Malware analysis /qa.sh Malicious activity | ANY.RUN

Add for printing

download:	/qa.sh
Full analysis:	https://app.any.run/tasks/74bae64e-6975-4b01-b7a6-d14443c94fb8
Verdict:	Malicious activity
Threats:	Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. Malware Trends Tracker >>>
Analysis date:	April 13, 2024, 16:56:37
OS:	Ubuntu 22.04.2
Tags:	miner
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable
MD5:	2CA0F44CBD4917C78E306FE54621D2EB
SHA1:	0741DFF260F83CDBA4F90469EE2D72568F8389A7
SHA256:	BE4F1A4E06CF61BCA3D26CA75E209F89985E20D7178A3C5CD2C47B63907A759C
SSDEEP:	12:+VTltK00HiokOyUdcPUlUpUF+vPUukS9B2g/ZO:Sn9nO3Ovr9zA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Reads /proc/mounts (likely used to find writable filesystems)
  - .redtail (PID: 9285)
- Checks list of the CPUs
  - .redtail (PID: 9285)
- Uses wget to download content
  - qa.sh (PID: 9274)
- Executes the "rm" command to delete files or directories
  - qa.sh (PID: 9274)
- Checks active cgroups controllers (like CPU time, system memory, network bandwidth)
  - .redtail (PID: 9285)
- Checks the online status of NUMA nodes
  - .redtail (PID: 9285)
- Checks DMI information (probably VM detection)
  - .redtail (PID: 9285)
  - udevadm (PID: 9296)
- Modifies Cron jobs
  - sh (PID: 9289)
- Executes commands using command-line interpreter
  - .redtail (PID: 9286)
- Modifies file or directory owner
  - sudo (PID: 9269)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 9295)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

255

Monitored processes

35

Malicious processes

0

Suspicious processes

2

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9268	/bin/sh -c "sudo chown user \"/home/user/Downloads/qa\.sh\" && chmod +x \"/home/user/Downloads/qa\.sh\" && DISPLAY=:0 sudo -iu user \"/home/user/Downloads/qa\.sh\" "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 496
9269	sudo chown user /home/user/Downloads/qa.sh	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 0
9270	chown user /home/user/Downloads/qa.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
9271	chmod +x /home/user/Downloads/qa.sh	/usr/bin/chmod	—	sh
User: user Integrity Level: UNKNOWN Exit code: 0
9272	sudo -iu user /home/user/Downloads/qa.sh	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 496
9274	/bin/bash /home/user/Downloads/qa.sh	/home/user/Downloads/qa.sh	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 496
9275	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	qa.sh
User: user Integrity Level: UNKNOWN Exit code: 0
9276	touch .testfile	/usr/bin/touch	—	qa.sh
User: user Integrity Level: UNKNOWN Exit code: 0
9277	rm -rf .testfile	/usr/bin/rm	—	qa.sh
User: user Integrity Level: UNKNOWN Exit code: 0
9278	uname -mp	/usr/bin/uname	—	qa.sh
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9276	touch	/var/tmp/.testfile		—
		MD5:—	SHA256:—
9281	wget	/var/tmp/.1		—
		MD5:—	SHA256:—
9283	cat	/var/tmp/.redtail		—
		MD5:—	SHA256:—
9292	crontab	/var/spool/cron/crontabs/tmp.9ekf43		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

2

TCP/UDP connections

8

DNS requests

13

Threats

7

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	200	193.222.96.163:80	http://193.222.96.163/.1	unknown	binary	1.83 Mb	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	193.222.96.163:80	srv.identitynetwork.top	Amirhossein Noori Latif	US	unknown
—	—	193.222.96.163:43782	srv.identitynetwork.top	Amirhossein Noori Latif	US	unknown
—	—	79.110.62.25:2137	proxies.identitynetwork.top	Delis LLC	US	unknown
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	unknown

DNS requests

Domain	IP	Reputation
api.snapcraft.io	185.125.188.55 185.125.188.59 185.125.188.54 185.125.188.58	unknown
srv.identitynetwork.top	193.222.96.163 78.153.140.51	unknown
proxies.identitynetwork.top	78.153.140.51 193.222.96.163 79.110.62.25	unknown
64.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2001:67c:1562::23 2620:2d:4000:1::23 2620:2d:4002:1::197 2620:2d:4000:1::96 2620:2d:4000:1::2a 2620:2d:4002:1::196 2001:67c:1562::24 2620:2d:4000:1::22 2620:2d:4000:1::98 2620:2d:4000:1::2b 2620:2d:4000:1::97 2620:2d:4002:1::198 185.125.190.48 91.189.91.98 185.125.190.98 91.189.91.48 91.189.91.96 185.125.190.97 91.189.91.97 91.189.91.49 185.125.190.18 185.125.190.17 185.125.190.49 185.125.190.96	unknown

Threats

PID	Process	Class	Message
—	—	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 37
—	—	Misc Attack	ET 3CORESec Poor Reputation IP group 6
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET DNS Query to a *.top domain - Likely Hostile
—	—	Crypto Currency Mining Activity Detected	MINER [ANY.RUN] CoinMiner Agent CnC Initial Connection
—	—	Potential Corporate Privacy Violation	ET POLICY Cryptocurrency Miner Checkin
—	—	Misc Attack	ET DROP Dshield Block Listed Source group 1

Add for printing

No debug info

General Info

/qa.sh

2CA0F44CBD4917C78E306FE54621D2EB

0741DFF260F83CDBA4F90469EE2D72568F8389A7

BE4F1A4E06CF61BCA3D26CA75E209F89985E20D7178A3C5CD2C47B63907A759C

12:+VTltK00HiokOyUdcPUlUpUF+vPUukS9B2g/ZO:Sn9nO3Ovr9zA

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Reads /proc/mounts (likely used to find writable filesystems)

Checks list of the CPUs

Uses wget to download content

Executes the "rm" command to delete files or directories

Checks active cgroups controllers (like CPU time, system memory, network bandwidth)

Checks the online status of NUMA nodes

Checks DMI information (probably VM detection)

Modifies Cron jobs

Executes commands using command-line interpreter

Modifies file or directory owner

Manipulating modules (likely to execute programs on system boot)

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings