Malware analysis i-5.8-6.Sakura Malicious activity | ANY.RUN

Add for printing

File name:	i-5.8-6.Sakura
Full analysis:	https://app.any.run/tasks/10d92d31-8bc1-420e-a5f0-59c9bbdcf0fd
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Malware Trends Tracker >>>
Analysis date:	June 30, 2025, 11:00:12
OS:	Ubuntu 22.04.2
Tags:	sakura botnet
Indicators:
MIME:	application/x-executable
File info:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, with debug_info, not stripped
MD5:	B7A36019198052954F4B61AE0654C7E6
SHA1:	55C44B428645ED03D71E8FFA37AA8C4DD8D6BCBE
SHA256:	96A7163C60755067B6E12A68C325F6EB09FB75E2745BBE1DBC72D1CDB66E25A2
SSDEEP:	12288:Xv0Qgpcc2rSYun3n3lga+55wGtwuV14PSeZjgKGSNnMawCq79g0DY:Xv0Qgpc6Yun3nVga+55wGtwxSeZjgKGW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- SAKURA has been detected
  - sysctl (PID: 41415)
- Application was dropped or rewritten from another process
  - i-5.8-6.Sakura.elf (PID: 41418)
  - i-5.8-6.Sakura.elf (PID: 41414)
  - i-5.8-6.Sakura.elf (PID: 41397)
  - i-5.8-6.Sakura.elf (PID: 41412)
  - i-5.8-6.Sakura.elf (PID: 41404)
  - i-5.8-6.Sakura.elf (PID: 41407)
  - i-5.8-6.Sakura.elf (PID: 41424)
  - i-5.8-6.Sakura.elf (PID: 41422)
  - i-5.8-6.Sakura.elf (PID: 41428)
  - i-5.8-6.Sakura.elf (PID: 41399)
  - i-5.8-6.Sakura.elf (PID: 41410)
  - i-5.8-6.Sakura.elf (PID: 41432)
  - i-5.8-6.Sakura.elf (PID: 41430)
  - i-5.8-6.Sakura.elf (PID: 41401)
  - i-5.8-6.Sakura.elf (PID: 41416)
  - i-5.8-6.Sakura.elf (PID: 41420)
  - i-5.8-6.Sakura.elf (PID: 41426)
  - i-5.8-6.Sakura.elf (PID: 41406)
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 41393)
- Executes commands using command-line interpreter
  - sudo (PID: 41396)
- Reads passwd file
  - crontab (PID: 41405)
  - crontab (PID: 41402)
- Modifies Cron jobs
  - i-5.8-6.Sakura.elf (PID: 41404)
- Creates shell script file
  - tee (PID: 41409)
- Gets information about currently running processes
  - i-5.8-6.Sakura.elf (PID: 41418)
  - i-5.8-6.Sakura.elf (PID: 41422)
  - i-5.8-6.Sakura.elf (PID: 41426)
  - i-5.8-6.Sakura.elf (PID: 41430)
- Connects to unusual port
  - i-5.8-6.Sakura.elf (PID: 41440)
INFO
- Creates file in the temporary folder
  - grep (PID: 41403)
  - i-5.8-6.Sakura.elf (PID: 41414)
  - sysctl (PID: 41415)
- Checks timezone
  - crontab (PID: 41402)
  - crontab (PID: 41405)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture:	32 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	i386

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

183

Monitored processes

50

Malicious processes

3

Suspicious processes

3

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

445

/lib/systemd/systemd-resolved

/usr/lib/systemd/systemd-resolved

systemd

User:

systemd-resolve

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/systemd/systemd-resolved
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libgmp.so.10.4.1
/usr/lib/x86_64-linux-gnu/libhogweed.so.6.4
/usr/lib/x86_64-linux-gnu/libnettle.so.8.4
/usr/lib/x86_64-linux-gnu/libtasn1.so.6.6.2
/usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0
/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.7

41392

/bin/sh -c "sudo chown user /tmp/i-5\.8-6\.Sakura\.elf && chmod +x /tmp/i-5\.8-6\.Sakura\.elf && DISPLAY=:0 sudo -iu user /tmp/i-5\.8-6\.Sakura\.elf "

/usr/bin/dash

—

UbvyYXL4x2mYa65Q

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41393

sudo chown user /tmp/i-5.8-6.Sakura.elf

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

41394

chown user /tmp/i-5.8-6.Sakura.elf

/usr/bin/chown

—

sudo

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41395

chmod +x /tmp/i-5.8-6.Sakura.elf

/usr/bin/chmod

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41396

sudo -iu user /tmp/i-5.8-6.Sakura.elf

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

41397

/tmp/i-5.8-6.Sakura.elf

—

sudo

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6

41398

/usr/bin/locale-check C.UTF-8

/usr/bin/locale-check

—

i-5.8-6.Sakura.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41399

/tmp/i-5.8-6.Sakura.elf

—

i-5.8-6.Sakura.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

256

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41400

chattr +i /tmp/.cacheCeToA6Sq

/usr/bin/chattr

—

i-5.8-6.Sakura.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

256

Modules

Images
/usr/lib/x86_64-linux-gnu/libe2p.so.2.3
/usr/lib/x86_64-linux-gnu/libcom_err.so.2.1
/usr/lib/x86_64-linux-gnu/libc.so.6

Add for printing

Executable files

0

Suspicious files

0

Text files

12

Unknown types

1

Dropped files

PID	Process	Filename		Type
41397	i-5.8-6.Sakura.elf	/home/user/.config/autostart/CeToA6Sq.desktop		text
		MD5:—	SHA256:—
41397	i-5.8-6.Sakura.elf	/home/user/.ssh/rc		text
		MD5:—	SHA256:—
41403	grep	/tmp/CeToA6Sq.cron (deleted)		text
		MD5:—	SHA256:—
41397	i-5.8-6.Sakura.elf	/home/user/.profile		text
		MD5:—	SHA256:—
41397	i-5.8-6.Sakura.elf	/tmp/CeToA6Sq.cron (deleted)		text
		MD5:—	SHA256:—
41397	i-5.8-6.Sakura.elf	/tmp/.cacheCeToA6Sq		o
		MD5:—	SHA256:—
41397	i-5.8-6.Sakura.elf	/home/user/.bashrc		text
		MD5:—	SHA256:—
41405	crontab	/var/spool/cron/crontabs/user		text
		MD5:—	SHA256:—
41397	i-5.8-6.Sakura.elf	/home/user/.bash_profile		text
		MD5:—	SHA256:—
41397	i-5.8-6.Sakura.elf	/home/user/.kshrc		text
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

14

DNS requests

13

Threats

2

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	91.189.91.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	195.181.175.41:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.57:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
41440	i-5.8-6.Sakura.elf	38.34.15.2:21451	btorgbds.duckdns.org	COGENT-174	US	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2620:2d:4000:1::23 2620:2d:4002:1::197 2620:2d:4000:1::2b 2620:2d:4000:1::22 2620:2d:4000:1::97 2620:2d:4000:1::98 2620:2d:4002:1::196 2001:67c:1562::24 2620:2d:4002:1::198 2001:67c:1562::23 2620:2d:4000:1::2a 2620:2d:4000:1::96 91.189.91.49 185.125.190.18 91.189.91.96 185.125.190.49 185.125.190.96 185.125.190.48 185.125.190.98 91.189.91.48 185.125.190.17 185.125.190.97 91.189.91.97 91.189.91.98	whitelisted
google.com	142.250.186.142 2a00:1450:4001:81d::200e	whitelisted
odrs.gnome.org	195.181.175.41 195.181.170.18 207.211.211.27 37.19.194.81 169.150.255.183 212.102.56.179 169.150.255.181 2a02:6ea0:c700::21 2a02:6ea0:c700::18 2a02:6ea0:c700::101 2a02:6ea0:c700::19 2a02:6ea0:c700::112 2a02:6ea0:c700::11 2a02:6ea0:c700::107	whitelisted
api.snapcraft.io	185.125.188.54 185.125.188.57 185.125.188.59 185.125.188.58 2620:2d:4000:1010::2e6 2620:2d:4000:1010::117 2620:2d:4000:1010::42 2620:2d:4000:1010::344	whitelisted
13.100.168.192.in-addr.arpa	—	unknown
btorgbds.duckdns.org	38.34.15.2	unknown

Threats

PID	Process	Class	Message
445	systemd-resolved	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
445	systemd-resolved	Misc activity	ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain

Add for printing

No debug info

General Info

i-5.8-6.Sakura

B7A36019198052954F4B61AE0654C7E6

55C44B428645ED03D71E8FFA37AA8C4DD8D6BCBE

96A7163C60755067B6E12A68C325F6EB09FB75E2745BBE1DBC72D1CDB66E25A2

12288:Xv0Qgpcc2rSYun3n3lga+55wGtwuV14PSeZjgKGSNnMawCq79g0DY:Xv0Qgpc6Yun3nVga+55wGtwxSeZjgKGW

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SAKURA has been detected

Application was dropped or rewritten from another process

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Reads passwd file

Modifies Cron jobs

Creates shell script file

Gets information about currently running processes

Connects to unusual port

INFO

Creates file in the temporary folder

Checks timezone

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings