Malware analysis http://93.123.39.76/huj.sh Malicious activity

Add for printing

URL:	http://93.123.39.76/huj.sh
Full analysis:	https://app.any.run/tasks/75bac951-6579-461f-aaee-da4a8207fcc1
Verdict:	Malicious activity
Analysis date:	February 13, 2024, 00:32:25
OS:	Ubuntu 22.04.2
Indicators:
MD5:	AD1B3FE2E1E624DAB415A17C9E9C66A9
SHA1:	50752D107920D305E65791621512CE0FE381101A
SHA256:	DBA3A3F72DDDB40C33D33954E090D24952084E89E30BC953E43D346B9BE958AA
SSDEEP:	3:N1K2SW/RaiN:C2SwaiN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Creates shell script file
  - chrome (PID: 7924)
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 8160)
  - .redtail (PID: 8242)
  - apt-get (PID: 8350)
  - dpkg-preconfigure (PID: 8356)
  - apt-get (PID: 8398)
- Checks DMI information (probably VM detection)
  - .redtail (PID: 8241)
  - systemd-hostnamed (PID: 8127)
  - udevadm (PID: 8337)
  - udevadm (PID: 8340)
  - .redtail (PID: 8533)
- Checks active cgroups controllers (like CPU time, system memory, network bandwidth)
  - .redtail (PID: 8241)
  - .redtail (PID: 8533)
- Executes the "rm" command to delete files or directories
  - huj.sh (PID: 8220)
  - huj.sh (PID: 8511)
  - update-motd-updates-available (PID: 8404)
  - dpkg (PID: 8371)
- Checks the online status of NUMA nodes
  - .redtail (PID: 8241)
  - .redtail (PID: 8533)
- Checks list of the CPUs
  - .redtail (PID: 8241)
  - .redtail (PID: 8533)
- Reads /proc/mounts (likely used to find writable filesystems)
  - .redtail (PID: 8241)
  - .redtail (PID: 8533)
- Uses wget to download content
  - huj.sh (PID: 8220)
  - huj.sh (PID: 8511)
- Modifies Cron jobs
  - sh (PID: 8331)
- Reads information about logins, logouts, and login attempts
  - bash (PID: 8178)
- Creates or rewrites file in the "bin" folder
  - dpkg (PID: 8371)
- Changes time attribute to hide new files or make changes to the existing one
  - sh (PID: 8402)
INFO
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 8336)
  - modprobe (PID: 8338)
  - modprobe (PID: 8339)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

610

Monitored processes

385

Malicious processes

0

Suspicious processes

5

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
7922	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome \"http://93\.123\.39\.76/huj\.sh\" "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 0
7923	sudo -iu user google-chrome http://93.123.39.76/huj.sh	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 0
7924	/usr/bin/google-chrome http://93.123.39.76/huj.sh	/opt/google/chrome/chrome	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
7925	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7926	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7927	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7928	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7929	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7930	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7931		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
7924	chrome	/7924/fd/63		—
		MD5:—	SHA256:—
7924	chrome	/home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-65CAB89E-1EF4.pma		—
		MD5:—	SHA256:—
7924	chrome	/.com.google.Chrome.J7Zl8U		—
		MD5:—	SHA256:—
7924	chrome	/.com.google.Chrome.zj6h2p		—
		MD5:—	SHA256:—
7924	chrome	/.com.google.Chrome.zEZoOE		—
		MD5:—	SHA256:—
7924	chrome	/home/user/.config/google-chrome/Default/Session Storage/LOG		—
		MD5:—	SHA256:—
7924	chrome	/home/user/.config/google-chrome/Default/shared_proto_db/metadata/LOG		—
		MD5:—	SHA256:—
7924	chrome	/home/user/.config/google-chrome/Default/shared_proto_db/LOG		—
		MD5:—	SHA256:—
7924	chrome	/home/user/.config/google-chrome/WidevineCdm/.com.google.Chrome.M651A9		—
		MD5:—	SHA256:—
7924	chrome	/.com.google.Chrome.gf9Yfz		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

14

TCP/UDP connections

72 873

DNS requests

77

Threats

9

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	200	93.123.39.76:80	http://93.123.39.76/download/redtail.i686	unknown	binary	1.77 Mb	unknown
—	—	GET	200	93.123.39.76:80	http://93.123.39.76/huj.sh	unknown	text	1.21 Kb	unknown
—	—	GET	200	93.123.39.76:80	http://93.123.39.76/download/redtail.x86_64	unknown	binary	1.80 Mb	unknown
—	—	GET	200	93.123.39.76:80	http://93.123.39.76/download/redtail.arm8	unknown	binary	1.51 Mb	unknown
—	—	GET	200	93.123.39.76:80	http://93.123.39.76/download/redtail.arm7	unknown	binary	1.21 Mb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad5ml547gfrjgchmd5pd74nchbsa_2024.2.12.0/niikhdgajlphfehepabhhblakbdgeefj_2024.02.12.00_all_kulqr4zozsu26pceac55mcdq5a.crx3	unknown	binary	5.63 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/lmelglejhemejginpboagddgdfbepgmp/1.d714e27bbcdedab3f9f9ca92462ee6dc8ca779849aefdd27af92009a9d55a38f/1.1c9ef13b7a63abd8f89d0cbad98858b9e8f54fc3951160950403c72b45812d07/7c4973aa28b0c59d92cc9ebf075fcdccab6008b049c66388f079107ba6184551.puff	unknown	binary	2.28 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/addz6q6bz6tk3vsstidrivmno3xq_8543/hfnkpimlhhgieaddgfemjhofmfblmnib_8543_all_acqfgv64tayldgynuci62usitjzq.crx3	unknown	binary	26.4 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx	unknown	binary	3.07 Kb	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.48:80	—	Canonical Group Limited	GB	unknown
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.98:80	—	Canonical Group Limited	US	unknown
—	—	239.255.255.250:1900	—	—	—	unknown
—	—	142.250.184.195:443	clientservices.googleapis.com	GOOGLE	US	unknown
—	—	74.125.71.84:443	accounts.google.com	GOOGLE	US	unknown
—	—	93.123.39.76:80	xmr.ohuyal.xyz	Vivacom	BG	unknown
—	—	93.123.39.76:443	xmr.ohuyal.xyz	Vivacom	BG	unknown
—	—	142.250.185.131:443	update.googleapis.com	GOOGLE	US	unknown
—	—	142.250.184.206:443	sb-ssl.google.com	GOOGLE	US	unknown

DNS requests

Domain	IP	Reputation
clientservices.googleapis.com	142.250.184.195	whitelisted
accounts.google.com	74.125.71.84	shared
update.googleapis.com	142.250.185.131	whitelisted
www.google.com	142.250.184.196 142.250.186.164	whitelisted
sb-ssl.google.com	142.250.184.206	whitelisted
sb-ssl.l.google.com	—	unknown
117.100.168.192.in-addr.arpa	—	unknown
optimizationguide-pa.googleapis.com	142.250.186.138 142.250.74.202 142.250.186.42 172.217.18.10 142.250.186.106 172.217.16.202 216.58.206.42 216.58.212.138 142.250.185.74 142.250.185.106 142.250.185.138 142.250.185.170 142.250.185.202 142.250.185.234 142.250.184.234 142.250.184.202	whitelisted
connectivity-check.ubuntu.com	2620:2d:4000:1::23 2620:2d:4002:1::198 2001:67c:1562::23 2620:2d:4002:1::197 2620:2d:4000:1::22 2001:67c:1562::24 2620:2d:4000:1::2b 2620:2d:4000:1::96 2620:2d:4000:1::97 2620:2d:4000:1::98 2620:2d:4002:1::196 2620:2d:4000:1::2a	unknown
edgedl.me.gvt1.com	34.104.35.123	whitelisted

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET INFO X86_64 File Download Request from IP Address
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .i686 File
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET INFO ARM7 File Download Request from IP Address
—	—	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP

Add for printing

No debug info

General Info

http://93.123.39.76/huj.sh

AD1B3FE2E1E624DAB415A17C9E9C66A9

50752D107920D305E65791621512CE0FE381101A

DBA3A3F72DDDB40C33D33954E090D24952084E89E30BC953E43D346B9BE958AA

3:N1K2SW/RaiN:C2SwaiN

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Creates shell script file

Executes commands using command-line interpreter

Checks DMI information (probably VM detection)

Checks active cgroups controllers (like CPU time, system memory, network bandwidth)

Executes the "rm" command to delete files or directories

Checks the online status of NUMA nodes

Checks list of the CPUs

Reads /proc/mounts (likely used to find writable filesystems)

Uses wget to download content

Modifies Cron jobs

Reads information about logins, logouts, and login attempts

Creates or rewrites file in the "bin" folder

Changes time attribute to hide new files or make changes to the existing one

INFO

Manipulating modules (likely to execute programs on system boot)

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings