Malware analysis http://94.156.177.109/sh Malicious activity

Add for printing

URL:	http://94.156.177.109/sh
Full analysis:	https://app.any.run/tasks/b6c4555d-bd53-4297-b9b1-526fdfd30592
Verdict:	Malicious activity
Threats:	Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. Malware Trends Tracker >>>
Analysis date:	October 05, 2024, 09:31:27
OS:	Ubuntu 22.04.2
Tags:	miner scan telnet telnetscan ssh sshscan exploit
Indicators:
MD5:	00982C2FDECE29CB75B72AEE716E5D31
SHA1:	7861B57E830252F5704D16508C2F8C7F2E5D6B84
SHA256:	998FB2F6E83ECFEAFD6D97F84BE1621C74B3F925194DFF6429813BBD26927FA9
SSDEEP:	3:N1KxLdgScKK:CNN+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Connects to the CnC server
  - .redtail (PID: 14543)
- MINER has been detected (SURICATA)
  - .redtail (PID: 14543)
- EXPLOIT has been detected (SURICATA)
  - .redtail (PID: 14543)
- Attempting to connect via SSH
  - .redtail (PID: 14543)
- Attempting to scan the network
  - .redtail (PID: 14543)
- TELNETSCAN has been detected (SURICATA)
  - .redtail (PID: 14543)
SUSPICIOUS
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 14364)
  - sh (PID: 14465)
  - gnome-terminal-server (PID: 14425)
  - update-notifier (PID: 14393)
  - sudo (PID: 14464)
  - sudo (PID: 14389)
  - .redtail (PID: 14543)
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 14360)
  - .redtail (PID: 14542)
  - udevadm (PID: 14559)
- Reads /proc/mounts (likely used to find writable filesystems)
  - cat (PID: 14467)
  - check-new-release-gtk (PID: 14395)
  - .redtail (PID: 14542)
- Removes file immutable attribute
  - sh (PID: 14480)
- Executes the "rm" command to delete files or directories
  - sh (PID: 14465)
- Uses wget to download content
  - sh (PID: 14465)
- Modifies Cron jobs
  - sh (PID: 14545)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 14558)
  - modprobe (PID: 14560)
  - modprobe (PID: 14561)
- Crypto Currency Mining Activity Detected
  - .redtail (PID: 14543)
- Connects to unusual port
  - .redtail (PID: 14543)
- Potential Corporate Privacy Violation
  - .redtail (PID: 14543)
- Connects to SSH
  - .redtail (PID: 14543)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

440

Monitored processes

222

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
13906	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome http://94\.156\.177\.109/sh "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN
13907	sudo -iu user google-chrome http://94.156.177.109/sh	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN
13908	/usr/bin/google-chrome http://94.156.177.109/sh	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
13909	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13910	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13911	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13912	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
13913	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
13914	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
13915		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
13908	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		binary
		MD5:—	SHA256:—
13908	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		binary
		MD5:—	SHA256:—
13908	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		binary
		MD5:—	SHA256:—
13908	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:—	SHA256:—
13908	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:—	SHA256:—
13908	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:—	SHA256:—
13908	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_3		vxd
		MD5:—	SHA256:—
13908	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_2		vxd
		MD5:—	SHA256:—
13908	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_0		vxd
		MD5:—	SHA256:—
13908	chrome	/home/user/.config/google-chrome/Default/History		sqlite
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1 444

TCP/UDP connections

21 782

DNS requests

110

Threats

31 476

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad4hpytkvfw66zgvp6ccf22mfbbq_2024.10.4.0/niikhdgajlphfehepabhhblakbdgeefj_2024.10.04.00_all_adwqxuuranzmeclphki5yktwfkaa.crx3	unknown	—	—	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gcmjkmgdlgnkkcocmoeiminaijmmjnii/1.3651711652892acf34795b2c7e4d401ed2274c20e952f65cf52deeeef5bbf9b5/1.cd1978742a4afdbaaa15bf712d5c90bef4144caa99024df98f6a9ad58043ae85/f57d48f2458d0a8d34ccc2077ca88da0d44e809d2acd717f10ab827dae45743b	unknown	—	—	whitelisted
—	—	GET	200	94.156.177.109:80	http://94.156.177.109/sh	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pjnu5jyln4kujhcmwstuyyvyyu_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_linux_ace35m3jiw32bj5wzzow5nia7yta.crx3	unknown	—	—	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx	unknown	—	—	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aciueukdrxvb6khkx2mvifmvt57a_20240902.672363756.14/obedbbhbpmojnkanicioggnmelmoomoc_20240902.672363756.14_all_ENGB500000_pioxf2kb34f767sqbe3w4sspgi.crx3	unknown	—	—	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrrdxnjcwfqghe5ldbmjjkfukca_1088/efniojlnjndmcbiieegkicadnoecjjef_1088_all_goahc2youlbog7nygjjmilyci4.crx3	unknown	—	—	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/fy6gcuz7d35wpliekinea3enmi_468/lmelglejhemejginpboagddgdfbepgmp_468_all_ZZ_d4nfnzkgqvc2ngwyveswvfctoi.crx3	unknown	—	—	whitelisted
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/mzjb4qvvv5y7fyatjgzeyzkrd4_9180/hfnkpimlhhgieaddgfemjhofmfblmnib_9180_all_b2r3cgajcfdfqgjm25fmo65j6u.crx3	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	207.211.211.26:443	odrs.gnome.org	—	US	whitelisted
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
485	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	142.250.186.131:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
13908	chrome	239.255.255.250:1900	—	—	—	whitelisted

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	91.189.91.96 185.125.190.97 185.125.190.48 91.189.91.97 91.189.91.48 185.125.190.98 91.189.91.49 185.125.190.18 185.125.190.49 185.125.190.17 91.189.91.98 185.125.190.96 2001:67c:1562::24 2001:67c:1562::23 2620:2d:4002:1::198 2620:2d:4000:1::2b 2620:2d:4000:1::98 2620:2d:4002:1::197 2620:2d:4000:1::2a 2620:2d:4000:1::22 2620:2d:4000:1::97 2620:2d:4000:1::96 2620:2d:4002:1::196 2620:2d:4000:1::23	whitelisted
google.com	142.250.186.78 2a00:1450:4001:82b::200e	whitelisted
odrs.gnome.org	207.211.211.26 195.181.175.40 195.181.170.18 169.150.255.181 169.150.255.184 37.19.194.80 212.102.56.178 2a02:6ea0:c700::107 2a02:6ea0:c700::11 2a02:6ea0:c700::19 2a02:6ea0:c700::112 2a02:6ea0:c700::21 2a02:6ea0:c700::101 2a02:6ea0:c700::18	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.58 185.125.188.59 185.125.188.54 2620:2d:4000:1010::2e6 2620:2d:4000:1010::6d 2620:2d:4000:1010::42 2620:2d:4000:1010::117	whitelisted
clientservices.googleapis.com	142.250.186.131	whitelisted
safebrowsingohttpgateway.googleapis.com	142.250.185.106 172.217.23.106 142.250.186.138 216.58.212.170 172.217.18.10 216.58.212.138 142.250.74.202 142.250.186.170 172.217.16.202 142.250.186.74 142.250.186.106 216.58.206.42 142.250.186.42 142.250.185.74 142.250.185.138 216.58.206.74	whitelisted
google-ohttp-relay-safebrowsing.fastly-edge.com	151.101.65.91 151.101.193.91 151.101.1.91 151.101.129.91	unknown
accounts.google.com	64.233.166.84	whitelisted
update.googleapis.com	142.250.185.163	whitelisted
www.google.com	172.217.16.196	whitelisted

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	SUSPICIOUS [ANY.RUN] The user name associated in PS.Script has been detected
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
14543	.redtail	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 211
14543	.redtail	Potential Corporate Privacy Violation	ET POLICY Cryptocurrency Miner Checkin
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND
—	—	Attempted Information Leak	ET SCAN Potential SSH Scan OUTBOUND

2 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

http://94.156.177.109/sh

00982C2FDECE29CB75B72AEE716E5D31

7861B57E830252F5704D16508C2F8C7F2E5D6B84

998FB2F6E83ECFEAFD6D97F84BE1621C74B3F925194DFF6429813BBD26927FA9

3:N1KxLdgScKK:CNN+

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Connects to the CnC server

MINER has been detected (SURICATA)

EXPLOIT has been detected (SURICATA)

Attempting to connect via SSH

Attempting to scan the network

TELNETSCAN has been detected (SURICATA)

SUSPICIOUS

Executes commands using command-line interpreter

Checks DMI information (probably VM detection)

Reads /proc/mounts (likely used to find writable filesystems)

Removes file immutable attribute

Executes the "rm" command to delete files or directories

Uses wget to download content

Modifies Cron jobs

Manipulating modules (likely to execute programs on system boot)

Crypto Currency Mining Activity Detected

Connects to unusual port

Potential Corporate Privacy Violation

Connects to SSH

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings