Find similar analyses in TI Lookup

Analysis date (UTC): 5 April 2025, 08:18Analysis environment: Ubuntu 22.04.2

message.txt

MD5:7E75CE6ADEF9A41E70ADF90878D4F127

SHA1:9FFCEFE691183A097E77D60AFCFDE35E46EECB8B

SHA256:DE8FCC44317CB5C16AC750A9B5680C0B84869D1623B9B1F0977DCDA9B0AC6DF2

Analysis result

Threat level:Malicious activity

Tags:

loader

Full analysis:Analysis message.txt (MD5: 7E75CE6ADEF9A41E70ADF90878D4F127) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Executes commands using command-line interpreter

gnome-terminal-server (PID: 39564)
sudo (PID: 39495)

Executes the "rm" command to delete files or directories

bash (PID: 39582)

Process drops legitimate windows executable

busybox (PID: 39615)
busybox (PID: 39620)
wget (PID: 39592)
busybox (PID: 39604)
busybox (PID: 39625)
busybox (PID: 39610)
busybox (PID: 39635)
busybox (PID: 39640)
busybox (PID: 39630)
busybox (PID: 39645)
busybox (PID: 39650)
busybox (PID: 39655)
busybox (PID: 39660)
busybox (PID: 39665)
busybox (PID: 39670)
busybox (PID: 39675)
busybox (PID: 39680)
busybox (PID: 39690)
busybox (PID: 39685)
busybox (PID: 39695)
busybox (PID: 39700)
busybox (PID: 39710)
busybox (PID: 39705)
busybox (PID: 39715)
busybox (PID: 39730)
busybox (PID: 39735)
busybox (PID: 39740)
busybox (PID: 39725)
busybox (PID: 39720)

Reads profile file

gnome-text-editor (PID: 39496)

Potential Corporate Privacy Violation

wget (PID: 39592)
busybox (PID: 39610)
busybox (PID: 39604)
busybox (PID: 39620)
busybox (PID: 39615)
busybox (PID: 39630)
busybox (PID: 39625)
busybox (PID: 39635)
busybox (PID: 39640)
busybox (PID: 39645)
busybox (PID: 39650)
busybox (PID: 39655)
busybox (PID: 39660)
busybox (PID: 39665)
busybox (PID: 39670)
busybox (PID: 39685)
busybox (PID: 39680)
busybox (PID: 39690)
busybox (PID: 39695)
busybox (PID: 39700)
busybox (PID: 39705)
busybox (PID: 39710)
busybox (PID: 39720)
busybox (PID: 39725)
busybox (PID: 39675)
busybox (PID: 39730)
busybox (PID: 39735)
busybox (PID: 39740)
busybox (PID: 39593)

Uses wget to download content

bash (PID: 39582)

Executable content was dropped or overwritten

wget (PID: 39592)
busybox (PID: 39604)
busybox (PID: 39615)
busybox (PID: 39610)
busybox (PID: 39620)
busybox (PID: 39625)
busybox (PID: 39635)
busybox (PID: 39640)
busybox (PID: 39630)
busybox (PID: 39645)
busybox (PID: 39650)
busybox (PID: 39655)
busybox (PID: 39660)
busybox (PID: 39670)
busybox (PID: 39665)
busybox (PID: 39675)
busybox (PID: 39680)
busybox (PID: 39685)
busybox (PID: 39690)
busybox (PID: 39705)
busybox (PID: 39700)
busybox (PID: 39710)
busybox (PID: 39715)
busybox (PID: 39720)
busybox (PID: 39725)
busybox (PID: 39730)
busybox (PID: 39735)
busybox (PID: 39740)
busybox (PID: 39695)

Connects to the server without a host name

busybox (PID: 39604)
busybox (PID: 39593)
busybox (PID: 39615)
busybox (PID: 39620)
busybox (PID: 39625)
wget (PID: 39592)
busybox (PID: 39610)
busybox (PID: 39630)
busybox (PID: 39635)
busybox (PID: 39640)
busybox (PID: 39650)
busybox (PID: 39645)
busybox (PID: 39655)
busybox (PID: 39670)
busybox (PID: 39660)
busybox (PID: 39675)
busybox (PID: 39680)
busybox (PID: 39685)
busybox (PID: 39665)
busybox (PID: 39700)
busybox (PID: 39695)
busybox (PID: 39705)
busybox (PID: 39690)
busybox (PID: 39715)
busybox (PID: 39710)
busybox (PID: 39720)
busybox (PID: 39730)
busybox (PID: 39735)
busybox (PID: 39725)
busybox (PID: 39740)

INFO

The sample compiled with english language support

wget (PID: 39592)
busybox (PID: 39615)
busybox (PID: 39620)
busybox (PID: 39604)
busybox (PID: 39610)
busybox (PID: 39625)
busybox (PID: 39635)
busybox (PID: 39645)
busybox (PID: 39630)
busybox (PID: 39640)
busybox (PID: 39650)
busybox (PID: 39655)
busybox (PID: 39660)
busybox (PID: 39665)
busybox (PID: 39670)
busybox (PID: 39675)
busybox (PID: 39680)
busybox (PID: 39685)
busybox (PID: 39690)
busybox (PID: 39695)
busybox (PID: 39700)
busybox (PID: 39710)
busybox (PID: 39715)
busybox (PID: 39720)
busybox (PID: 39705)
busybox (PID: 39735)
busybox (PID: 39740)
busybox (PID: 39725)
busybox (PID: 39730)

Checks timezone

python3.10 (PID: 39556)
wget (PID: 39592)

Threats

PID	Process	Class	Message
39592	wget	Potential Corporate Privacy Violation	ET INFO PE EXE or DLL Windows file download HTTP
39604	busybox	Potential Corporate Privacy Violation	ET INFO PE EXE or DLL Windows file download HTTP
39592	wget	Misc activity	ET INFO Packed Executable Download
39604	busybox	Potentially Bad Traffic	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
39592	wget	Potentially Bad Traffic	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
39604	busybox	Misc activity	ET INFO Packed Executable Download
39615	busybox	Potential Corporate Privacy Violation	ET INFO PE EXE or DLL Windows file download HTTP
39620	busybox	Misc activity	ET INFO Packed Executable Download
39610	busybox	Misc activity	ET INFO Packed Executable Download
39615	busybox	Misc activity	ET INFO Packed Executable Download

Rows per page