Malware analysis https://raw.githubusercontent.com/hekerprotzy/rootshell/main/auto.tar.gz Malicious activity

Add for printing

URL:	https://raw.githubusercontent.com/hekerprotzy/rootshell/main/auto.tar.gz
Full analysis:	https://app.any.run/tasks/70d257bf-428e-482a-9bb9-fbe53f129a35
Verdict:	Malicious activity
Analysis date:	June 21, 2024, 13:36:28
OS:	Ubuntu 22.04.2
MD5:	9F4826ABBABE64CA65A5A2897D53F994
SHA1:	117FAA47A3F87085608CCF1C3B0C09C21858640D
SHA256:	656B0DB127F1C8FE9E4B519DEA1CE62FAF01AD5A9CB0D94DE28DE373AC7CDBFA
SSDEEP:	3:N8SGfALtGTHP91Kn7KIEKKy2c:2FMGLPn5Rpc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - overlayfs (PID: 13263)
  - nautilus (PID: 13261)
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 13240)
  - udevadm (PID: 13277)
- Executes the "rm" command to delete files or directories
  - sh (PID: 13264)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 13267)
  - modprobe (PID: 13290)
  - modprobe (PID: 13284)
  - modprobe (PID: 13292)
- Uses pkexec (likely to bypass security restrictions)
  - 0 (PID: 13269)
  - ptrace (PID: 13268)
  - nautilus (PID: 13271)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

326

Monitored processes

111

Malicious processes

0

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
12927	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://raw\.githubusercontent\.com/hekerprotzy/rootshell/main/auto\.tar\.gz "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN
12928	sudo -iu user google-chrome https://raw.githubusercontent.com/hekerprotzy/rootshell/main/auto.tar.gz	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN
12929	/usr/bin/google-chrome https://raw.githubusercontent.com/hekerprotzy/rootshell/main/auto.tar.gz	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
12930	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12931	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12932	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12933	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12934	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
12935	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
12936		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

60

Text files

6

Unknown types

8

Dropped files

PID	Process	Filename		Type
12929	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		vxd
		MD5:—	SHA256:—
12929	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		vxd
		MD5:—	SHA256:—
12929	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		vxd
		MD5:—	SHA256:—
12929	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:—	SHA256:—
12929	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:—	SHA256:—
12929	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:—	SHA256:—
12929	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_3		vxd
		MD5:—	SHA256:—
12929	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_2		vxd
		MD5:—	SHA256:—
12929	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_0		vxd
		MD5:—	SHA256:—
13077	chrome	/home/user/.cache/mesa_shader_cache/index		koa
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

30

DNS requests

32

Threats

0

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.96:80	—	Canonical Group Limited	US	unknown
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.48:80	—	Canonical Group Limited	US	unknown
—	—	156.146.33.14:443	odrs.gnome.org	Datacamp Limited	DE	unknown
—	—	142.250.186.67:443	clientservices.googleapis.com	GOOGLE	US	unknown
—	—	74.125.71.84:443	accounts.google.com	—	—	unknown
12929	chrome	239.255.255.250:1900	—	—	—	whitelisted
—	—	142.250.185.106:443	safebrowsingohttpgateway.googleapis.com	GOOGLE	US	unknown
—	—	185.199.110.133:443	raw.githubusercontent.com	FASTLY	US	unknown
—	—	142.250.184.195:443	update.googleapis.com	GOOGLE	US	unknown

DNS requests

Domain	IP	Reputation
odrs.gnome.org	156.146.33.14 212.102.56.182 195.181.175.40 156.146.33.138 195.181.175.16 156.146.33.140 212.102.56.178 2a02:6ea0:c700::101 2a02:6ea0:c700::10 2a02:6ea0:c700::18 2a02:6ea0:c700::11 2a02:6ea0:c700::17 2a02:6ea0:c700::21 2a02:6ea0:c700::22	unknown
accounts.google.com	74.125.71.84	shared
clientservices.googleapis.com	142.250.186.67	whitelisted
raw.githubusercontent.com	185.199.110.133 185.199.111.133 185.199.108.133 185.199.109.133	shared
safebrowsingohttpgateway.googleapis.com	142.250.185.106 142.250.184.202 142.250.186.74 172.217.18.10 142.250.186.170 172.217.16.138 142.250.185.234 142.250.185.138 142.250.185.202 142.250.181.234 142.250.186.42 142.250.185.170 216.58.212.170 216.58.212.138 142.250.186.138 142.250.74.202	unknown
update.googleapis.com	142.250.184.195	whitelisted
api.snapcraft.io	185.125.188.59 185.125.188.58 185.125.188.54 185.125.188.55	unknown
www.google.com	142.250.184.228	whitelisted
134.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4000:1::2b 2620:2d:4002:1::197 2001:67c:1562::23 2620:2d:4000:1::98 2620:2d:4000:1::22 2620:2d:4000:1::2a 2620:2d:4002:1::198 2001:67c:1562::24 2620:2d:4002:1::196 2620:2d:4000:1::96 2620:2d:4000:1::23 2620:2d:4000:1::97	unknown

Threats

No threats detected

Add for printing

No debug info

General Info

https://raw.githubusercontent.com/hekerprotzy/rootshell/main/auto.tar.gz

9F4826ABBABE64CA65A5A2897D53F994

117FAA47A3F87085608CCF1C3B0C09C21858640D

656B0DB127F1C8FE9E4B519DEA1CE62FAF01AD5A9CB0D94DE28DE373AC7CDBFA

3:N8SGfALtGTHP91Kn7KIEKKy2c:2FMGLPn5Rpc

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Checks DMI information (probably VM detection)

Executes the "rm" command to delete files or directories

Manipulating modules (likely to execute programs on system boot)

Uses pkexec (likely to bypass security restrictions)

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings