Malware analysis https://www.thc.org/ssh-it/ Malicious activity

Add for printing

URL:	https://www.thc.org/ssh-it/
Full analysis:	https://app.any.run/tasks/84626819-d0d1-4705-845b-7f64d771996f
Verdict:	Malicious activity
Analysis date:	March 26, 2024, 13:02:14
OS:	Ubuntu 22.04.2
MD5:	9B2FFE74D4920447B6D8C8F3B42B7B49
SHA1:	F05BC11BB9AEBFD01D16295250BEB08DF176496D
SHA256:	F26F705736C0491D23EA3D4FFE6AB742C85A65C2967D4F23856E250D961EE43A
SSDEEP:	3:N8DSLSLWcMsn:2OLWfn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - gnome-terminal-server (PID: 9554)
  - dpkg-preconfigure (PID: 9652)
  - bash (PID: 9572)
  - apt (PID: 9606)
  - apt (PID: 9694)
  - bash (PID: 9909)
  - tar (PID: 9921)
  - bash (PID: 9910)
  - ssh (PID: 9967)
  - tar (PID: 9979)
  - sshd (PID: 10011)
  - sshd (PID: 10096)
- Executes the "rm" command to delete files or directories
  - dpkg (PID: 9667)
  - update-motd-updates-available (PID: 9700)
  - bash (PID: 9884)
  - bash (PID: 9927)
- Changes time attribute to hide new files or make changes to the existing one
  - sh (PID: 9698)
  - bash (PID: 9927)
- Reads information about logins, logouts, and login attempts
  - bash (PID: 9572)
- Creates or rewrites file in the "bin" folder
  - dpkg (PID: 9667)
- Creates shell script file
  - tar (PID: 9907)
  - tar (PID: 9949)
- Checks the user who created the process
  - sshd (PID: 10011)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

774

Monitored processes

546

Malicious processes

0

Suspicious processes

3

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9296	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome \"https://www\.thc\.org/ssh-it/\" "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN
9297	sudo -iu user google-chrome https://www.thc.org/ssh-it/	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN
9298	/usr/bin/google-chrome https://www.thc.org/ssh-it/	/opt/google/chrome/chrome	—	sudo
User: user Integrity Level: UNKNOWN
9299	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9300	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9301	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9302	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
9303	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
9304	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
9305		/opt/google/chrome/chrome	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9298	chrome	/9298/fd/63		—
		MD5:—	SHA256:—
9298	chrome	/home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-6602C75C-2452.pma		—
		MD5:—	SHA256:—
9298	chrome	/.com.google.Chrome.Erv7Nq		—
		MD5:—	SHA256:—
9298	chrome	/.com.google.Chrome.yojsSU		—
		MD5:—	SHA256:—
9298	chrome	/.com.google.Chrome.s276EP		—
		MD5:—	SHA256:—
9298	chrome	/.com.google.Chrome.LiYTUQ		—
		MD5:—	SHA256:—
9298	chrome	/.com.google.Chrome.XOENGZ		—
		MD5:—	SHA256:—
9298	chrome	/.com.google.Chrome.5zv6Ev		—
		MD5:—	SHA256:—
9298	chrome	/home/user/.config/google-chrome/Default/Local Storage/leveldb/LOG		—
		MD5:—	SHA256:—
9298	chrome	/home/user/.config/google-chrome/Default/commerce_subscription_db/LOG		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

11

TCP/UDP connections

52

DNS requests

53

Threats

2

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jx7rkbwas3jtmlgf6ivmagwisi_2024.3.22.0/niikhdgajlphfehepabhhblakbdgeefj_2024.03.22.00_all_pplglefstwrw27olw4xpo7hgs4.crx3	unknown	binary	5.92 Kb	unknown
—	—	GET	200	91.189.91.81:80	http://ie.archive.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.81.0-1ubuntu1.15_amd64.deb	unknown	binary	189 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.90b91aaa463ef666bf030c7f14b7046738dee86d64321b28cb834d04bbfea4b3/1.4a6508925b2ffec931c1e3931ddeb15ca41d820a8264cd5a962b526e9932bcdf/e7212b90bb1f0ff6252449bbddc556675aa725f13d46408fb87016facb011e35.puff	unknown	binary	3.21 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx	unknown	binary	3.07 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adenfnd66guzd4vn7ffvjgkyl7wq_439/lmelglejhemejginpboagddgdfbepgmp_439_all_ZZ_adbbwdbp45y3tcec5bde2wha5nnq.crx3	unknown	binary	46.8 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/jflookgnkcckhobaglndicnbbgbonegd/1.a00d455e64721d33c650d312ce6208b58e42fb0181b5e89c2f5222eda2b8e712/1.ab8da5b849ba36382f26992fe1b52d72aa457549f31246a0c386d6880fca8afc/36fd7b9c256475d2f7be4667ebf839f5a95a72dd73026ce6889740102eda5182.puff	unknown	binary	52.2 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.a20984b62546ce601a8395d3363909bdd9e427ce1c0c3363c2f21e5808dbe9b3/1.6fcc02a365d39485c49c9da8679a9fd979832315b2d47ff7f0ab395b10e303bd/04c228ddca24f61e36e7ead1e61fd583f99fada897f37fdf44d4cf0586a81857.puff	unknown	binary	22.9 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ki7f4nrcmjqm7uvrab7w422q3e_2024.3.25.1/jflhchccmppkfebkiaminageehmchikm_2024.03.25.01_all_m2b6xwgmnygdaozhrleqizrdku.crx3	unknown	binary	9.21 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad7ymo4xuspiuckympqnpnyov56a_8623/hfnkpimlhhgieaddgfemjhofmfblmnib_8623_all_e77nvdtde6nzgspcgrmkwa5q2a.crx3	unknown	binary	26.1 Kb	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.17:80	changelogs.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	185.125.190.18:80	changelogs.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	185.125.190.98:80	—	Canonical Group Limited	GB	unknown
—	—	195.181.175.40:443	—	Datacamp Limited	DE	unknown
—	—	74.125.143.84:443	accounts.google.com	GOOGLE	US	unknown
—	—	239.255.255.250:1900	—	—	—	unknown
—	—	104.26.2.199:443	cdnjs.buymeacoffee.com	—	—	unknown
—	—	216.58.206.67:443	clientservices.googleapis.com	GOOGLE	US	unknown
—	—	185.199.111.153:443	www.thc.org	FASTLY	US	unknown

DNS requests

Domain	IP	Reputation
clientservices.googleapis.com	216.58.206.67	whitelisted
accounts.google.com	74.125.143.84	shared
www.thc.org	185.199.111.153 185.199.108.153 185.199.109.153 185.199.110.153 2606:50c0:8003::153 2606:50c0:8001::153 2606:50c0:8000::153 2606:50c0:8002::153	unknown
fonts.googleapis.com	142.250.185.202	whitelisted
cdnjs.buymeacoffee.com	104.26.2.199 172.67.75.15 104.26.3.199	whitelisted
asciinema.org	109.107.37.0	whitelisted
fonts.gstatic.com	142.250.185.67	whitelisted
a.nel.cloudflare.com	35.190.80.1	whitelisted
90.100.168.192.in-addr.arpa	—	unknown
www.google.com	142.250.185.164	whitelisted

Threats

PID	Process	Class	Message
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—	—	Not Suspicious Traffic	ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management

Add for printing

No debug info

General Info

https://www.thc.org/ssh-it/

9B2FFE74D4920447B6D8C8F3B42B7B49

F05BC11BB9AEBFD01D16295250BEB08DF176496D

F26F705736C0491D23EA3D4FFE6AB742C85A65C2967D4F23856E250D961EE43A

3:N8DSLSLWcMsn:2OLWfn

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Executes the "rm" command to delete files or directories

Changes time attribute to hide new files or make changes to the existing one

Reads information about logins, logouts, and login attempts

Creates or rewrites file in the "bin" folder

Creates shell script file

Checks the user who created the process

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings