File name:

kworker

Full analysis: https://app.any.run/tasks/f0bdb5d6-1082-4fd1-b815-0f9bc3e34892
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Analysis date: April 11, 2026, 17:30:34
OS: Ubuntu 22.04.2
Tags:
auto
coinminer
miner
kinsing
backdoor
mrbot
botnet
Indicators:
MIME: text/x-shellscript
File info: POSIX shell script, ASCII text executable, with very long lines (3964)
MD5:

FEA52AB0CC2717301B0E197BBFEC894F

SHA1:

A5E71A9889FD8EE32175B064238AC1731E310A8F

SHA256:

92A71778310BF37CF81C8F42A250EA7B9ED17042B577D90F5D179F90AC1C056A

SSDEEP:

768:vxlT2wDuWvWi7uDcFHcbSRlIniRULz/Ql/+9V:wHDEcbSciI19V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Modifies or disables the system firewall

      • dash (PID: 1904)
    • Removes log files

      • dash (PID: 1904)
    • Apparmor service disabling

      • dash (PID: 1904)
    • KINSING has been detected

      • rm (PID: 2609)
    • COINMINER has been found (auto)

      • dash (PID: 1904)
    • MRBOT has been detected

      • rm (PID: 2609)
    • Appends a new rule to chain (Iptables)

      • dash (PID: 1904)
  • SUSPICIOUS

    • System firewall impairment

      • dash (PID: 1904)
    • Modifies file or directory owner

      • sudo (PID: 1900)
    • Removes file immutable attribute

      • dash (PID: 1904)
    • Reads passwd file

      • ps (PID: 1930)
      • ps (PID: 1932)
      • ps (PID: 1953)
      • ps (PID: 1958)
      • ps (PID: 1987)
      • ps (PID: 1995)
      • ps (PID: 1963)
      • ps (PID: 1971)
      • ps (PID: 1979)
      • ps (PID: 2020)
      • ps (PID: 2015)
      • ps (PID: 2025)
      • ps (PID: 2030)
      • ps (PID: 2040)
      • ps (PID: 2035)
      • ps (PID: 2000)
      • ps (PID: 2005)
      • ps (PID: 2010)
      • ps (PID: 2172)
      • ps (PID: 2152)
      • ps (PID: 2162)
      • ps (PID: 2167)
      • ps (PID: 2178)
      • ps (PID: 2147)
      • ps (PID: 2157)
      • ps (PID: 2193)
      • ps (PID: 2198)
      • ps (PID: 2203)
      • ps (PID: 2208)
      • ps (PID: 2223)
      • ps (PID: 2183)
      • ps (PID: 2188)
      • ps (PID: 2213)
      • ps (PID: 2218)
      • ps (PID: 2238)
      • ps (PID: 2243)
      • ps (PID: 2253)
      • ps (PID: 2258)
      • ps (PID: 2263)
      • ps (PID: 2228)
      • ps (PID: 2233)
      • ps (PID: 2248)
      • ps (PID: 2268)
      • ps (PID: 2273)
      • ps (PID: 2279)
      • ps (PID: 2286)
      • ps (PID: 2291)
      • ps (PID: 2296)
      • ps (PID: 2301)
      • ps (PID: 2306)
      • ps (PID: 2331)
      • ps (PID: 2346)
      • ps (PID: 2341)
      • ps (PID: 2311)
      • ps (PID: 2316)
      • ps (PID: 2321)
      • ps (PID: 2326)
      • ps (PID: 2336)
      • ps (PID: 2361)
      • ps (PID: 2366)
      • ps (PID: 2371)
      • ps (PID: 2376)
      • ps (PID: 2392)
      • ps (PID: 2387)
      • ps (PID: 2398)
      • ps (PID: 2351)
      • ps (PID: 2356)
      • ps (PID: 2382)
      • ps (PID: 2410)
      • ps (PID: 2435)
      • ps (PID: 2415)
      • ps (PID: 2420)
      • ps (PID: 2425)
      • ps (PID: 2430)
      • ps (PID: 2440)
      • ps (PID: 2445)
      • ps (PID: 2404)
      • ps (PID: 2456)
      • ps (PID: 2468)
      • ps (PID: 2480)
      • ps (PID: 2474)
      • ps (PID: 2486)
      • ps (PID: 2492)
      • ps (PID: 2450)
      • ps (PID: 2462)
      • ps (PID: 2509)
      • ps (PID: 2551)
      • ps (PID: 2545)
      • ps (PID: 2527)
      • ps (PID: 2539)
      • ps (PID: 2533)
      • ps (PID: 2498)
      • ps (PID: 2503)
      • ps (PID: 2515)
      • ps (PID: 2521)
      • ps (PID: 2557)
      • ps (PID: 2568)
      • ps (PID: 2573)
      • ps (PID: 2588)
      • ps (PID: 2583)
      • ps (PID: 2563)
      • ps (PID: 2578)
      • ls (PID: 2727)
      • ls (PID: 2729)
      • ls (PID: 2731)
      • ls (PID: 2733)
      • ls (PID: 2737)
      • ls (PID: 2735)
      • crontab (PID: 2718)
      • ls (PID: 2743)
      • ls (PID: 2739)
      • ls (PID: 2747)
      • ls (PID: 2745)
      • ls (PID: 2749)
      • ls (PID: 2751)
      • ls (PID: 2755)
      • ls (PID: 2741)
      • ls (PID: 2761)
      • ls (PID: 2765)
      • ls (PID: 2769)
      • ls (PID: 2767)
      • ls (PID: 2753)
      • ls (PID: 2757)
      • ls (PID: 2759)
      • ls (PID: 2763)
      • ls (PID: 2777)
      • ls (PID: 2783)
      • ls (PID: 2775)
      • ls (PID: 2781)
      • ls (PID: 2785)
      • ls (PID: 2771)
      • ls (PID: 2773)
      • ls (PID: 2779)
      • ls (PID: 2793)
      • ls (PID: 2799)
      • ls (PID: 2795)
      • ls (PID: 2801)
      • ls (PID: 2797)
      • ls (PID: 2789)
      • ls (PID: 2787)
      • ls (PID: 2791)
      • ls (PID: 2803)
      • ls (PID: 2809)
      • ls (PID: 2807)
      • ls (PID: 2811)
      • ls (PID: 2815)
      • ls (PID: 2813)
      • ls (PID: 2817)
      • ls (PID: 2821)
      • ls (PID: 2805)
      • ls (PID: 2823)
      • ls (PID: 2825)
      • ls (PID: 2827)
      • ls (PID: 2829)
      • ls (PID: 2831)
      • ls (PID: 2819)
      • ls (PID: 2839)
      • ls (PID: 2841)
      • ls (PID: 2847)
      • ls (PID: 2835)
      • ls (PID: 2837)
      • ls (PID: 2833)
      • ls (PID: 2843)
      • ls (PID: 2845)
      • ls (PID: 2853)
      • ls (PID: 2859)
      • ls (PID: 2865)
      • ls (PID: 2863)
      • ls (PID: 2851)
      • ls (PID: 2849)
      • ls (PID: 2857)
      • ls (PID: 2855)
      • ls (PID: 2867)
      • ls (PID: 2879)
      • ls (PID: 2877)
      • ls (PID: 2861)
      • ls (PID: 2869)
      • ls (PID: 2871)
      • ls (PID: 2873)
      • ls (PID: 2875)
      • ls (PID: 2885)
      • ls (PID: 2891)
      • ls (PID: 2889)
      • ls (PID: 2893)
      • ls (PID: 2881)
      • ls (PID: 2883)
      • ls (PID: 2887)
      • ls (PID: 2903)
      • ls (PID: 2905)
      • ls (PID: 2901)
      • ls (PID: 2913)
      • ls (PID: 2895)
      • ls (PID: 2899)
      • ls (PID: 2897)
      • ls (PID: 2907)
      • ls (PID: 2919)
      • ls (PID: 2921)
      • ls (PID: 2923)
      • ls (PID: 2925)
      • ls (PID: 2909)
      • ls (PID: 2915)
      • ls (PID: 2911)
      • ls (PID: 2917)
      • ls (PID: 2937)
      • ls (PID: 2933)
      • ls (PID: 2943)
      • ls (PID: 2935)
      • ls (PID: 2939)
      • ls (PID: 2927)
      • ls (PID: 2929)
      • ls (PID: 2931)
      • ls (PID: 2951)
      • ls (PID: 2945)
      • ls (PID: 2955)
      • ls (PID: 2953)
      • ls (PID: 2957)
      • ls (PID: 2941)
      • ls (PID: 2949)
      • ls (PID: 2947)
      • ls (PID: 2965)
      • ls (PID: 2963)
      • ls (PID: 2967)
      • ls (PID: 2977)
      • ls (PID: 2975)
      • ls (PID: 2961)
      • ls (PID: 2959)
      • ls (PID: 2969)
      • ls (PID: 2979)
      • ls (PID: 2981)
      • ls (PID: 2985)
      • ls (PID: 2989)
      • ls (PID: 2991)
      • ls (PID: 2987)
      • ls (PID: 2971)
      • ls (PID: 2973)
      • ls (PID: 2983)
      • ls (PID: 3005)
      • ls (PID: 3007)
      • ls (PID: 3001)
      • ls (PID: 3009)
      • ls (PID: 3003)
      • ls (PID: 2999)
      • ls (PID: 2997)
      • ls (PID: 2993)
      • ls (PID: 2995)
      • ls (PID: 3015)
      • ls (PID: 3011)
      • ls (PID: 3021)
      • ls (PID: 3017)
      • ls (PID: 3019)
      • ls (PID: 3013)
      • ls (PID: 3031)
      • ls (PID: 3027)
      • ls (PID: 3039)
      • ls (PID: 3033)
      • ls (PID: 3035)
      • ls (PID: 3037)
      • ls (PID: 3025)
      • ls (PID: 3023)
      • ls (PID: 3029)
      • ls (PID: 3059)
      • ls (PID: 3045)
      • ls (PID: 3047)
      • ls (PID: 3043)
      • ls (PID: 3051)
      • ls (PID: 3053)
      • ls (PID: 3057)
      • ls (PID: 3049)
      • ls (PID: 3041)
      • ls (PID: 3065)
      • ls (PID: 3067)
      • ls (PID: 3069)
      • ls (PID: 3063)
      • ls (PID: 3071)
      • ls (PID: 3055)
      • ls (PID: 3061)
      • ls (PID: 3077)
      • ls (PID: 3085)
      • ls (PID: 3079)
      • ls (PID: 3083)
      • ls (PID: 3075)
      • ls (PID: 3073)
      • ls (PID: 3081)
      • ls (PID: 3095)
      • ls (PID: 3097)
      • ls (PID: 3099)
      • ls (PID: 3089)
      • ls (PID: 3087)
      • ls (PID: 3091)
      • ls (PID: 3093)
      • ls (PID: 3101)
      • ls (PID: 3109)
      • ls (PID: 3113)
      • ls (PID: 3105)
      • ls (PID: 3103)
      • ls (PID: 3107)
      • ls (PID: 3111)
      • ls (PID: 3115)
      • ls (PID: 3129)
      • ls (PID: 3125)
      • ls (PID: 3133)
      • ls (PID: 3131)
      • ls (PID: 3137)
      • ls (PID: 3121)
      • ls (PID: 3119)
      • ls (PID: 3117)
      • ls (PID: 3123)
      • ls (PID: 3127)
      • ls (PID: 3139)
      • ls (PID: 3151)
      • ls (PID: 3149)
      • ls (PID: 3143)
      • ls (PID: 3145)
      • ls (PID: 3147)
      • ls (PID: 3135)
      • ls (PID: 3141)
      • ls (PID: 3167)
      • ls (PID: 3161)
      • ls (PID: 3159)
      • ls (PID: 3157)
      • ls (PID: 3163)
      • ls (PID: 3153)
      • ls (PID: 3155)
      • ls (PID: 3211)
      • curl (PID: 3215)
      • curl (PID: 3216)
      • curl (PID: 3218)
      • curl (PID: 3217)
      • crontab (PID: 3203)
      • crontab (PID: 3202)
      • ps (PID: 3219)
      • curl (PID: 3250)
    • Executes the "rm" command to delete files or directories

      • dash (PID: 1904)
      • xargs (PID: 1976)
      • xargs (PID: 1992)
      • xargs (PID: 1984)
      • xargs (PID: 1968)
    • File locking via ext attributes

      • dash (PID: 1904)
    • Creates or rewrites file in the "bin" folder

      • dash (PID: 1904)
      • cp (PID: 3252)
      • cp (PID: 3257)
    • Gets information about currently running processes

      • dash (PID: 1904)
    • Modifies Cron jobs

      • sudo (PID: 1903)
      • dash (PID: 1904)
    • Modify startup scripts of the system services

      • dash (PID: 1904)
    • Uses curl to download content

      • dash (PID: 1904)
    • SSH authorized_keys modification

      • dash (PID: 1904)
    • Checks DMI information (probably VM detection)

      • javae (PID: 3224)
    • Create hidden file

      • dash (PID: 1904)
  • INFO

    • Checks timezone

      • python3.10 (PID: 1910)
      • ps (PID: 1930)
      • ps (PID: 1932)
      • ps (PID: 1953)
      • ps (PID: 1958)
      • ps (PID: 1971)
      • ps (PID: 1979)
      • ps (PID: 1987)
      • ps (PID: 1995)
      • ps (PID: 2000)
      • ps (PID: 1963)
      • ps (PID: 2020)
      • ps (PID: 2030)
      • ps (PID: 2025)
      • ps (PID: 2035)
      • ps (PID: 2040)
      • ps (PID: 2005)
      • ps (PID: 2010)
      • ps (PID: 2015)
      • ps (PID: 2152)
      • ps (PID: 2162)
      • ps (PID: 2167)
      • ps (PID: 2172)
      • ps (PID: 2178)
      • ps (PID: 2147)
      • ps (PID: 2157)
      • ps (PID: 2193)
      • ps (PID: 2198)
      • ps (PID: 2203)
      • ps (PID: 2208)
      • ps (PID: 2213)
      • ps (PID: 2223)
      • ps (PID: 2218)
      • ps (PID: 2183)
      • ps (PID: 2188)
      • ps (PID: 2233)
      • ps (PID: 2243)
      • ps (PID: 2248)
      • ps (PID: 2253)
      • ps (PID: 2258)
      • ps (PID: 2263)
      • ps (PID: 2228)
      • ps (PID: 2238)
      • ps (PID: 2268)
      • ps (PID: 2273)
      • ps (PID: 2286)
      • ps (PID: 2279)
      • ps (PID: 2291)
      • ps (PID: 2296)
      • ps (PID: 2301)
      • ps (PID: 2306)
      • ps (PID: 2311)
      • ps (PID: 2331)
      • ps (PID: 2336)
      • ps (PID: 2341)
      • ps (PID: 2346)
      • ps (PID: 2316)
      • ps (PID: 2321)
      • ps (PID: 2326)
      • ps (PID: 2351)
      • ps (PID: 2371)
      • ps (PID: 2376)
      • ps (PID: 2382)
      • ps (PID: 2387)
      • ps (PID: 2392)
      • ps (PID: 2398)
      • ps (PID: 2404)
      • ps (PID: 2356)
      • ps (PID: 2361)
      • ps (PID: 2366)
      • ps (PID: 2415)
      • ps (PID: 2410)
      • ps (PID: 2425)
      • ps (PID: 2430)
      • ps (PID: 2435)
      • ps (PID: 2440)
      • ps (PID: 2445)
      • ps (PID: 2420)
      • ps (PID: 2462)
      • ps (PID: 2474)
      • ps (PID: 2468)
      • ps (PID: 2480)
      • ps (PID: 2492)
      • ps (PID: 2486)
      • ps (PID: 2456)
      • ps (PID: 2450)
      • ps (PID: 2527)
      • ps (PID: 2515)
      • ps (PID: 2521)
      • ps (PID: 2533)
      • ps (PID: 2539)
      • ps (PID: 2545)
      • ps (PID: 2551)
      • ps (PID: 2498)
      • ps (PID: 2503)
      • ps (PID: 2509)
      • ps (PID: 2568)
      • ps (PID: 2563)
      • ps (PID: 2573)
      • ps (PID: 2578)
      • ps (PID: 2583)
      • ps (PID: 2588)
      • ps (PID: 2557)
      • ls (PID: 2727)
      • ls (PID: 2729)
      • ls (PID: 2731)
      • ls (PID: 2737)
      • ls (PID: 2733)
      • ls (PID: 2735)
      • ls (PID: 2743)
      • ls (PID: 2745)
      • ls (PID: 2749)
      • ls (PID: 2747)
      • ls (PID: 2751)
      • ls (PID: 2757)
      • ls (PID: 2739)
      • ls (PID: 2741)
      • ls (PID: 2759)
      • ls (PID: 2769)
      • ls (PID: 2765)
      • ls (PID: 2763)
      • ls (PID: 2767)
      • ls (PID: 2753)
      • ls (PID: 2755)
      • ls (PID: 2761)
      • ls (PID: 2781)
      • ls (PID: 2785)
      • ls (PID: 2779)
      • ls (PID: 2771)
      • ls (PID: 2773)
      • ls (PID: 2777)
      • ls (PID: 2775)
      • ls (PID: 2793)
      • ls (PID: 2801)
      • ls (PID: 2797)
      • ls (PID: 2783)
      • ls (PID: 2789)
      • ls (PID: 2787)
      • ls (PID: 2791)
      • ls (PID: 2807)
      • ls (PID: 2813)
      • ls (PID: 2815)
      • ls (PID: 2811)
      • ls (PID: 2819)
      • ls (PID: 2795)
      • ls (PID: 2799)
      • ls (PID: 2803)
      • ls (PID: 2805)
      • ls (PID: 2809)
      • ls (PID: 2821)
      • ls (PID: 2817)
      • ls (PID: 2823)
      • ls (PID: 2825)
      • ls (PID: 2827)
      • ls (PID: 2829)
      • ls (PID: 2831)
      • ls (PID: 2833)
      • ls (PID: 2837)
      • ls (PID: 2835)
      • ls (PID: 2847)
      • ls (PID: 2841)
      • ls (PID: 2849)
      • ls (PID: 2845)
      • ls (PID: 2851)
      • ls (PID: 2843)
      • ls (PID: 2839)
      • ls (PID: 2855)
      • ls (PID: 2857)
      • ls (PID: 2861)
      • ls (PID: 2865)
      • ls (PID: 2863)
      • ls (PID: 2853)
      • ls (PID: 2859)
      • ls (PID: 2867)
      • ls (PID: 2877)
      • ls (PID: 2871)
      • ls (PID: 2881)
      • ls (PID: 2873)
      • ls (PID: 2869)
      • ls (PID: 2875)
      • ls (PID: 2887)
      • ls (PID: 2889)
      • ls (PID: 2893)
      • ls (PID: 2897)
      • ls (PID: 2879)
      • ls (PID: 2883)
      • ls (PID: 2885)
      • ls (PID: 2891)
      • ls (PID: 2903)
      • ls (PID: 2907)
      • ls (PID: 2905)
      • ls (PID: 2911)
      • ls (PID: 2901)
      • ls (PID: 2909)
      • ls (PID: 2899)
      • ls (PID: 2895)
      • ls (PID: 2917)
      • ls (PID: 2919)
      • ls (PID: 2921)
      • ls (PID: 2925)
      • ls (PID: 2923)
      • ls (PID: 2915)
      • ls (PID: 2913)
      • ls (PID: 2933)
      • ls (PID: 2939)
      • ls (PID: 2927)
      • ls (PID: 2929)
      • ls (PID: 2931)
      • ls (PID: 2937)
      • ls (PID: 2935)
      • ls (PID: 2945)
      • ls (PID: 2951)
      • ls (PID: 2953)
      • ls (PID: 2943)
      • ls (PID: 2941)
      • ls (PID: 2949)
      • ls (PID: 2947)
      • ls (PID: 2955)
      • ls (PID: 2963)
      • ls (PID: 2967)
      • ls (PID: 2969)
      • ls (PID: 2965)
      • ls (PID: 2971)
      • ls (PID: 2977)
      • ls (PID: 2959)
      • ls (PID: 2961)
      • ls (PID: 2957)
      • ls (PID: 2973)
      • ls (PID: 2975)
      • ls (PID: 2979)
      • ls (PID: 2989)
      • ls (PID: 2985)
      • ls (PID: 2981)
      • ls (PID: 2983)
      • ls (PID: 2991)
      • ls (PID: 2987)
      • ls (PID: 2997)
      • ls (PID: 2999)
      • ls (PID: 3005)
      • ls (PID: 3003)
      • ls (PID: 2993)
      • ls (PID: 2995)
      • ls (PID: 3015)
      • ls (PID: 3019)
      • ls (PID: 3017)
      • ls (PID: 3021)
      • ls (PID: 3025)
      • ls (PID: 3007)
      • ls (PID: 3009)
      • ls (PID: 3001)
      • ls (PID: 3013)
      • ls (PID: 3011)
      • ls (PID: 3031)
      • ls (PID: 3029)
      • ls (PID: 3023)
      • ls (PID: 3033)
      • ls (PID: 3035)
      • ls (PID: 3027)
      • ls (PID: 3037)
      • ls (PID: 3047)
      • ls (PID: 3055)
      • ls (PID: 3039)
      • ls (PID: 3045)
      • ls (PID: 3041)
      • ls (PID: 3043)
      • ls (PID: 3049)
      • ls (PID: 3069)
      • ls (PID: 3065)
      • ls (PID: 3063)
      • ls (PID: 3059)
      • ls (PID: 3051)
      • ls (PID: 3053)
      • ls (PID: 3057)
      • ls (PID: 3067)
      • ls (PID: 3061)
      • ls (PID: 3071)
      • ls (PID: 3077)
      • ls (PID: 3081)
      • ls (PID: 3083)
      • ls (PID: 3079)
      • ls (PID: 3073)
      • ls (PID: 3075)
      • ls (PID: 3085)
      • ls (PID: 3091)
      • ls (PID: 3097)
      • ls (PID: 3101)
      • ls (PID: 3095)
      • ls (PID: 3087)
      • ls (PID: 3089)
      • ls (PID: 3099)
      • ls (PID: 3115)
      • ls (PID: 3107)
      • ls (PID: 3111)
      • ls (PID: 3113)
      • ls (PID: 3093)
      • ls (PID: 3105)
      • ls (PID: 3103)
      • ls (PID: 3109)
      • ls (PID: 3137)
      • ls (PID: 3125)
      • ls (PID: 3129)
      • ls (PID: 3123)
      • ls (PID: 3131)
      • ls (PID: 3133)
      • ls (PID: 3119)
      • ls (PID: 3121)
      • ls (PID: 3117)
      • ls (PID: 3127)
      • ls (PID: 3135)
      • ls (PID: 3143)
      • ls (PID: 3139)
      • ls (PID: 3145)
      • ls (PID: 3147)
      • ls (PID: 3149)
      • ls (PID: 3141)
      • ls (PID: 3163)
      • ls (PID: 3161)
      • ls (PID: 3151)
      • ls (PID: 3155)
      • ls (PID: 3153)
      • ls (PID: 3159)
      • ls (PID: 3157)
      • ls (PID: 3167)
      • ps (PID: 3219)
      • crontab (PID: 3203)
      • crontab (PID: 3202)
      • ls (PID: 3211)
    • Creates file in the temporary folder

      • dash (PID: 1904)
      • curl (PID: 3216)
      • curl (PID: 3218)
    • Get executable path from process ID

      • dash (PID: 2724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
1 483
Monitored processes
1 362
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs #COINMINER dash no specs locale-check no specs chmod no specs chattr no specs xtables-nft-multi no specs python3.10 no specs chattr no specs rm no specs rm no specs sync no specs cat no specs cat no specs mv no specs mv no specs mv no specs mv no specs mv no specs mv no specs mv no specs mv no specs mv no specs mv no specs mv no specs mv no specs mv no specs ps no specs grep no specs ps no specs grep no specs systemctl no specs basename no specs basename no specs dash no specs systemctl no specs sed no specs systemctl no specs dash no specs systemctl no specs getopt no specs perl no specs perl no specs basename no specs basename no specs dash no specs systemctl no specs systemctl no specs sed no specs systemctl no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs xargs no specs dirname no specs rm no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs xargs no specs dirname no specs rm no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs xargs no specs dirname no specs rm no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs xargs no specs dirname no specs rm no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs rm no specs sleep no specs dash no specs dash no specs chattr no specs chattr no specs chattr no specs chattr no specs chattr no specs chattr no specs chattr no specs chattr no specs chattr no specs chattr no specs chattr no specs chattr no specs sleep no specs rm no specs sysctl no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs mawk no specs mawk no specs grep no specs xargs no specs dash no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs kill no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs cut no specs xargs no specs ps no specs grep no specs grep no specs cut no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs ps no specs grep no specs grep no specs mawk no specs xargs no specs dash no specs grep no specs grep no specs mawk no specs sed no specs xargs no specs dash no specs grep no specs grep no specs mawk no specs sed no specs xargs no specs pgrep no specs xargs no specs pgrep no specs pgrep no specs #MRBOT rm no specs rm no specs rm no specs rm no specs chattr no specs systemctl no specs systemctl no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs chattr no specs chattr no specs rm no specs systemctl no specs basename no specs basename no specs dash no specs systemctl no specs sed no specs systemctl no specs systemctl no specs systemctl no specs basename no specs basename no specs dash no specs systemctl no specs sed no specs rm no specs chattr no specs chmod no specs rm no specs sleep no specs systemctl no specs chattr no specs chattr no specs sleep no specs chattr no specs chattr no specs dash no specs xargs no specs dash no specs xargs no specs systemctl no specs basename no specs basename no specs dash no specs systemctl no specs sed no specs systemctl no specs dash no specs getopt no specs perl no specs systemctl no specs perl no specs systemctl no specs basename no specs basename no specs dash no specs systemctl no specs sed no specs systemctl no specs chattr no specs chattr no specs chattr no specs crontab no specs rm no specs rm no specs rm no specs rm no specs ps no specs dash no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ls no specs grep no specs ps no specs mawk no specs dash no specs dash no specs dash no specs dash no specs grep no specs grep no specs mawk no specs dash no specs rm no specs pgrep no specs dash no specs dash no specs grep no specs grep no specs mawk no specs rm no specs killall no specs dash no specs ps no specs grep no specs grep no specs dash no specs ps no specs grep no specs grep no specs chattr no specs chattr no specs chattr no specs chattr no specs chattr no specs dash no specs crontab no specs crontab no specs chattr no specs chattr no specs chattr no specs chattr no specs chmod no specs chmod no specs dash no specs pgrep no specs ls no specs mawk no specs rm no specs curl curl curl curl ps no specs grep no specs grep no specs chmod no specs sleep no specs javae no specs javae no specs chmod no specs chattr no specs chmod no specs chattr no specs xtables-nft-multi no specs xtables-nft-multi no specs xtables-nft-multi no specs xtables-nft-multi no specs dash no specs basename no specs basename no specs systemctl no specs systemctl no specs chmod no specs chmod no specs apt no specs dpkg no specs apt-get no specs curl dpkg no specs bash no specs cp no specs cp no specs cp no specs cp no specs cp no specs cp no specs cp no specs cp no specs cp no specs cp no specs bash no specs sleep no specs seq no specs sort no specs head no specs

Process information

PID
CMD
Path
Indicators
Parent process
1899/bin/sh -c "sudo chown user /tmp/kworker\.sh && chmod +x /tmp/kworker\.sh && DISPLAY=:0 sudo -iu user /tmp/kworker\.sh "/usr/bin/dashClU101gqD6apx7CA
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1900sudo chown user /tmp/kworker.sh/usr/bin/sudodash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
1901chown user /tmp/kworker.sh/usr/bin/chownsudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1902chmod +x /tmp/kworker.sh/usr/bin/chmoddash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1903sudo -iu user /tmp/kworker.sh/usr/bin/sudodash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
1904/bin/sh /tmp/kworker.sh/usr/bin/dash
sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
1905/usr/bin/locale-check C.UTF-8/usr/bin/locale-checkdash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1906chmod 777 /usr/bin/chattr /bin/chattr/usr/bin/chmoddash
User:
user
Integrity Level:
UNKNOWN
Exit code:
256
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1907chattr -iua /tmp/ /var/tmp//usr/bin/chattrdash
User:
user
Integrity Level:
UNKNOWN
Exit code:
256
Modules
Images
/usr/lib/x86_64-linux-gnu/libe2p.so.2.3
/usr/lib/x86_64-linux-gnu/libcom_err.so.2.1
/usr/lib/x86_64-linux-gnu/libc.so.6
1908iptables -F/usr/sbin/xtables-nft-multidash
User:
user
Integrity Level:
UNKNOWN
Exit code:
1024
Modules
Images
/usr/lib/x86_64-linux-gnu/libmnl.so.0.2.0
/usr/lib/x86_64-linux-gnu/libnftnl.so.11.6.0
/usr/lib/x86_64-linux-gnu/libxtables.so.12.4.0
/usr/lib/x86_64-linux-gnu/libc.so.6
Executable files
0
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1904dash/tmp/kdevtmpfsitext
MD5:
SHA256:
3202crontab/var/spool/cron/crontabs/usertext
MD5:
SHA256:
1904dash/home/user/.ssh/authorized_keystext
MD5:
SHA256:
1904dash/tmp/javae (deleted)text
MD5:
SHA256:
1904dash/tmp/javaebinary
MD5:
SHA256:
1904dash/tmp/kworkertext
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
14
DNS requests
11
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
204
185.125.190.101:80
http://connectivity-check.ubuntu.com/
GB
whitelisted
3215
curl
HEAD
200
34.70.205.211:80
http://34.70.205.211/plugins-dist/safehtml/lang/font/javae
US
unknown
3216
curl
GET
34.70.205.211:80
http://34.70.205.211/plugins-dist/safehtml/lang/font/javae
US
unknown
3217
curl
HEAD
200
34.70.205.211:80
http://34.70.205.211/plugins-dist/safehtml/lang/font/kworker
US
unknown
3218
curl
GET
200
34.70.205.211:80
http://34.70.205.211/plugins-dist/safehtml/lang/font/kworker
US
text
35.4 Kb
unknown
3250
curl
GET
200
34.70.205.211:80
http://34.70.205.211/plugins-dist/safehtml/lang/font/cb.txt
US
text
4.32 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
459
avahi-daemon
224.0.0.251:5353
whitelisted
1
systemd
37.19.194.81:443
odrs.gnome.org
CDN77 _
GB
whitelisted
185.125.190.101:80
connectivity-check.ubuntu.com
CANONICAL-AS
GB
whitelisted
195.181.170.18:443
odrs.gnome.org
CDN77 _
GB
whitelisted
185.125.188.57:443
api.snapcraft.io
CANONICAL-AS
GB
whitelisted
1391
snap-store
195.181.175.40:443
odrs.gnome.org
CDN77 _
GB
whitelisted
485
snapd
185.125.188.57:443
api.snapcraft.io
CANONICAL-AS
GB
whitelisted
3215
curl
34.70.205.211:80
GOOGLE-CLOUD-PLATFORM
US
unknown
3216
curl
34.70.205.211:80
GOOGLE-CLOUD-PLATFORM
US
unknown
3217
curl
34.70.205.211:80
GOOGLE-CLOUD-PLATFORM
US
unknown

DNS requests

Domain
IP
Reputation
odrs.gnome.org
  • 37.19.194.81
  • 195.181.175.40
  • 212.102.56.178
  • 79.127.216.204
  • 195.181.170.18
  • 79.127.211.90
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c77a::47
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c77a::48
whitelisted
google.com
  • 142.251.110.113
  • 142.251.110.102
  • 142.251.110.139
  • 142.251.110.138
  • 142.251.110.101
  • 142.251.110.100
  • 2a00:1450:4001:c1f::66
  • 2a00:1450:4001:c1f::71
  • 2a00:1450:4001:c1f::8a
  • 2a00:1450:4001:c1f::64
whitelisted
connectivity-check.ubuntu.com
  • 185.125.190.101
  • 185.125.190.100
  • 91.189.91.98
  • 91.189.91.97
  • 91.189.91.96
  • 185.125.190.99
  • 2620:2d:4002:1::197
  • 2620:2d:4002:1::198
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::1101
  • 2620:2d:4000:1::1099
  • 2620:2d:4000:1::1100
whitelisted
api.snapcraft.io
  • 185.125.188.57
  • 185.125.188.54
  • 185.125.188.58
  • 185.125.188.59
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::3da
  • 2620:2d:4000:1010::2cc
whitelisted
11.100.168.192.in-addr.arpa
whitelisted

Threats

PID
Process
Class
Message
3215
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
3216
curl
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
3216
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
3217
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
3218
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
3250
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
No debug info