File name:

auto_color.elf

Full analysis: https://app.any.run/tasks/1c7c4fc0-af11-44c9-b45e-b7cbe82ea002
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: April 19, 2025, 11:26:30
OS: Ubuntu 22.04.2
Tags:
auto-color
backdoor
Indicators:
MIME: application/x-pie-executable
File info: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=08a8401aef311e569e8bcbc3b46829560334ec0a, for GNU/Linux 3.2.0, stripped
MD5:

A30F5C43B437C940A4D5E940D37106CA

SHA1:

F91623FA3D8C69B0A3FC1ED2172290AF492BE37B

SHA256:

E463921880458EE1DE65CC3F77AE07A3B9A3AE151DE8B6C52EA382C8D6146B0F

SSDEEP:

1536:S2AYDjMunnwrPqfMAuuHFGYa865MzFN4brZHh4lX32uHYj/M2ql:S9eLnnwDqfMAuuHFGYz6KN44n2uHNN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AUTOCOLOR has been detected

      • auto_color.elf (PID: 39503)

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • sudo (PID: 39501)

    • Modifies file or directory owner

      • sudo (PID: 39497)

    • Reads passwd file

      • auto_color.elf (PID: 39503)

    • Reads profile file

      • auto_color.elf (PID: 39503)

    • Connects to unusual port

      • auto_color.elf (PID: 39503)

  • INFO

    • Creates file in the temporary folder

      • auto_color.elf (PID: 39503)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.o | ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture: 64 bit
CPUByteOrder: Little endian
ObjectFileType: Shared object file
CPUType: AMD x86-64
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
234
Monitored processes
13
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs systemctl no specs chown no specs chmod no specs sudo no specs #AUTO-COLOR auto_color.elf locale-check no specs bash no specs dash no specs tr no specs mesg no specs cat no specs

Process information

PID
CMD
Path
Indicators
Parent process
39496/bin/sh -c "sudo chown user /home/user/Desktop/auto_color\.elf && chmod +x /home/user/Desktop/auto_color\.elf && DISPLAY=:0 sudo -i /home/user/Desktop/auto_color\.elf "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
39497sudo chown user /home/user/Desktop/auto_color.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39498systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39499chown user /home/user/Desktop/auto_color.elf/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39500chmod +x /home/user/Desktop/auto_color.elf/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39501sudo -i /home/user/Desktop/auto_color.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
39503/home/user/Desktop/auto_color.elf/home/user/Desktop/auto_color.elf
sudo
User:
root
Integrity Level:
UNKNOWN
39504/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—auto_color.elf
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39505-bash --login -c \/home\/user\/Desktop\/auto_color\.elf/usr/bin/bash—auto_color.elf
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39506sh -c "cat /usr/etc/debuginfod/*\.urls 2>/dev/null"/usr/bin/dash—bash
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
Executable files
0
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
39503auto_color.elf/var/log/cross/auto-colorbinary
MD5:—
SHA256:—
39503auto_color.elf/usr/lib/x86_64-linux-gnu/libcext.so.2binary
MD5:—
SHA256:—
39503auto_color.elf/etc/ld.so.preloadtext
MD5:—
SHA256:—
39503auto_color.elf/var/log/cross/0/config-err-7500b1bbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
46
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
185.125.188.58:443
https://api.snapcraft.io/api/v1/snaps/auth/sessions
unknown
binary
587 b
whitelisted
—
—
POST
200
185.125.188.54:443
https://api.snapcraft.io/api/v1/snaps/auth/nonces
unknown
binary
53 b
whitelisted
—
—
POST
200
185.125.188.55:443
https://api.snapcraft.io/api/v1/snaps/auth/nonces
unknown
binary
53 b
whitelisted
—
—
POST
200
185.125.188.59:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.5 Kb
whitelisted
—
—
POST
200
185.125.188.58:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.4 Kb
whitelisted
—
—
POST
200
185.125.188.55:443
https://api.snapcraft.io/api/v1/snaps/auth/sessions
unknown
binary
587 b
whitelisted
—
—
POST
200
185.125.188.59:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.4 Kb
whitelisted
—
—
GET
—
185.125.190.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
185.125.190.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.190.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.49:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
169.150.255.181:443
odrs.gnome.org
—
GB
whitelisted
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
39503
auto_color.elf
18.167.12.195:5353
check.linux-kernel.xyz
AMAZON-02
HK
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 185.125.190.49
  • 91.189.91.97
  • 185.125.190.18
  • 185.125.190.97
  • 185.125.190.98
  • 185.125.190.17
  • 185.125.190.48
  • 91.189.91.98
  • 185.125.190.96
  • 91.189.91.48
  • 91.189.91.49
  • 91.189.91.96
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::23
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::2a
  • 2620:2d:4002:1::197
  • 2001:67c:1562::24
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::96
  • 2001:67c:1562::23
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::196
whitelisted
odrs.gnome.org
  • 169.150.255.181
  • 195.181.170.18
  • 37.19.194.81
  • 207.211.211.26
  • 212.102.56.178
  • 195.181.175.41
  • 169.150.255.183
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::101
whitelisted
api.snapcraft.io
  • 185.125.188.54
  • 185.125.188.58
  • 185.125.188.55
  • 185.125.188.59
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::6d
  • 2620:2d:4000:1010::42
whitelisted
google.com
  • 142.250.186.142
  • 2a00:1450:4001:82a::200e
whitelisted
check.linux-kernel.xyz
  • 18.167.12.195
unknown
10.100.168.192.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
auto_color.elf