| File name: | kworker |
| Full analysis: | https://app.any.run/tasks/f0bdb5d6-1082-4fd1-b815-0f9bc3e34892 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | April 11, 2026, 17:30:34 |
| OS: | Ubuntu 22.04.2 |
| Tags: | |
| Indicators: | |
| MIME: | text/x-shellscript |
| File info: | POSIX shell script, ASCII text executable, with very long lines (3964) |
| MD5: | FEA52AB0CC2717301B0E197BBFEC894F |
| SHA1: | A5E71A9889FD8EE32175B064238AC1731E310A8F |
| SHA256: | 92A71778310BF37CF81C8F42A250EA7B9ED17042B577D90F5D179F90AC1C056A |
| SSDEEP: | 768:vxlT2wDuWvWi7uDcFHcbSRlIniRULz/Ql/+9V:wHDEcbSciI19V |
| .sh | | | Linux/UNIX shell script (100) |
|---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1899 | /bin/sh -c "sudo chown user /tmp/kworker\.sh && chmod +x /tmp/kworker\.sh && DISPLAY=:0 sudo -iu user /tmp/kworker\.sh " | /usr/bin/dash | — | ClU101gqD6apx7CA | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1900 | sudo chown user /tmp/kworker.sh | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1901 | chown user /tmp/kworker.sh | /usr/bin/chown | — | sudo | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1902 | chmod +x /tmp/kworker.sh | /usr/bin/chmod | — | dash | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1903 | sudo -iu user /tmp/kworker.sh | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1904 | /bin/sh /tmp/kworker.sh | /usr/bin/dash | sudo | ||||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1905 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | dash | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1906 | chmod 777 /usr/bin/chattr /bin/chattr | /usr/bin/chmod | — | dash | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 256 Modules
| |||||||||||||||
| 1907 | chattr -iua /tmp/ /var/tmp/ | /usr/bin/chattr | — | dash | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 256 Modules
| |||||||||||||||
| 1908 | iptables -F | /usr/sbin/xtables-nft-multi | — | dash | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 1024 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1904 | dash | /tmp/kdevtmpfsi | text | |
MD5:— | SHA256:— | |||
| 3202 | crontab | /var/spool/cron/crontabs/user | text | |
MD5:— | SHA256:— | |||
| 1904 | dash | /home/user/.ssh/authorized_keys | text | |
MD5:— | SHA256:— | |||
| 1904 | dash | /tmp/javae (deleted) | text | |
MD5:— | SHA256:— | |||
| 1904 | dash | /tmp/javae | binary | |
MD5:— | SHA256:— | |||
| 1904 | dash | /tmp/kworker | text | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.101:80 | http://connectivity-check.ubuntu.com/ | GB | — | — | whitelisted |
3215 | curl | HEAD | 200 | 34.70.205.211:80 | http://34.70.205.211/plugins-dist/safehtml/lang/font/javae | US | — | — | unknown |
3216 | curl | GET | — | 34.70.205.211:80 | http://34.70.205.211/plugins-dist/safehtml/lang/font/javae | US | — | — | unknown |
3217 | curl | HEAD | 200 | 34.70.205.211:80 | http://34.70.205.211/plugins-dist/safehtml/lang/font/kworker | US | — | — | unknown |
3218 | curl | GET | 200 | 34.70.205.211:80 | http://34.70.205.211/plugins-dist/safehtml/lang/font/kworker | US | text | 35.4 Kb | unknown |
3250 | curl | GET | 200 | 34.70.205.211:80 | http://34.70.205.211/plugins-dist/safehtml/lang/font/cb.txt | US | text | 4.32 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
459 | avahi-daemon | 224.0.0.251:5353 | — | — | — | whitelisted |
1 | systemd | 37.19.194.81:443 | odrs.gnome.org | CDN77 _ | GB | whitelisted |
— | — | 185.125.190.101:80 | connectivity-check.ubuntu.com | CANONICAL-AS | GB | whitelisted |
— | — | 195.181.170.18:443 | odrs.gnome.org | CDN77 _ | GB | whitelisted |
— | — | 185.125.188.57:443 | api.snapcraft.io | CANONICAL-AS | GB | whitelisted |
1391 | snap-store | 195.181.175.40:443 | odrs.gnome.org | CDN77 _ | GB | whitelisted |
485 | snapd | 185.125.188.57:443 | api.snapcraft.io | CANONICAL-AS | GB | whitelisted |
3215 | curl | 34.70.205.211:80 | — | GOOGLE-CLOUD-PLATFORM | US | unknown |
3216 | curl | 34.70.205.211:80 | — | GOOGLE-CLOUD-PLATFORM | US | unknown |
3217 | curl | 34.70.205.211:80 | — | GOOGLE-CLOUD-PLATFORM | US | unknown |
Domain | IP | Reputation |
|---|---|---|
odrs.gnome.org |
| whitelisted |
google.com |
| whitelisted |
connectivity-check.ubuntu.com |
| whitelisted |
api.snapcraft.io |
| whitelisted |
11.100.168.192.in-addr.arpa |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
3215 | curl | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
3216 | curl | Potential Corporate Privacy Violation | ET INFO Executable and linking format (ELF) file download Over HTTP |
3216 | curl | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
3217 | curl | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
3218 | curl | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
3250 | curl | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |