Malware analysis x86.Sakura Malicious activity | ANY.RUN

Add for printing

File name:	x86.Sakura
Full analysis:	https://app.any.run/tasks/36355f17-d105-48d4-a9e9-cf18fb35fcb8
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Gafgyt, also known as BASHLITE, is a botnet affecting Internet of Things (IoT) devices and Linux-based systems. The malware aims to compromise and gain control of these devices, often by exploiting weak or default passwords, as well as known vulnerabilities. Gafgyt has been around since 2014 and has evolved into multiple variants, each with its own set of features and capabilities, including the ability to launch distributed denial of service (DDoS) attacks. Malware Trends Tracker >>>
Analysis date:	April 18, 2025, 16:57:34
OS:	Ubuntu 22.04.2
Tags:	ddos gafgyt botnet
Indicators:
MIME:	application/x-executable
File info:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
MD5:	6D224ACF8437C18434B11E347268E24D
SHA1:	C8005003E2AA8EC91D8C84964ECA866E95687A8E
SHA256:	848B6E03F1630134236BAC98B2CEA22A3FC33E380B43EBEC02172EEAD70DBFF4
SSDEEP:	1536:0YRG8ZACBPgom6QRnZA1XV/SyU7mA+KWOXFseaZYxe:JG8Zv9gf6QRnZA1NWm/KWOXF7aZYxe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- GAFGYT has been detected (SURICATA)
  - x86.Sakura.elf (PID: 39497)
- Connects to the CnC server
  - x86.Sakura.elf (PID: 39497)
SUSPICIOUS
- Reads network configuration
  - sudo (PID: 39493)
- Modifies file or directory owner
  - sudo (PID: 39490)
- Gets active network interfaces
  - sudo (PID: 39493)
- Executes commands using command-line interpreter
  - sudo (PID: 39493)
- Reads profile file
  - x86.Sakura.elf (PID: 39494)
- Reads passwd file
  - x86.Sakura.elf (PID: 39494)
- Contacting a server suspected of hosting an CnC
  - x86.Sakura.elf (PID: 39497)
- Connects to unusual port
  - x86.Sakura.elf (PID: 39497)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

229

Monitored processes

9

Malicious processes

5

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
39489	/bin/sh -c "sudo chown user /tmp/x86\.Sakura\.elf && chmod +x /tmp/x86\.Sakura\.elf && DISPLAY=:0 sudo -iu user /tmp/x86\.Sakura\.elf "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
39490	sudo chown user /tmp/x86.Sakura.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39491	chown user /tmp/x86.Sakura.elf	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
39492	chmod +x /tmp/x86.Sakura.elf	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39493	sudo -iu user /tmp/x86.Sakura.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39494	/tmp/x86.Sakura.elf	/tmp/x86.Sakura.elf	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
39495	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	x86.Sakura.elf
User: user Integrity Level: UNKNOWN Exit code: 0
39496	/tmp/x86.Sakura.elf	/tmp/x86.Sakura.elf	—	x86.Sakura.elf
User: user Integrity Level: UNKNOWN Exit code: 0
39497	/tmp/x86.Sakura.elf	/tmp/x86.Sakura.elf		x86.Sakura.elf
User: user Integrity Level: UNKNOWN

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

318

DNS requests

11

Threats

634

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	169.150.255.183:443	odrs.gnome.org	—	GB	whitelisted
—	—	169.150.255.181:443	odrs.gnome.org	—	GB	whitelisted
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
39497	x86.Sakura.elf	149.88.87.187:12345	—	COMCAST-7922	US	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2001:67c:1562::24 2620:2d:4000:1::2b 2620:2d:4002:1::198 2620:2d:4000:1::22 2620:2d:4000:1::23 2620:2d:4000:1::98 2620:2d:4000:1::2a 2620:2d:4000:1::96 2620:2d:4000:1::97 2001:67c:1562::23 2620:2d:4002:1::197 2620:2d:4002:1::196 185.125.190.96 185.125.190.49 185.125.190.98 185.125.190.48 185.125.190.18 185.125.190.97 185.125.190.17 91.189.91.98 91.189.91.49 91.189.91.96 91.189.91.48 91.189.91.97	whitelisted
odrs.gnome.org	169.150.255.183 207.211.211.26 37.19.194.81 195.181.170.19 212.102.56.179 169.150.255.181 195.181.175.40 2a02:6ea0:c700::11 2a02:6ea0:c700::107 2a02:6ea0:c700::112 2a02:6ea0:c700::18 2a02:6ea0:c700::19 2a02:6ea0:c700::21 2a02:6ea0:c700::101	whitelisted
google.com	216.58.212.142 2a00:1450:4001:829::200e	whitelisted
api.snapcraft.io	185.125.188.54 185.125.188.55 185.125.188.59 185.125.188.58 2620:2d:4000:1010::6d 2620:2d:4000:1010::344 2620:2d:4000:1010::42 2620:2d:4000:1010::117	whitelisted
14.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 4
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 2
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 2
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 4
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 2
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 4
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 2
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 4
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 4
39497	x86.Sakura.elf	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Gafgyt CnC Communication 2

Add for printing

No debug info

General Info

x86.Sakura

6D224ACF8437C18434B11E347268E24D

C8005003E2AA8EC91D8C84964ECA866E95687A8E

848B6E03F1630134236BAC98B2CEA22A3FC33E380B43EBEC02172EEAD70DBFF4

1536:0YRG8ZACBPgom6QRnZA1XV/SyU7mA+KWOXFseaZYxe:JG8Zv9gf6QRnZA1NWm/KWOXF7aZYxe

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

GAFGYT has been detected (SURICATA)

Connects to the CnC server

SUSPICIOUS

Reads network configuration

Modifies file or directory owner

Gets active network interfaces

Executes commands using command-line interpreter

Reads profile file

Reads passwd file

Contacting a server suspected of hosting an CnC

Connects to unusual port

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings