF057FF714
SSDEEP:	3:N1KGUj4:CGT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 9541)
- Creates shell script file
  - gedit (PID: 9465)
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 9589)
  - su (PID: 9616)
  - bash (PID: 9617)
- Reads information about logins, logouts, and login attempts
  - bash (PID: 9607)
  - sudo (PID: 9615)
- Executes the "rm" command to delete files or directories
  - bash (PID: 9623)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 9629)
  - modprobe (PID: 9635)
- Uses wget to download content
  - bash (PID: 9623)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

359

Monitored processes

139

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9269	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome http://45\.87\.154\.160/shk "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN
9270	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
9271	sudo -iu user google-chrome http://45.87.154.160/shk	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN
9272	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
9273	/usr/bin/google-chrome http://45.87.154.160/shk	/opt/google/chrome/chrome	—	sudo
User: user Integrity Level: UNKNOWN
9274	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9275	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9276	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9277	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9278	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9273	chrome	/9273/fd/63		—
		MD5:—	SHA256:—
9273	chrome	/home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-663A099C-2439.pma		—
		MD5:—	SHA256:—
9273	chrome	/home/user/.config/google-chrome/Default/Site Characteristics Database/LOG		—
		MD5:—	SHA256:—
9273	chrome	/home/user/.config/google-chrome/Default/Local Storage/leveldb/LOG		—
		MD5:—	SHA256:—
9273	chrome	/home/user/.config/google-chrome/Default/commerce_subscription_db/LOG		—
		MD5:—	SHA256:—
9273	chrome	/home/user/.config/google-chrome/Default/discounts_db/LOG		—
		MD5:—	SHA256:—
9273	chrome	/home/user/.config/google-chrome/Default/parcel_tracking_db/LOG		—
		MD5:—	SHA256:—
9273	chrome	/home/user/.config/google-chrome/Default/chrome_cart_db/LOG		—
		MD5:—	SHA256:—
9273	chrome	/home/user/.config/google-chrome/Default/coupon_db/LOG		—
		MD5:—	SHA256:—
9273	chrome	/home/user/.config/google-chrome/Default/LOG		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

12

TCP/UDP connections

58 642

DNS requests

23

Threats

108

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	200	45.87.154.160:80	http://45.87.154.160/shk	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.153e9301be7e862a33e2cab936a0a97e2f8bdf2dae1be516d6fe8a5f184ce028/1.4a6508925b2ffec931c1e3931ddeb15ca41d820a8264cd5a962b526e9932bcdf/1bbd0eca21eb9c81cf6ffb73afcdf08d70ee6d920b87e2e731f03dc4ac0a6cf8.puff	unknown	—	—	unknown
—	—	GET	404	45.87.154.160:80	http://45.87.154.160/favicon.ico	unknown	—	—	unknown
—	—	GET	200	45.87.154.160:80	http://45.87.154.160/x86	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/ggkkehgbnfjpeggfpleeakpidbkibbmn/1.905f83845e25579fd4c6ae4bdc81a2740a216023f856918045ced4508329c941/1.c45cd56a0a8da0883c8f9757b31891d6c628f38cb80724015ffdf33b419a73f3/0e81ca17ff2d8fc4645b4dd59216b1ad6413403ef03bae5dc24f1bbb977f7a5a.puff	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acf23by5mmnw2i55m3sw7vulsnnq_2024.5.5.1/jflhchccmppkfebkiaminageehmchikm_2024.05.05.01_all_myqtvl4ms7ochmrvqawjo7j7km.crx3	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jmaarj3zzn5i3bp5agmrb7k3pu_3028/jflookgnkcckhobaglndicnbbgbonegd_3028_all_adtsy74lce7u5mtzcrq4jm4azpia.crx3	unknown	—	—	unknown
—	—	GET	200	45.87.154.160:80	http://45.87.154.160/mips	unknown	—	—	unknown
—	—	GET	200	45.87.154.160:80	http://45.87.154.160/mpsl	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.49:80	—	Canonical Group Limited	GB	unknown
—	—	91.189.91.98:80	—	Canonical Group Limited	US	unknown
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	239.255.255.250:1900	—	—	—	unknown
—	—	172.217.18.3:443	clientservices.googleapis.com	GOOGLE	US	unknown
—	—	64.233.166.84:443	accounts.google.com	GOOGLE	US	unknown
—	—	45.87.154.160:80	—	Stark Industries Solutions Ltd	NL	unknown
—	—	45.87.154.160:443	—	Stark Industries Solutions Ltd	NL	unknown

DNS requests

Domain	IP	Reputation
api.snapcraft.io	185.125.188.58 185.125.188.59 185.125.188.54 185.125.188.55	unknown
clientservices.googleapis.com	172.217.18.3	whitelisted
accounts.google.com	64.233.166.84	shared
update.googleapis.com	216.58.206.35	unknown
164.100.168.192.in-addr.arpa	—	unknown
www.google.com	216.58.206.68	whitelisted
optimizationguide-pa.googleapis.com	142.250.185.170 216.58.212.138 216.58.212.170 142.250.181.234 142.250.185.106 216.58.206.74 142.250.186.170 142.250.186.106 142.250.185.138 142.250.185.74 172.217.18.10 142.250.184.234 142.250.185.234 172.217.16.202 142.250.185.202 216.58.206.42	whitelisted
connectivity-check.ubuntu.com	2620:2d:4002:1::198 2620:2d:4002:1::197 2620:2d:4002:1::196 2620:2d:4000:1::2b 2620:2d:4000:1::97 2001:67c:1562::23 2620:2d:4000:1::23 2620:2d:4000:1::22 2620:2d:4000:1::96 2620:2d:4000:1::98 2620:2d:4000:1::2a 2001:67c:1562::24	unknown
edgedl.me.gvt1.com	34.104.35.123	whitelisted

Threats

PID	Process	Class	Message
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 5
—	—	Potential Corporate Privacy Violation	POLICY [ANY.RUN] Received Telnet Banner
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Miori.BootNoot Execution Command
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Miori.BootNoot Execution Command
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Miori.BootNoot Execution Command
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Miori.BootNoot Execution Command
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Miori.BootNoot Execution Command

Add for printing

No debug info

General Info

http://45.87.154.160/shk

93988F1BD36E5F594C451014B3A21F1E

27828E4C1A51AFD385AD0E162B0276D88322D5A4

528A04D5BE46B835E1640DB9F7172F614CFD605252622E9208EB15FF057FF714

3:N1KGUj4:CGT

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Checks DMI information (probably VM detection)

Creates shell script file

Executes commands using command-line interpreter

Reads information about logins, logouts, and login attempts

Executes the "rm" command to delete files or directories

Manipulating modules (likely to execute programs on system boot)

Uses wget to download content

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings