Malware analysis neon.x86_64 Malicious activity | ANY.RUN

Add for printing

File name:	neon.x86_64
Full analysis:	https://app.any.run/tasks/81449d9e-9b42-42fc-8246-29935324b3e3
Verdict:	Malicious activity
Analysis date:	May 10, 2025, 05:17:58
OS:	Ubuntu 22.04.2
Indicators:
MIME:	application/x-executable
File info:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
MD5:	C2EE66D72383D4C2638F87E52679DC94
SHA1:	32A1D39891E180B29A863929F76777A4F708B3A1
SHA256:	991D61F5C4BC7C78B19F6A727B7007080F8A1098A41B76AD68AF33104C190C6D
SSDEEP:	1536:r8YT+yYCtPrtUx4bRyRSPXiO1VJBwUaoB:r8YTjYCtPrtUx4dFXiO7JBwUaoB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - neon.x86_64.elf (PID: 39517)
  - neon.x86_64.elf (PID: 39500)
SUSPICIOUS
- Reads passwd file
  - neon.x86_64.elf (PID: 39495)
- Executes commands using command-line interpreter
  - sudo (PID: 39493)
- Modifies file or directory owner
  - sudo (PID: 39490)
- Reads profile file
  - neon.x86_64.elf (PID: 39495)
- Connects to unusual port
  - neon.x86_64.elf (PID: 39500)
  - neon.x86_64.elf (PID: 39517)
- Contacting a server suspected of hosting an CnC
  - neon.x86_64.elf (PID: 39517)
  - neon.x86_64.elf (PID: 39500)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

235

Monitored processes

17

Malicious processes

5

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
39489	/bin/sh -c "sudo chown user /tmp/neon\.x86_64\.elf && chmod +x /tmp/neon\.x86_64\.elf && DISPLAY=:0 sudo -iu user /tmp/neon\.x86_64\.elf "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
39490	sudo chown user /tmp/neon.x86_64.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39491	chown user /tmp/neon.x86_64.elf	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
39492	chmod +x /tmp/neon.x86_64.elf	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39493	sudo -iu user /tmp/neon.x86_64.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39494	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
39495	/tmp/neon.x86_64.elf	/tmp/neon.x86_64.elf	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
39496	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	neon.x86_64.elf
User: user Integrity Level: UNKNOWN Exit code: 0
39497	/tmp/neon.x86_64.elf	/tmp/neon.x86_64.elf	—	neon.x86_64.elf
User: user Integrity Level: UNKNOWN Exit code: 0
39498	/tmp/neon.x86_64.elf	/tmp/neon.x86_64.elf	—	neon.x86_64.elf
User: user Integrity Level: UNKNOWN

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

11

DNS requests

13

Threats

12

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.96:80	—	Canonical Group Limited	US	unknown
—	—	185.125.190.17:80	—	Canonical Group Limited	GB	unknown
—	—	169.150.255.183:443	odrs.gnome.org	—	GB	whitelisted
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.57:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
39500	neon.x86_64.elf	103.252.137.107:12121	traxanhc2.duckdns.org	—	—	malicious
39517	neon.x86_64.elf	103.252.137.107:12121	traxanhc2.duckdns.org	—	—	malicious

DNS requests

Domain	IP	Reputation
odrs.gnome.org	169.150.255.183 195.181.175.40 195.181.170.18 212.102.56.179 37.19.194.81 207.211.211.27 169.150.255.180 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::18 2a02:6ea0:c700::19 2a02:6ea0:c700::11 2a02:6ea0:c700::107 2a02:6ea0:c700::101	whitelisted
google.com	172.217.16.142 2a00:1450:4001:808::200e	whitelisted
api.snapcraft.io	185.125.188.59 185.125.188.54 185.125.188.58 185.125.188.57 2620:2d:4000:1010::344 2620:2d:4000:1010::2e6 2620:2d:4000:1010::117 2620:2d:4000:1010::42	whitelisted
traxanhc2.duckdns.org	103.252.137.107	unknown
12.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4000:1::22 2620:2d:4002:1::198 2620:2d:4000:1::23 2620:2d:4002:1::196 2620:2d:4000:1::96 2001:67c:1562::24 2620:2d:4000:1::97 2620:2d:4000:1::98 2620:2d:4000:1::2b 2620:2d:4000:1::2a 2001:67c:1562::23	whitelisted

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
—	—	Misc activity	ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
—	—	Misc activity	ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
—	—	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
—	—	Misc activity	ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
—	—	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
—	—	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
—	—	Misc activity	ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)

Add for printing

No debug info

General Info

neon.x86_64

C2EE66D72383D4C2638F87E52679DC94

32A1D39891E180B29A863929F76777A4F708B3A1

991D61F5C4BC7C78B19F6A727B7007080F8A1098A41B76AD68AF33104C190C6D

1536:r8YT+yYCtPrtUx4bRyRSPXiO1VJBwUaoB:r8YTjYCtPrtUx4dFXiO7JBwUaoB

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

SUSPICIOUS

Reads passwd file

Executes commands using command-line interpreter

Modifies file or directory owner

Reads profile file

Connects to unusual port

Contacting a server suspected of hosting an CnC

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings