Malware analysis redtail Malicious activity | ANY.RUN

Add for printing

File name:	redtail
Full analysis:	https://app.any.run/tasks/8b809fe2-06aa-48ef-bbe0-b30dfbde88ae
Verdict:	Malicious activity
Threats:	Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. Malware Trends Tracker >>>
Analysis date:	August 19, 2024, 13:09:30
OS:	Ubuntu 22.04.2
Tags:	miner
Indicators:
MIME:	application/x-sharedlib
File info:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), statically linked, no section header
MD5:	D433A029EA44786CADA7A4B63655A1B4
SHA1:	AFE4B1B9C16444FCAA8FD9CE77A4EC18533C9CF5
SHA256:	CDEE45E764FFF18A81E3FC7AB719E03FD93239180BD213BD754691579F01421E
SSDEEP:	49152:6fW7eNvoJ+lXWkkS3SyXWogSq7ditVqV9qWe4Bz/V4Y+X6kU248w/rmkgu76OBbh:6fqJeXWpMSyXWorqAGb54Kh24N/iDO/j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Connects to the CnC server
  - redtail.o (PID: 12999)
- MINER has been detected (SURICATA)
  - redtail.o (PID: 12999)
SUSPICIOUS
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 12967)
  - bash (PID: 12985)
  - redtail.o (PID: 12999)
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 12957)
  - redtail.o (PID: 12998)
  - udevadm (PID: 13018)
- Modifies Cron jobs
  - sh (PID: 13001)
- Reads /proc/mounts (likely used to find writable filesystems)
  - redtail.o (PID: 12998)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 13017)
- Crypto Currency Mining Activity Detected
  - redtail.o (PID: 12999)
- Connects to unusual port
  - redtail.o (PID: 12999)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Shared object file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

256

Monitored processes

43

Malicious processes

2

Suspicious processes

2

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
12935	/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus /home/user/Desktop/redtail\.o "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 213
12936	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
12937	sudo -iu user nautilus /home/user/Desktop/redtail.o	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 1195
12938	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
12939	nautilus /home/user/Desktop/redtail.o	/usr/bin/nautilus	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 1195
12940	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	nautilus
User: user Integrity Level: UNKNOWN Exit code: 0
12957	/lib/systemd/systemd-hostnamed	/lib/systemd/systemd-hostnamed	—	systemd
User: root Integrity Level: UNKNOWN Exit code: 482
12963	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 482
12964	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 482
12965	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 482

Add for printing

Executable files

0

Suspicious files

2

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
12939	nautilus	/home/user/.local/share/nautilus/tags/meta.db		sqlite
		MD5:—	SHA256:—
12939	nautilus	/home/user/.local/share/nautilus/tags/meta.db-shm		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

27

DNS requests

20

Threats

8

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.98:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	169.150.255.183:443	odrs.gnome.org	—	GB	unknown
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	malicious
485	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
485	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
485	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	malicious
12999	redtail.o	95.215.19.53:853	—	ab stract	FI	unknown
12999	redtail.o	8.8.8.8:853	—	GOOGLE	US	malicious

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.98 91.189.91.96 185.125.190.97 185.125.190.17 91.189.91.49 91.189.91.48 185.125.190.18 185.125.190.96 91.189.91.97 91.189.91.98 185.125.190.49 185.125.190.48 2620:2d:4000:1::2a 2620:2d:4000:1::96 2620:2d:4000:1::23 2620:2d:4002:1::198 2620:2d:4000:1::2b 2620:2d:4002:1::196 2001:67c:1562::24 2620:2d:4000:1::97 2001:67c:1562::23 2620:2d:4000:1::98 2620:2d:4002:1::197 2620:2d:4000:1::22	whitelisted
google.com	142.250.186.46 2a00:1450:4001:80f::200e	whitelisted
odrs.gnome.org	169.150.255.183 195.181.175.41 207.211.211.26 212.102.56.178 37.19.194.80 195.181.170.19 169.150.255.181 2a02:6ea0:c700::11 2a02:6ea0:c700::101 2a02:6ea0:c700::107 2a02:6ea0:c700::19 2a02:6ea0:c700::112 2a02:6ea0:c700::18 2a02:6ea0:c700::21	whitelisted
api.snapcraft.io	185.125.188.59 185.125.188.55 185.125.188.54 185.125.188.58	whitelisted
71.100.168.192.in-addr.arpa	—	unknown
moneroed.net	5.182.211.148 92.118.39.120 5.182.211.150 5.182.211.152 5.182.211.154	unknown

Threats

PID	Process	Class	Message
12999	redtail.o	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 317
12999	redtail.o	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 210
12999	redtail.o	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 1
12999	redtail.o	Crypto Currency Mining Activity Detected	MINER [ANY.RUN] CoinMiner Agent CnC Initial Connection
—	—	Potential Corporate Privacy Violation	ET POLICY Cryptocurrency Miner Checkin
—	—	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 14
—	—	Potential Corporate Privacy Violation	ET POLICY Cryptocurrency Miner Checkin

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

redtail

D433A029EA44786CADA7A4B63655A1B4

AFE4B1B9C16444FCAA8FD9CE77A4EC18533C9CF5

CDEE45E764FFF18A81E3FC7AB719E03FD93239180BD213BD754691579F01421E

49152:6fW7eNvoJ+lXWkkS3SyXWogSq7ditVqV9qWe4Bz/V4Y+X6kU248w/rmkgu76OBbh:6fqJeXWpMSyXWorqAGb54Kh24N/iDO/j

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Connects to the CnC server

MINER has been detected (SURICATA)

SUSPICIOUS

Executes commands using command-line interpreter

Checks DMI information (probably VM detection)

Modifies Cron jobs

Reads /proc/mounts (likely used to find writable filesystems)

Manipulating modules (likely to execute programs on system boot)

Crypto Currency Mining Activity Detected

Connects to unusual port

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings