download:

/2025/07/22/P4XLO.jpeg

Full analysis: https://app.any.run/tasks/0be923e0-2514-4918-9678-b1bb5d5efae2
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: July 25, 2025, 19:56:40
OS: Ubuntu 22.04.2
Tags:
github
miner
Indicators:
MIME: image/jpeg
File info: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 640x640, components 3
MD5:

65C2498D7393BF1141578F4CEB3F348E

SHA1:

0D418AED57749A1829B7D497EBF44F68272F4E07

SHA256:

F8C6C873E8289EBBD52D3FC5B6552129D7E20F8A3466ACA2D6F1DD2CDD578780

SSDEEP:

6144:wngxqIQ/jyOOqJV9H8cXLiS7JSZlb5Y/iLkiUNH9V9MO:wng8IYJOq/18giOvNH9V9MO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MINER has been detected (SURICATA)

      • cpuMinerTermux (PID: 41684)

    • Application was dropped or rewritten from another process

      • cpuMinerTermux (PID: 41684)

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • gnome-terminal-server (PID: 41437)
      • sudo (PID: 41409)
      • bash (PID: 41455)
      • dash (PID: 41516)
      • timeout (PID: 41628)

    • Check the Environment Variables Related to System Identification (os-release)

      • snap (PID: 41481)
      • curl (PID: 41531)
      • curl (PID: 41646)

    • Creates shell script file

      • dd (PID: 41497)

    • Checks kernel name (uname)

      • bash (PID: 41529)

    • Reads passwd file

      • dumpe2fs (PID: 41555)
      • dumpe2fs (PID: 41554)
      • curl (PID: 41646)
      • curl (PID: 41531)
      • ls (PID: 41770)
      • ps (PID: 41766)
      • ps (PID: 41767)
      • ps (PID: 41744)
      • ls (PID: 41783)

    • Gets information about currently running processes

      • bash (PID: 41529)
      • bash (PID: 41581)

    • Potential Corporate Privacy Violation

      • cpuMinerTermux (PID: 41684)

    • Crypto Currency Mining Activity Detected

      • cpuMinerTermux (PID: 41684)

    • Checks type of computer hardware (uname)

      • bash (PID: 41529)

    • Uses tools that copy files from or to remote systems

      • bash (PID: 41581)

    • Connects to unusual port

      • cpuMinerTermux (PID: 41684)
      • bash (PID: 41630)

    • Modifies bash configuration script

      • bash (PID: 41529)

    • Uses base64 (probably to encode stolen data or decode malicious payload)

      • bash (PID: 41751)
      • bash (PID: 41754)
      • bash (PID: 41757)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 41529)

    • Clears command history

      • bash (PID: 41529)

  • INFO

    • Checks timezone

      • eog (PID: 41410)
      • python3.10 (PID: 41430)
      • python3.10 (PID: 41480)
      • dumpe2fs (PID: 41554)
      • dumpe2fs (PID: 41555)
      • curl (PID: 41646)
      • cpuMinerTermux (PID: 41684)
      • curl (PID: 41531)
      • ps (PID: 41766)
      • ps (PID: 41767)
      • ls (PID: 41770)
      • ps (PID: 41744)
      • ls (PID: 41783)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jpg | JFIF JPEG bitmap (50)
.jpg | JPEG bitmap (37.4)
.mp3 | MP3 audio (12.4)

EXIF

JFIF

JFIFVersion: 1.01
ResolutionUnit: None
XResolution: 1
YResolution: 1

Composite

ImageSize: 640x640
Megapixels: 0.41
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
363
Monitored processes
226
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
dash no specs sudo no specs eog no specs locale-check no specs python3.10 no specs gnome-terminal.real no specs gnome-terminal-server no specs bash no specs dash no specs dircolors no specs basename no specs dash no specs dirname no specs bash no specs bash no specs bash no specs bash no specs file no specs bash no specs bash no specs bash no specs python3.10 no specs snap no specs bash no specs bash no specs dd no specs bash no specs bash no specs file no specs bash no specs bash no specs less no specs dash no specs dash no specs basename no specs dash no specs dash no specs dash no specs tr no specs bash no specs bash no specs bash no specs uname no specs curl snap-seccomp no specs snap-confine no specs dumpe2fs no specs dumpe2fs no specs snap-update-ns no specs apt-get no specs dpkg no specs uname no specs uname no specs grep no specs uname no specs grep no specs uname no specs grep no specs bash no specs whereis no specs wc no specs bash no specs lscpu no specs grep no specs cut no specs mawk no specs nproc no specs bash no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs timeout no specs bash no specs mawk no specs bash no specs mawk no specs bash no specs mawk no specs bash no specs mawk no specs cut no specs bash no specs mawk no specs bash no specs mawk no specs mawk no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs mkdir no specs basename no specs curl bash shuf no specs bash no specs mawk no specs sed no specs snap-seccomp no specs snap-confine no specs snap-confine no specs mv no specs mv no specs touch no specs chmod no specs file no specs bash no specs sleep no specs #MINER cpuminertermux sleep no specs cat no specs ps no specs dmesg no specs grep no specs cpuminertermux no specs ps no specs ps no specs ps no specs ps no specs ps no specs ps no specs bash no specs bash no specs mkdir no specs mount no specs bash no specs cat no specs pgrep no specs bash no specs mawk no specs bash no specs mawk no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs grep no specs pgrep no specs ps no specs grep no specs grep no specs mawk no specs mv no specs rm no specs grep no specs bash no specs bash no specs base64 no specs bash no specs bash no specs chmod no specs clear no specs rm no specs cat no specs grep no specs cat no specs bash no specs base64 no specs bash no specs base64 no specs ps no specs ps no specs bash no specs bash no specs ls no specs bash no specs bash no specs cat no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs bash no specs ls no specs

Process information

PID
CMD
Path
Indicators
Parent process
41408/bin/sh -c "DISPLAY=:0 sudo -iu user eog /home/user/Desktop/P4XLO\.jpeg "/usr/bin/dash—UbvyYXL4x2mYa65Q
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41409sudo -iu user eog /home/user/Desktop/P4XLO.jpeg/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41410eog /home/user/Desktop/P4XLO.jpeg/usr/bin/eog—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/eog/libeog.so
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgtk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libgirepository-1.0.so.1.0.0
/usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4200.8
/usr/lib/x86_64-linux-gnu/libgdk-3.so.0.2404.29
41411/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—eog
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41430/usr/bin/python3 /usr/bin/gnome-terminal/usr/bin/python3.10—gnome-shell
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libm.so.6
/usr/lib/x86_64-linux-gnu/libexpat.so.1.8.7
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/python3/dist-packages/gi/_gi.cpython-310-x86_64-linux-gnu.so
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgirepository-1.0.so.1.0.0
/usr/lib/x86_64-linux-gnu/libffi.so.8.1.0
/usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3
41432/usr/bin/gnome-terminal.real/usr/bin/gnome-terminal.real—python3.10
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libdconf.so.1.0.0
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgtk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libgdk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libx11.so.6.4.0
/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
/usr/lib/x86_64-linux-gnu/libvte-2.91.so.0.6800.0
/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30
41437/usr/libexec/gnome-terminal-server/usr/libexec/gnome-terminal-server—systemd
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libdconf.so.1.0.0
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgtk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libgdk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libpango-1.0.so.0.5000.6
/usr/lib/x86_64-linux-gnu/libcairo.so.2.11600.0
/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
/usr/lib/x86_64-linux-gnu/libvte-2.91.so.0.6800.0
41455bash/usr/bin/bash—gnome-terminal-server
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
41456/bin/sh /usr/bin/lesspipe/usr/bin/dash—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41457basename /usr/bin/lesspipe/usr/bin/basename—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
Executable files
0
Suspicious files
0
Text files
27
Unknown types
1

Dropped files

PID
Process
Filename
Type
41410eog/home/user/.cache/thumbnails/normal/695ae0065f5ae46fba0a275a1711af44.pngimage
MD5:—
SHA256:—
41410eog/home/user/.local/share/recently-used.xbelxml
MD5:—
SHA256:—
41497dd/home/user/Desktop/panda-v14.shtext
MD5:—
SHA256:—
41515less/home/user/.lesshsQtext
MD5:—
SHA256:—
41569apt-get/tmp/#6029335 (deleted)text
MD5:—
SHA256:—
41569apt-get/tmp/#6029338 (deleted)text
MD5:—
SHA256:—
41569apt-get/tmp/#6029339 (deleted)text
MD5:—
SHA256:—
41569apt-get/tmp/#6029359 (deleted)text
MD5:—
SHA256:—
41569apt-get/tmp/#6029358 (deleted)text
MD5:—
SHA256:—
41569apt-get/tmp/#6029364 (deleted)text
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
15
DNS requests
21
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
91.189.91.97:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
37.19.194.80:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
—
—
185.125.190.98:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
41531
curl
140.82.121.4:443
github.com
GITHUB
US
whitelisted
41630
bash
51.79.215.200:7022
stratum-asia.rplant.xyz
OVH SAS
SG
unknown
41646
curl
140.82.121.4:443
github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 91.189.91.97
  • 91.189.91.96
  • 185.125.190.98
  • 185.125.190.49
  • 91.189.91.98
  • 185.125.190.48
  • 185.125.190.96
  • 185.125.190.97
  • 185.125.190.18
  • 91.189.91.49
  • 91.189.91.48
  • 185.125.190.17
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::23
  • 2001:67c:1562::24
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::96
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::2b
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::98
  • 2001:67c:1562::23
whitelisted
google.com
  • 142.250.186.46
  • 2a00:1450:4001:827::200e
whitelisted
odrs.gnome.org
  • 37.19.194.80
  • 195.181.170.19
  • 195.181.175.41
  • 169.150.255.181
  • 212.102.56.179
  • 207.211.211.27
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::19
whitelisted
api.snapcraft.io
  • 185.125.188.59
  • 185.125.188.54
  • 185.125.188.58
  • 185.125.188.57
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::2e6
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::42
whitelisted
12.100.168.192.in-addr.arpa
  • —
unknown
github.com
  • 140.82.121.4
whitelisted
stratum-asia.rplant.xyz
  • 51.79.215.200
unknown
release-assets.githubusercontent.com
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.110.133
unknown

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access release user assets on GitHub
—
—
Potential Corporate Privacy Violation
AV POLICY NiceHash Miner Subscribing To Pool
—
—
Crypto Currency Mining Activity Detected
ET COINMINER W32/BitCoinMiner.MultiThreat Subscribe/Authorize Stratum Protocol Message
—
—
Crypto Currency Mining Activity Detected
ET COINMINER W32/BitCoinMiner.MultiThreat Subscribe/Authorize Stratum Protocol Message
—
—
Potential Corporate Privacy Violation
AV POLICY NiceHash Miner Subscribing To Pool
—
—
Crypto Currency Mining Activity Detected
ET COINMINER W32/BitCoinMiner.MultiThreat Subscribe/Authorize Stratum Protocol Message
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/2025/07/22/P4XLO.jpeg