Malware analysis x86_64 Malicious activity | ANY.RUN

Add for printing

File name:	x86_64
Full analysis:	https://app.any.run/tasks/507eb3dd-0979-4f1d-8cb5-77467eab5ba0
Verdict:	Malicious activity
Threats:	Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. Malware Trends Tracker >>>
Analysis date:	May 31, 2025, 17:54:35
OS:	Ubuntu 22.04.2
Tags:	auto miner coinminer
Indicators:
MIME:	application/x-sharedlib
File info:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), statically linked, no section header
MD5:	12044E97B0E5EAB66F16A55F24993DC2
SHA1:	0A5D94D0522F3446AE3E8C2B637D27AD23523CA9
SHA256:	B6EE8E08F1D4992CA85770E6883C1D2206EBBAF42F99D99ABA0E26278DE8BFFB
SSDEEP:	98304:BgjWCnN4qodGqXX10+X8iwfOe9KxeHXM0QSROaLjYQsfjbc29vZULyOcbtr6zjtG:/Hi2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MINER has been detected (SURICATA)
  - x86_64.elf (PID: 41063)
- Connects to the CnC server
  - x86_64.elf (PID: 41063)
SUSPICIOUS
- Reads passwd file
  - crontab (PID: 41066)
  - top (PID: 41156)
  - x86_64.elf (PID: 41063)
  - crontab (PID: 41068)
- Modifies Cron jobs
  - dash (PID: 41065)
- Potential Corporate Privacy Violation
  - x86_64.elf (PID: 41063)
- Connects to unusual port
  - x86_64.elf (PID: 41063)
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 41117)
  - sudo (PID: 41033)
- Gets information about currently running processes
  - bash (PID: 41135)
- Checks DMI information (probably VM detection)
  - udevadm (PID: 41080)
  - x86_64.elf (PID: 41060)
- Check the Environment Variables Related to System Identification (os-release)
  - snap (PID: 41144)
- Crypto Currency Mining Activity Detected
  - x86_64.elf (PID: 41063)
INFO
- Checks timezone
  - crontab (PID: 41068)
  - python3.10 (PID: 41111)
  - python3.10 (PID: 41143)
  - top (PID: 41156)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Shared object file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

176

Monitored processes

43

Malicious processes

3

Suspicious processes

2

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

41032

/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus /tmp/x86_64\.elf "

/usr/bin/dash

—

IntiFjKCklFyPMJr

User:

user

Integrity Level:

UNKNOWN

Exit code:

9

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41033

sudo -iu user nautilus /tmp/x86_64.elf

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

9

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

41034

nautilus /tmp/x86_64.elf

/usr/bin/nautilus

—

sudo

User:

user

Integrity Level:

UNKNOWN

Exit code:

9

Modules

Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libnautilus-extension.so.1.5.0
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgtk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libgdk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libpango-1.0.so.0.5000.6
/usr/lib/x86_64-linux-gnu/libatk-1.0.so.0.23609.1
/usr/lib/x86_64-linux-gnu/libcairo-gobject.so.2.11600.0
/usr/lib/x86_64-linux-gnu/libcairo.so.2.11600.0

41035

/usr/bin/locale-check C.UTF-8

/usr/bin/locale-check

—

nautilus

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41052

/lib/systemd/systemd-hostnamed

/usr/lib/systemd/systemd-hostnamed

—

systemd

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/systemd/libsystemd-shared-249.so
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libcrypt.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libip4tc.so.2.0.0
/usr/lib/x86_64-linux-gnu/libkmod.so.2.3.7
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3

41059

nautilus /tmp/x86_64.elf

/usr/bin/nautilus

—

nautilus

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

41060

/tmp/x86_64.elf

—

nautilus

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41063

/tmp/x86_64.elf

x86_64.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

41064

sh -c "command -v crontab >/dev/null 2>&1"

/usr/bin/dash

—

x86_64.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41065

sh -c "crontab -r >/dev/null 2>&1; echo \"@reboot /tmp/x86_64\.elf\" | crontab -"

/usr/bin/dash

—

x86_64.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

Add for printing

Executable files

0

Suspicious files

2

Text files

1

Unknown types

0

Dropped files

PID	Process	Filename		Type
41034	nautilus	/home/user/.local/share/nautilus/tags/meta.db		binary
		MD5:—	SHA256:—
41034	nautilus	/home/user/.local/share/nautilus/tags/meta.db-shm		binary
		MD5:—	SHA256:—
41068	crontab	/var/spool/cron/crontabs/user		text
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

15

DNS requests

11

Threats

4

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	91.189.91.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	169.150.255.184:443	odrs.gnome.org	—	GB	whitelisted
—	—	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.57:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
41063	x86_64.elf	95.215.19.53:853	—	ab stract	FI	unknown
41063	x86_64.elf	196.251.70.219:43782	—	—	GH	malicious

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.48 91.189.91.96 185.125.190.97 91.189.91.97 185.125.190.18 185.125.190.96 91.189.91.48 91.189.91.49 185.125.190.17 91.189.91.98 185.125.190.49 185.125.190.98 2001:67c:1562::24 2620:2d:4000:1::98 2620:2d:4002:1::196 2001:67c:1562::23 2620:2d:4000:1::97 2620:2d:4002:1::198 2620:2d:4000:1::22 2620:2d:4000:1::2a 2620:2d:4000:1::2b 2620:2d:4002:1::197 2620:2d:4000:1::23 2620:2d:4000:1::96	whitelisted
google.com	172.217.18.14 2a00:1450:4001:80b::200e	whitelisted
odrs.gnome.org	169.150.255.184 207.211.211.27 169.150.255.181 212.102.56.178 195.181.170.19 195.181.175.41 2a02:6ea0:c700::21 2a02:6ea0:c700::18 2a02:6ea0:c700::19 2a02:6ea0:c700::112 2a02:6ea0:c700::107 2a02:6ea0:c700::11	whitelisted
api.snapcraft.io	185.125.188.57 185.125.188.54 185.125.188.59 185.125.188.58 2620:2d:4000:1010::42 2620:2d:4000:1010::117 2620:2d:4000:1010::2e6 2620:2d:4000:1010::344	whitelisted
13.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
41063	x86_64.elf	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 43
41063	x86_64.elf	Crypto Currency Mining Activity Detected	MINER [ANY.RUN] CoinMiner Agent CnC Initial Connection
41063	x86_64.elf	Potential Corporate Privacy Violation	ET INFO Cryptocurrency Miner Checkin
41063	x86_64.elf	Potential Corporate Privacy Violation	ET INFO Cryptocurrency Miner Checkin

Add for printing

No debug info

General Info

x86_64

12044E97B0E5EAB66F16A55F24993DC2

0A5D94D0522F3446AE3E8C2B637D27AD23523CA9

B6EE8E08F1D4992CA85770E6883C1D2206EBBAF42F99D99ABA0E26278DE8BFFB

98304:BgjWCnN4qodGqXX10+X8iwfOe9KxeHXM0QSROaLjYQsfjbc29vZULyOcbtr6zjtG:/Hi2

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MINER has been detected (SURICATA)

Connects to the CnC server

SUSPICIOUS

Reads passwd file

Modifies Cron jobs

Potential Corporate Privacy Violation

Connects to unusual port

Executes commands using command-line interpreter

Gets information about currently running processes

Checks DMI information (probably VM detection)

Check the Environment Variables Related to System Identification (os-release)

Crypto Currency Mining Activity Detected

INFO

Checks timezone

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Information

Modules

Information

Modules

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings