Malware analysis lucifer Malicious activity | ANY.RUN

Add for printing

File name:	lucifer
Full analysis:	https://app.any.run/tasks/474508db-c79f-4416-9ce4-857b48dfaaa7
Verdict:	Malicious activity
Analysis date:	April 07, 2025, 09:45:07
OS:	Ubuntu 22.04.2
MIME:	application/x-pie-executable
File info:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=bc553ebedd800310589f769500925b843d8f328b, for GNU/Linux 3.2.0, stripped
MD5:	3660298C7B6BA03645EADE2BD0D9BA78
SHA1:	C4F27383CA812D59ED6D110F7F52F8DC7953BAB9
SHA256:	F941E624590490FAA012ACC921D1F5FD97177BD142D9964EF3A8EEB044EACA63
SSDEEP:	768:zSZPgM0cEsU8kM0LLLLLLLLLLLLLLLLR5hJxZBpR5hJxZBpIIIIIIIIIIIIIIN72:zAIQH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - sudo (PID: 39566)
- Modifies file or directory owner
  - sudo (PID: 39563)
- Reads passwd file
  - lucifer.elf (PID: 39567)
- Reads profile file
  - lucifer.elf (PID: 39567)
- Connects to the server without a host name
  - lucifer.elf (PID: 39567)
INFO
- Creates file in the temporary folder
  - lucifer.elf (PID: 39567)
- Checks timezone
  - lucifer.elf (PID: 39567)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Shared object file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

234

Monitored processes

7

Malicious processes

3

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
39562	/bin/sh -c "sudo chown user /home/user/Desktop/lucifer\.elf && chmod +x /home/user/Desktop/lucifer\.elf && DISPLAY=:0 sudo -iu user /home/user/Desktop/lucifer\.elf "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
39563	sudo chown user /home/user/Desktop/lucifer.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39564	chown user /home/user/Desktop/lucifer.elf	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
39565	chmod +x /home/user/Desktop/lucifer.elf	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39566	sudo -iu user /home/user/Desktop/lucifer.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
39567	/home/user/Desktop/lucifer.elf	/home/user/Desktop/lucifer.elf		sudo
User: user Integrity Level: UNKNOWN Exit code: 0
39568	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	lucifer.elf
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

1

Unknown types

0

Dropped files

PID	Process	Filename		Type
39567	lucifer.elf	/tmp/response_logOlSSkP (deleted)		html
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

31

TCP/UDP connections

96

DNS requests

129

Threats

1

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	404	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	404	185.125.190.97:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
39567	lucifer.elf	POST	404	112.6.214.244:80	http://112.6.214.244/	unknown	—	—	malicious
39567	lucifer.elf	POST	404	112.6.214.244:80	http://112.6.214.244/	unknown	—	—	malicious
—	—	GET	404	151.101.65.91:80	http://nmcheck.gnome.org/	unknown	—	—	whitelisted
488	NetworkManager	GET	404	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
39567	lucifer.elf	POST	404	112.6.214.244:80	http://112.6.214.244/	unknown	—	—	malicious
488	NetworkManager	GET	404	91.189.91.97:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
39567	lucifer.elf	POST	404	112.6.214.244:80	http://112.6.214.244/	unknown	—	—	malicious
39567	lucifer.elf	POST	404	112.6.214.244:80	http://112.6.214.244/	unknown	—	—	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	185.125.190.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	91.189.91.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	151.101.65.91:80	nmcheck.gnome.org	FASTLY	US	whitelisted
1178	snap-store	37.19.194.81:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
39567	lucifer.elf	1.6.228.81:443	ekamev.rbi.org.in	Power Grid Corporation of India Limited	IN	whitelisted
39567	lucifer.elf	1.6.197.81:443	ekamev.rbi.org.in	Sify Limited	IN	whitelisted
39567	lucifer.elf	1.6.229.81:443	ekamev.rbi.org.in	TATA Communications formerly VSNL is Leading ISP	IN	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.181.238 2a00:1450:4001:82f::200e	whitelisted
nmcheck.gnome.org	151.101.65.91 151.101.193.91 151.101.1.91 151.101.129.91 2a04:4e42:600::347 2a04:4e42:400::347 2a04:4e42::347 2a04:4e42:200::347	whitelisted
odrs.gnome.org	37.19.194.81 207.211.211.27 195.181.175.41 195.181.170.18 169.150.255.181 169.150.255.184 212.102.56.179 2a02:6ea0:c700::101 2a02:6ea0:c700::11 2a02:6ea0:c700::18 2a02:6ea0:c700::19 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::107	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.55 185.125.188.54 185.125.188.59 2620:2d:4000:1010::344 2620:2d:4000:1010::117 2620:2d:4000:1010::42 2620:2d:4000:1010::6d	whitelisted
ekamev.rbi.org.in	1.6.228.81 1.6.197.81 1.6.229.81	whitelisted
5.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4000:1::23 2620:2d:4002:1::198 2001:67c:1562::24 2620:2d:4002:1::196 2620:2d:4000:1::22 2620:2d:4002:1::197 2001:67c:1562::23 2620:2d:4000:1::2a 2620:2d:4000:1::97 2620:2d:4000:1::96 2620:2d:4000:1::98 2620:2d:4000:1::2b 91.189.91.98 91.189.91.49 185.125.190.49 91.189.91.48 91.189.91.97 185.125.190.98 185.125.190.97 91.189.91.96 185.125.190.48 185.125.190.18 185.125.190.96 185.125.190.17	whitelisted

Threats

PID	Process	Class	Message
39567	lucifer.elf	Misc Attack	ET COMPROMISED Known Compromised or Hostile Host Traffic group 1

Add for printing

No debug info

General Info

lucifer

3660298C7B6BA03645EADE2BD0D9BA78

C4F27383CA812D59ED6D110F7F52F8DC7953BAB9

F941E624590490FAA012ACC921D1F5FD97177BD142D9964EF3A8EEB044EACA63

768:zSZPgM0cEsU8kM0LLLLLLLLLLLLLLLLR5hJxZBpR5hJxZBpIIIIIIIIIIIIIIN72:zAIQH

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Modifies file or directory owner

Reads passwd file

Reads profile file

Connects to the server without a host name

INFO

Creates file in the temporary folder

Checks timezone

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings