Malware analysis oPog2p9Wms.elf Malicious activity | ANY.RUN

Add for printing

File name:	oPog2p9Wms.elf
Full analysis:	https://app.any.run/tasks/7a8799d5-3bc9-4f06-9455-d90b743d8d8a
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 02:17:16
OS:	Ubuntu 22.04.2
Tags:	auto generic
Indicators:
MIME:	application/x-executable
File info:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
MD5:	88C8DB87EBBDE2A330783999D69704F5
SHA1:	62761C693B66EAA766BAAA51FD7E16E288510CBC
SHA256:	53FB9390D471F30B79297095159247D23C0AF868FD02C43AFCD797BC83816678
SSDEEP:	98304:QNelO63XRtq8wQ1zrtLHchguklU6EZdaltNrX3fv+iyk6icRxzWGbCupPSTGhYsp:oAMbjB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 1901)
- Executes commands using command-line interpreter
  - sudo (PID: 1904)
- Check the Environment Variables Related to System Identification (os-release)
  - python3.10 (PID: 1968)
  - update-notifier (PID: 1930)
  - python3.10 (PID: 1970)
  - python3.10 (PID: 1973)
  - python3.10 (PID: 1967)
  - python3.10 (PID: 1969)
- Reads /proc/mounts (likely used to find writable filesystems)
  - python3.10 (PID: 1954)
  - python3.10 (PID: 1990)
- Reads passwd file
  - whoopsie (PID: 1999)
  - oPog2p9Wms.elf (PID: 1912)
INFO
- Checks timezone
  - python3.10 (PID: 1954)
  - python3.10 (PID: 1968)
  - python3.10 (PID: 1973)
  - python3.10 (PID: 1988)
  - python3.10 (PID: 1987)
  - whoopsie (PID: 1999)
  - python3.10 (PID: 1986)
  - python3.10 (PID: 1990)
  - python3.10 (PID: 2014)
  - python3.10 (PID: 2006)
  - python3.10 (PID: 1970)
  - python3.10 (PID: 1969)
  - python3.10 (PID: 1967)
- Creates file in the temporary folder
  - python3.10 (PID: 1973)
  - python3.10 (PID: 1990)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

178

Monitored processes

57

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1900

/bin/sh -c "sudo chown user /tmp/oPog2p9Wms\.elf && chmod +x /tmp/oPog2p9Wms\.elf && DISPLAY=:0 sudo -i /tmp/oPog2p9Wms\.elf "

/usr/bin/dash

—

zhqBI23Omt06cXXL

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

1901

sudo chown user /tmp/oPog2p9Wms.elf

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

1902

chown user /tmp/oPog2p9Wms.elf

/usr/bin/chown

—

sudo

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

1903

chmod +x /tmp/oPog2p9Wms.elf

/usr/bin/chmod

—

dash

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

1904

sudo -i /tmp/oPog2p9Wms.elf

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

1905

/tmp/oPog2p9Wms.elf

—

sudo

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6

1906

/usr/bin/locale-check C.UTF-8

/usr/bin/locale-check

—

oPog2p9Wms.elf

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

1907

-bash --login -c \/tmp\/oPog2p9Wms\.elf

/usr/bin/bash

—

oPog2p9Wms.elf

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

1908

sh -c "cat /usr/etc/debuginfod/*\.urls 2>/dev/null"

/usr/bin/dash

—

bash

User:

root

Integrity Level:

UNKNOWN

Exit code:

256

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

1909

tr \n " "

/usr/bin/tr

—

bash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

Add for printing

Executable files

0

Suspicious files

0

Text files

6

Unknown types

0

Dropped files

PID	Process	Filename		Type
1973	python3.10	/tmp/#6029332 (deleted)		text
		MD5:—	SHA256:—
1973	python3.10	/tmp/#6029333 (deleted)		text
		MD5:—	SHA256:—
1973	python3.10	/tmp/#6029335 (deleted)		text
		MD5:—	SHA256:—
1973	python3.10	/tmp/#6029338 (deleted)		text
		MD5:—	SHA256:—
1990	python3.10	/tmp/mdno6orx (deleted)		text
		MD5:—	SHA256:—
1999	whoopsie	/var/lib/whoopsie/whoopsie-id		text
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

96

DNS requests

12

Threats

0

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
473	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.57:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
494	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
494	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
494	snapd	185.125.188.57:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted

DNS requests

Domain	IP	Reputation
google.com	172.217.16.142 2a00:1450:4001:808::200e	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.59 185.125.188.54 185.125.188.57 2620:2d:4000:1010::2e6 2620:2d:4000:1010::344 2620:2d:4000:1010::117 2620:2d:4000:1010::42	whitelisted
connectivity-check.ubuntu.com	185.125.190.17 185.125.190.97 91.189.91.97 91.189.91.98 185.125.190.98 185.125.190.96 185.125.190.49 91.189.91.49 91.189.91.48 185.125.190.48 185.125.190.18 91.189.91.96 2620:2d:4000:1::22 2620:2d:4000:1::98 2620:2d:4002:1::197 2620:2d:4000:1::2b 2620:2d:4002:1::196 2620:2d:4000:1::97 2620:2d:4002:1::198 2620:2d:4000:1::2a 2620:2d:4000:1::96 2001:67c:1562::24 2001:67c:1562::23 2620:2d:4000:1::23	whitelisted
8.100.168.192.in-addr.arpa	—	unknown
changelogs.ubuntu.com	91.189.91.49 91.189.91.48 185.125.190.17 185.125.190.18 2001:67c:1562::23 2620:2d:4000:1::2a 2001:67c:1562::24 2620:2d:4000:1::2b	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

oPog2p9Wms.elf

88C8DB87EBBDE2A330783999D69704F5

62761C693B66EAA766BAAA51FD7E16E288510CBC

53FB9390D471F30B79297095159247D23C0AF868FD02C43AFCD797BC83816678

98304:QNelO63XRtq8wQ1zrtLHchguklU6EZdaltNrX3fv+iyk6icRxzWGbCupPSTGhYsp:oAMbjB

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Check the Environment Variables Related to System Identification (os-release)

Reads /proc/mounts (likely used to find writable filesystems)

Reads passwd file

INFO

Checks timezone

Creates file in the temporary folder

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings