File name:

da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf

Full analysis: https://app.any.run/tasks/e20c7e82-ff2b-46d5-bc05-c6a6b85abd2d
Verdict: Malicious activity
Analysis date: March 24, 2025, 11:45:51
OS: Ubuntu 22.04.2
Indicators:
MIME: application/x-executable
File info: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
MD5:

AE403EF91F4A5A63F9FEA903F5C2A598

SHA1:

409CA9D7EA942A3ECA0D81367EBF5D3843CD3A7A

SHA256:

DA92F6515014F5F4CA9D22CEE708F921A0A2228FDC8220CB188E2B345D9B6E69

SSDEEP:

1536:qRw+4AzFl+uyAmCPw6j6fa45GMuuuxfyMCx3uXgtXSCh:2w+4AzFl+uyAmCPwPGMef3C0ab

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 40671)

    • Connects to unusual port

      • da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf (PID: 40685)

    • Reads profile file

      • da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf (PID: 40677)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.o | ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture: 32 bit
CPUByteOrder: Little endian
ObjectFileType: Executable file
CPUType: i386
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
289
Monitored processes
67
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs systemctl no specs chmod no specs sudo no specs da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf no specs locale-check no specs bash no specs mesg no specs dash no specs tr no specs cat no specs da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf gnome-session-ctl no specs da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf udevadm no specs avahi-daemon no specs avahi-daemon no specs acpid no specs cron no specs gsd-rfkill no specs systemd-hostnamed no specs gnome-session-ctl no specs gnome-session-ctl no specs dash no specs dash no specs gnome-session-ctl no specs gnome-session-ctl no specs gnome-session-ctl no specs gnome-session-ctl no specs gnome-session-ctl no specs gnome-session-ctl no specs gnome-session-ctl no specs gnome-session-ctl no specs gnome-session-ctl no specs gnome-session-ctl no specs gnome-session-ctl no specs dbus-daemon no specs gnome-session-ctl no specs gnome-session-ctl no specs networkmanager no specs dash no specs systemctl no specs kmod no specs nm-online no specs systemd-hostnamed no specs systemd-logind no specs systemd no specs systemd no specs nm-dispatcher no specs nm-dispatcher no specs nm-dispatcher no specs dash no specs dash no specs run-parts no specs run-parts no specs run-parts no specs run-parts no specs run-parts no specs run-parts no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs

Process information

PID
CMD
Path
Indicators
Parent process
40670/bin/sh -c "sudo chown user /home/user/Desktop/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69\.elf && chmod +x /home/user/Desktop/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69\.elf && DISPLAY=:0 sudo -i /home/user/Desktop/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69\.elf "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40671sudo chown user /home/user/Desktop/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40672chown user /home/user/Desktop/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40673systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40674chmod +x /home/user/Desktop/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40675sudo -i /home/user/Desktop/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40677/home/user/Desktop/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf/home/user/Desktop/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40678/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40679-bash --login -c \/home\/user\/Desktop\/da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69\.elf/usr/bin/bash—da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40680sh -c "cat /usr/etc/debuginfod/*\.urls 2>/dev/null"/usr/bin/dash—bash
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
879
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.18:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.190.18:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.190.18:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.190.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
91.189.91.48:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.190.97:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.188.59:443
https://api.snapcraft.io/api/v1/snaps/names?confinement=strict%2Cclassic
unknown
—
—
—
—
—
GET
204
185.125.190.97:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
91.189.91.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
91.189.91.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.18:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
207.211.211.26:443
odrs.gnome.org
—
US
whitelisted
—
—
169.150.255.180:443
odrs.gnome.org
—
GB
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
40685
da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf
89.190.156.145:7733
—
Alsycon B.V.
NL
unknown
—
—
89.190.156.145:7733
—
Alsycon B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 185.125.190.18
  • 185.125.190.97
  • 91.189.91.48
  • 91.189.91.96
  • 185.125.190.48
  • 185.125.190.49
  • 91.189.91.49
  • 185.125.190.17
  • 91.189.91.97
  • 91.189.91.98
  • 185.125.190.98
  • 185.125.190.96
  • 2620:2d:4000:1::96
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::98
  • 2001:67c:1562::24
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::2b
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::97
  • 2001:67c:1562::23
whitelisted
odrs.gnome.org
  • 207.211.211.26
  • 195.181.175.40
  • 169.150.255.180
  • 37.19.194.81
  • 169.150.255.184
  • 195.181.170.18
  • 212.102.56.178
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::21
whitelisted
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.59
  • 185.125.188.54
  • 185.125.188.55
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::6d
whitelisted
google.com
  • 142.250.185.78
  • 2a00:1450:4001:81c::200e
whitelisted
kumalala.cloudboats.vip
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69.elf