File name:

_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a.sh

Full analysis: https://app.any.run/tasks/1a443094-4802-40f2-9ce2-b2ca45acd251
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: April 03, 2026, 23:55:26
OS: Ubuntu 22.04.2
Tags:
github
xmrig
miner
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

2A1D315282822CEB549D9B076F6096E1

SHA1:

AFB586F2D8DC8798624A3D7997F5333DB35167DF

SHA256:

0D63CCA52A1F18A4D1461E49739AABB46E28EF8D2E50F4E80404088E2BA6343A

SSDEEP:

48:inOx1T70gMP1P4Uo4UlDlCJH/M18lBJQTYXLpIbZt:SS17q1QUHUIH/e8l4TYX90Zt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XMRIG loader has been detected

      • bash (PID: 1903)

  • SUSPICIOUS

    • Uses wget to download content

      • bash (PID: 1903)

    • Gets information about currently running processes

      • bash (PID: 1903)

    • Modifies file or directory owner

      • sudo (PID: 1898)

    • Reads passwd file

      • tar (PID: 1940)

    • Create hidden file

      • tee (PID: 1952)

    • Writes to Systemd service files (likely for persistence achievement)

      • sudo (PID: 1946)
      • systemd (PID: 1981)
      • systemd (PID: 1909)
      • systemd (PID: 1957)

    • Checks type of computer hardware (uname)

      • bash (PID: 1903)

    • Modifies bash configuration script

      • tee (PID: 1952)

    • Checks DMI information (probably VM detection)

      • kworker-u4-2 (PID: 2003)

  • INFO

    • Checks timezone

      • wget (PID: 1938)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
228
Monitored processes
107
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs sudo no specs systemctl no specs systemd no specs snapd-env-generator no specs systemd no specs dash no specs generate no specs dash no specs snapd-generator no specs cat no specs systemd-bless-boot-generator no specs systemd-cryptsetup-generator no specs mkdir no specs systemd-debug-generator no specs systemd-fstab-generator no specs systemd-getty-generator no specs systemd-gpt-auto-generator no specs systemd-hibernate-resume-generator no specs systemd-rc-local-generator no specs systemd-run-generator no specs systemd-system-update-generator no specs systemd-sysv-generator no specs systemd-veritysetup-generator no specs ls no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs pgrep no specs uname no specs sudo no specs mkdir no specs wget sudo no specs tar no specs tar no specs gzip no specs sudo no specs mv no specs cat no specs sudo no specs tee no specs sudo no specs grep no specs bash no specs sudo no specs tee no specs sudo no specs systemctl no specs systemd no specs systemd no specs snapd-env-generator no specs dash no specs generate no specs dash no specs snapd-generator no specs systemd-bless-boot-generator no specs systemd-cryptsetup-generator no specs systemd-debug-generator no specs systemd-fstab-generator no specs systemd-getty-generator no specs systemd-gpt-auto-generator no specs systemd-hibernate-resume-generator no specs systemd-rc-local-generator no specs systemd-run-generator no specs systemd-system-update-generator no specs systemd-sysv-generator no specs systemd-veritysetup-generator no specs cat no specs mkdir no specs ls no specs sudo no specs systemctl no specs systemd no specs systemd no specs snapd-env-generator no specs dash no specs generate no specs dash no specs snapd-generator no specs systemd-bless-boot-generator no specs systemd-cryptsetup-generator no specs systemd-debug-generator no specs cat no specs mkdir no specs ls no specs systemd-fstab-generator no specs systemd-getty-generator no specs systemd-gpt-auto-generator no specs systemd-hibernate-resume-generator no specs systemd-rc-local-generator no specs systemd-run-generator no specs systemd-system-update-generator no specs systemd-sysv-generator no specs systemd-veritysetup-generator no specs sudo no specs systemctl no specs kworker-u4-2 systemd-timedated no specs

Process information

PID
CMD
Path
Indicators
Parent process
1897/bin/sh -c "sudo chown user /home/user/Desktop/_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a\.sh && chmod +x /home/user/Desktop/_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a\.sh "/usr/bin/dash—ClU101gqD6apx7CA
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1898sudo chown user /home/user/Desktop/_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
1899chown user /home/user/Desktop/_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1900chmod +x /home/user/Desktop/_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1901sudo -iu user /home/user/Desktop/_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
1903/bin/bash /home/user/Desktop/_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
1904/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1905sudo systemctl unmask apt-security-update.service/usr/bin/sudo—bash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
1906systemctl unmask apt-security-update.service/usr/bin/systemctl—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
/usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1
1907/sbin/init splash/usr/lib/systemd/systemd—systemd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1940tar/usr/share/apt-cache/SHA256SUMStext
MD5:—
SHA256:—
1940tar/usr/share/apt-cache/config.jsontext
MD5:—
SHA256:—
1938wget/home/user/.wget-hststext
MD5:—
SHA256:—
1940tar/usr/share/apt-cache/xmrigbinary
MD5:—
SHA256:—
1947tee/etc/systemd/system/apt-security-update.servicetext
MD5:—
SHA256:—
1952tee/root/.bashrctext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
20
DNS requests
22
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1938
wget
GET
302
140.82.121.4:443
https://github.com/xmrig/xmrig/releases/download/v6.26.0/xmrig-6.26.0-linux-static-x64.tar.gz
US
—
—
whitelisted
—
—
GET
—
91.189.91.96:80
http://connectivity-check.ubuntu.com/
GB
—
—
whitelisted
—
—
GET
204
91.189.91.96:80
http://connectivity-check.ubuntu.com/
GB
—
—
whitelisted
1938
wget
GET
200
185.199.111.133:443
https://release-assets.githubusercontent.com/github-production-release-asset/88327406/ecfabc02-9e68-4cec-a6d1-a0e7773d900e?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-04-04T00%3A39%3A16Z&rscd=attachment%3B+filename%3Dxmrig-6.26.0-linux-static-x64.tar.gz&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-04-03T23%3A38%3A22Z&ske=2026-04-04T00%3A39%3A16Z&sks=b&skv=2018-11-09&sig=RwFa2qm0KOI7g5DFItpxY44Xpo7BetT3%2FJipYcv2NGg%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc3NTI2MDgzNywibmJmIjoxNzc1MjYwNTM3LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.Om2NdkobpbzgzGShpH_vBFGQRk9CtvULBnkMnSUorGM&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.26.0-linux-static-x64.tar.gz&response-content-type=application%2Foctet-stream
NL
text
3.36 Mb
whitelisted
—
—
GET
—
91.189.91.96:80
http://connectivity-check.ubuntu.com/
GB
—
—
whitelisted
1938
wget
GET
302
140.82.121.4:443
https://github.com/xmrig/xmrig/releases/download/v6.26.0/xmrig-6.26.0-linux-static-x64.tar.gz
US
—
—
—
1938
wget
GET
200
185.199.111.133:443
https://release-assets.githubusercontent.com/github-production-release-asset/88327406/ecfabc02-9e68-4cec-a6d1-a0e7773d900e?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-04-04T00%3A39%3A16Z&rscd=attachment%3B+filename%3Dxmrig-6.26.0-linux-static-x64.tar.gz&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-04-03T23%3A38%3A22Z&ske=2026-04-04T00%3A39%3A16Z&sks=b&skv=2018-11-09&sig=RwFa2qm0KOI7g5DFItpxY44Xpo7BetT3%2FJipYcv2NGg%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc3NTI2MDgzNywibmJmIjoxNzc1MjYwNTM3LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.Om2NdkobpbzgzGShpH_vBFGQRk9CtvULBnkMnSUorGM&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.26.0-linux-static-x64.tar.gz&response-content-type=application%2Foctet-stream
US
text
3.36 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
91.189.91.96:80
connectivity-check.ubuntu.com
CANONICAL-AS
GB
whitelisted
459
avahi-daemon
224.0.0.251:5353
—
—
—
whitelisted
1938
wget
140.82.121.4:443
github.com
GITHUB
US
whitelisted
1938
wget
185.199.111.133:443
release-assets.githubusercontent.com
FASTLY
US
whitelisted
2003
kworker-u4-2
161.35.34.195:3333
rx.unmineable.com
DIGITALOCEAN-ASN
US
suspicious
424
systemd-timesyncd
185.125.190.57:123
ntp.ubuntu.com
CANONICAL-AS
GB
whitelisted
424
systemd-timesyncd
91.189.91.157:123
ntp.ubuntu.com
CANONICAL-AS
GB
whitelisted
424
systemd-timesyncd
185.125.190.56:123
ntp.ubuntu.com
CANONICAL-AS
GB
whitelisted
424
systemd-timesyncd
185.125.190.58:123
ntp.ubuntu.com
CANONICAL-AS
GB
whitelisted

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 91.189.91.96
  • 185.125.190.101
  • 185.125.190.100
  • 185.125.190.99
  • 91.189.91.98
  • 91.189.91.97
  • 2620:2d:4000:1::1099
  • 2620:2d:4000:1::1100
  • 2620:2d:4002:1::196
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::1101
  • 2620:2d:4002:1::198
whitelisted
google.com
  • 172.217.168.78
  • 2a00:1450:4001:c1f::8b
  • 2a00:1450:4001:c1f::64
  • 2a00:1450:4001:c1f::66
  • 2a00:1450:4001:c1f::71
whitelisted
github.com
  • 140.82.121.4
whitelisted
release-assets.githubusercontent.com
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.110.133
whitelisted
3.100.168.192.in-addr.arpa
  • —
whitelisted
rx.unmineable.com
  • 161.35.34.195
unknown
rx-eu.unmineable.com
  • —
unknown
ntp.ubuntu.com
  • 185.125.190.57
  • 91.189.91.157
  • 185.125.190.56
  • 185.125.190.58
  • 2620:2d:4000:1::3f
  • 2620:2d:4000:1::40
  • 2620:2d:4000:1::41
whitelisted

Threats

PID
Process
Class
Message
422
systemd-resolved
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access release user assets on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a.sh