Malware analysis http://94.156.177.109/sh Malicious activity

Add for printing

URL:	http://94.156.177.109/sh
Full analysis:	https://app.any.run/tasks/b6c4555d-bd53-4297-b9b1-526fdfd30592
Verdict:	Malicious activity
Threats:	Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. Malware Trends Tracker >>>
Analysis date:	October 05, 2024, 09:31:27
OS:	Ubuntu 22.04.2
Tags:	miner scan telnet telnetscan ssh sshscan exploit
Indicators:
MD5:	00982C2FDECE29CB75B72AEE716E5D31
SHA1:	7861B57E830252F5704D16508C2F8C7F2E5D6B84
SHA256:	998FB2F6E83ECFEAFD6D97F84BE1621C74B3F925194DFF6429813BBD26927FA9
SSDEEP:	3:N1KxLdgScKK:CNN+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Connects to the CnC server
  - .redtail (PID: 14543)
- MINER has been detected (SURICATA)
  - .redtail (PID: 14543)
- EXPLOIT has been detected (SURICATA)
  - .redtail (PID: 14543)
- Attempting to scan the network
  - .redtail (PID: 14543)
- Attempting to connect via SSH
  - .redtail (PID: 14543)
- TELNETSCAN has been detected (SURICATA)
  - .redtail (PID: 14543)
SUSPICIOUS
- Executes commands using command-line interpreter
  - sudo (PID: 14389)
  - gnome-terminal-server (PID: 14425)
  - gnome-terminal-server (PID: 14364)
  - sh (PID: 14465)
  - sudo (PID: 14464)
  - update-notifier (PID: 14393)
  - .redtail (PID: 14543)
- Removes file immutable attribute
  - sh (PID: 14480)
- Reads /proc/mounts (likely used to find writable filesystems)
  - .redtail (PID: 14542)
  - check-new-release-gtk (PID: 14395)
  - cat (PID: 14467)
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 14360)
  - udevadm (PID: 14559)
  - .redtail (PID: 14542)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 14561)
  - modprobe (PID: 14560)
  - modprobe (PID: 14558)
- Uses wget to download content
  - sh (PID: 14465)
- Executes the "rm" command to delete files or directories
  - sh (PID: 14465)
- Modifies Cron jobs
  - sh (PID: 14545)
- Connects to unusual port
  - .redtail (PID: 14543)
- Crypto Currency Mining Activity Detected
  - .redtail (PID: 14543)
- Potential Corporate Privacy Violation
  - .redtail (PID: 14543)
- Connects to SSH
  - .redtail (PID: 14543)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

440

Monitored processes

222

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
13906	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome http://94\.156\.177\.109/sh "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN
13907	sudo -iu user google-chrome http://94.156.177.109/sh	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN
13908	/usr/bin/google-chrome http://94.156.177.109/sh	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
13909	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13910	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13911	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13912	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13913	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
13914	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
13915		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
13908	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:0962291D6D367570BEE5454721C17E11	SHA256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
13908	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:CF89D16BB9107C631DAABF0C0EE58EFB	SHA256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
13908	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:CF89D16BB9107C631DAABF0C0EE58EFB	SHA256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
13908	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:41876349CB12D6DB992F1309F22DF3F0	SHA256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
13908	chrome	/home/user/.config/google-chrome/Default/DawnCache/index		binary
		MD5:4084CB9F2E9764D1E26930C8C6DC4597	SHA256:681FECBB0545C2CB01D4F7BF0A836ED4E405B2FDA6C77A95AA88A51D952E2FD1
13908	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:0962291D6D367570BEE5454721C17E11	SHA256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
13908	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_1		binary
		MD5:DE2B31E318B6881CAB2BFF9201596D2C	SHA256:691B19B82711DED4FF21DFB56E8C7FC6390F566ED3C6F5DA57995A0DAC3D2FBD
13908	chrome	/home/user/.config/google-chrome/ShaderCache/index		binary
		MD5:6B713B3E364EB6CA90416027E4179CE2	SHA256:E934E9E1C18C5872E4F4CE7921E2110FCC4F8907EC68647726DBCE96F90A3FED
13908	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:41876349CB12D6DB992F1309F22DF3F0	SHA256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
13908	chrome	/home/user/.config/google-chrome/WidevineCdm/latest-component-updated-widevine-cdm		binary
		MD5:95C0DCBFAD51AD12194F90A703971AB3	SHA256:96621E3B24DA1E66B9F4C21CA9F3A87BF25BAD8C6A7A24345C372C666E1ED9DF

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1 444

TCP/UDP connections

21 782

DNS requests

110

Threats

31 476

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrrdxnjcwfqghe5ldbmjjkfukca_1088/efniojlnjndmcbiieegkicadnoecjjef_1088_all_goahc2youlbog7nygjjmilyci4.crx3	US	binary	152 Kb	whitelisted
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	US	—	—	whitelisted
—	—	GET	200	94.156.177.109:80	http://94.156.177.109/sh	BG	text	1.56 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx	US	binary	3.07 Kb	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pjnu5jyln4kujhcmwstuyyvyyu_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_linux_ace35m3jiw32bj5wzzow5nia7yta.crx3	US	binary	13.5 Mb	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad4hpytkvfw66zgvp6ccf22mfbbq_2024.10.4.0/niikhdgajlphfehepabhhblakbdgeefj_2024.10.04.00_all_adwqxuuranzmeclphki5yktwfkaa.crx3	US	binary	6.56 Kb	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gcmjkmgdlgnkkcocmoeiminaijmmjnii/1.3651711652892acf34795b2c7e4d401ed2274c20e952f65cf52deeeef5bbf9b5/1.cd1978742a4afdbaaa15bf712d5c90bef4144caa99024df98f6a9ad58043ae85/f57d48f2458d0a8d34ccc2077ca88da0d44e809d2acd717f10ab827dae45743b	US	binary	30.2 Kb	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/fy6gcuz7d35wpliekinea3enmi_468/lmelglejhemejginpboagddgdfbepgmp_468_all_ZZ_d4nfnzkgqvc2ngwyveswvfctoi.crx3	US	binary	53.9 Kb	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adn3tbb2pd3we3bgvlhz7kbeqlca_2024.9.30.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.09.30.01_all_acosqho7p2tdp4gkqv4e3ge37qna.crx3	US	binary	8.74 Kb	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/oz5aexgbrlit2xnkrybso6ixgm_3043/jflookgnkcckhobaglndicnbbgbonegd_3043_all_lgpichw6h2f4s36o2b7xualnjq.crx3	US	binary	75.3 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	207.211.211.26:443	odrs.gnome.org	—	US	whitelisted
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	142.250.186.131:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
13908	chrome	239.255.255.250:1900	—	—	—	whitelisted

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	91.189.91.96 185.125.190.97 185.125.190.48 91.189.91.97 91.189.91.48 185.125.190.98 91.189.91.49 185.125.190.18 185.125.190.49 185.125.190.17 91.189.91.98 185.125.190.96 2001:67c:1562::24 2001:67c:1562::23 2620:2d:4002:1::198 2620:2d:4000:1::2b 2620:2d:4000:1::98 2620:2d:4002:1::197 2620:2d:4000:1::2a 2620:2d:4000:1::22 2620:2d:4000:1::97 2620:2d:4000:1::96 2620:2d:4002:1::196 2620:2d:4000:1::23	whitelisted
google.com	142.250.186.78 2a00:1450:4001:82b::200e	whitelisted
odrs.gnome.org	207.211.211.26 195.181.175.40 195.181.170.18 169.150.255.181 169.150.255.184 37.19.194.80 212.102.56.178 2a02:6ea0:c700::107 2a02:6ea0:c700::11 2a02:6ea0:c700::19 2a02:6ea0:c700::112 2a02:6ea0:c700::21 2a02:6ea0:c700::101 2a02:6ea0:c700::18	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.58 185.125.188.59 185.125.188.54 2620:2d:4000:1010::2e6 2620:2d:4000:1010::6d 2620:2d:4000:1010::42 2620:2d:4000:1010::117	whitelisted
clientservices.googleapis.com	142.250.186.131	whitelisted
safebrowsingohttpgateway.googleapis.com	142.250.185.106 172.217.23.106 142.250.186.138 216.58.212.170 172.217.18.10 216.58.212.138 142.250.74.202 142.250.186.170 172.217.16.202 142.250.186.74 142.250.186.106 216.58.206.42 142.250.186.42 142.250.185.74 142.250.185.138 216.58.206.74	whitelisted
google-ohttp-relay-safebrowsing.fastly-edge.com	151.101.65.91 151.101.193.91 151.101.1.91 151.101.129.91	unknown
accounts.google.com	64.233.166.84	whitelisted
update.googleapis.com	142.250.185.163	whitelisted
www.google.com	172.217.16.196	whitelisted

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	SUSPICIOUS [ANY.RUN] The user name associated in PS.Script has been detected
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
14543	.redtail	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 211
14543	.redtail	Potential Corporate Privacy Violation	ET POLICY Cryptocurrency Miner Checkin
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND

2 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

http://94.156.177.109/sh

00982C2FDECE29CB75B72AEE716E5D31

7861B57E830252F5704D16508C2F8C7F2E5D6B84

998FB2F6E83ECFEAFD6D97F84BE1621C74B3F925194DFF6429813BBD26927FA9

3:N1KxLdgScKK:CNN+

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Connects to the CnC server

MINER has been detected (SURICATA)

EXPLOIT has been detected (SURICATA)

Attempting to scan the network

Attempting to connect via SSH

TELNETSCAN has been detected (SURICATA)

SUSPICIOUS

Executes commands using command-line interpreter

Removes file immutable attribute

Reads /proc/mounts (likely used to find writable filesystems)

Checks DMI information (probably VM detection)

Manipulating modules (likely to execute programs on system boot)

Uses wget to download content

Executes the "rm" command to delete files or directories

Modifies Cron jobs

Connects to unusual port

Crypto Currency Mining Activity Detected

Potential Corporate Privacy Violation

Connects to SSH

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings