Analysis date (UTC): 10 April 2024, 08:03Analysis environment: Ubuntu 22.04.2

skid.x86

MD5:8E8A7759E596EFB31DA60C5CF5239520
SHA1:0058625CEBBCEA271C5E8A12A7E96910FC4D9FAF
SHA256:A939592B7C4B82EB07BF7AD619A3CE9606EBC119D3D7091B193B1A625684D77B

Analysis result

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Executes commands using command-line interpreter

  • sudo (PID: 9270)
  • gnome-terminal-server (PID: 9310)

Modifies file or directory owner

  • sudo (PID: 9267)

Reads network configuration

  • dvrHelper (PID: 9273)

Checks DMI information (probably VM detection)

  • systemd-hostnamed (PID: 9296)

Gets active TCP connections

  • dvrHelper (PID: 9273)

INFO

No info indicators.

Threats

PIDProcessClassMessage
——Potentially Bad TrafficET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.pirate)
——Malware Command and Control Activity DetectedBOTNET [ANY.RUN] Mirai.Gen Check-In (Linux DDoS)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN