Malware analysis wget.sh Malicious activity | ANY.RUN

Add for printing

File name:	wget.sh
Full analysis:	https://app.any.run/tasks/eff8b87d-3a1c-4b58-982d-52b1fc0d78d6
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	June 21, 2025, 17:29:47
OS:	Ubuntu 22.04.2
Tags:	mirai botnet
Indicators:
MIME:	text/plain
File info:	ASCII text
MD5:	2F05F4373E3DA24AD387EA59A76F5706
SHA1:	FB917CCF246A000A6823763A0D0E692ADEC87D54
SHA256:	7F3B5F8D7EB6FBA8A1A9FF8C8177F20ADFF2DAB75CCA40BF38161F6AFD82EF9C
SSDEEP:	24:9cs6v16csEvcsBNIv+csyWAKSqycs2QcslSJl5csvqAcsmZ/x+FcsOc8csmApcsx:9d6v16dEvd2+dyWAxqyd2QdlSX5dvqAg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - wget (PID: 41424)
  - main.x86 (deleted) (PID: 41451)
  - main.x86_64 (deleted) (PID: 41456)
- Application was dropped or rewritten from another process
  - main.x86 (deleted) (PID: 41453)
  - main.x86 (deleted) (PID: 41451)
  - main.x86 (PID: 41450)
  - main.x86_64 (deleted) (PID: 41457)
  - main.x86_64 (deleted) (PID: 41456)
  - main.x86_64 (PID: 41455)
SUSPICIOUS
- Starts itself from another location
  - main.x86_64 (PID: 41455)
  - main.x86 (PID: 41450)
- Modifies file or directory owner
  - sudo (PID: 41388)
- Uses wget to download content
  - bash (PID: 41396)
- Executes commands using command-line interpreter
  - bash (PID: 41396)
  - sudo (PID: 41391)
- Potential Corporate Privacy Violation
  - wget (PID: 41398)
  - wget (PID: 41402)
  - wget (PID: 41412)
  - wget (PID: 41420)
  - wget (PID: 41424)
  - wget (PID: 41430)
  - wget (PID: 41416)
  - wget (PID: 41452)
  - wget (PID: 41439)
  - wget (PID: 41448)
- Connects to the server without a host name
  - wget (PID: 41412)
  - wget (PID: 41402)
  - wget (PID: 41430)
  - wget (PID: 41439)
  - wget (PID: 41436)
  - wget (PID: 41416)
  - wget (PID: 41420)
  - wget (PID: 41424)
  - wget (PID: 41452)
  - wget (PID: 41448)
- Executes the "rm" command to delete files or directories
  - bash (PID: 41396)
- Connects to unusual port
  - main.x86 (deleted) (PID: 41451)
  - main.x86_64 (deleted) (PID: 41456)
- Contacting a server suspected of hosting an CnC
  - main.x86_64 (deleted) (PID: 41456)
  - main.x86 (deleted) (PID: 41451)
INFO
- Checks timezone
  - wget (PID: 41398)
  - wget (PID: 41402)
  - wget (PID: 41412)
  - wget (PID: 41416)
  - wget (PID: 41430)
  - wget (PID: 41436)
  - wget (PID: 41439)
  - wget (PID: 41448)
  - wget (PID: 41420)
  - wget (PID: 41424)
  - wget (PID: 41452)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

201

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

41387

/bin/sh -c "sudo chown user /tmp/wget\.sh && chmod +x /tmp/wget\.sh && DISPLAY=:0 sudo -iu user /tmp/wget\.sh "

/usr/bin/dash

—

UbvyYXL4x2mYa65Q

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41388

sudo chown user /tmp/wget.sh

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

41389

chown user /tmp/wget.sh

/usr/bin/chown

—

sudo

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41390

chmod +x /tmp/wget.sh

/usr/bin/chmod

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41391

sudo -iu user /tmp/wget.sh

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

41392

systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service

/usr/bin/systemctl

—

snapd

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
/usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1

41393

systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service

/usr/bin/systemctl

—

snapd

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
/usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1

41395

systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service

/usr/bin/systemctl

—

snapd

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
/usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1

41396

-bash --login -c \/tmp\/wget\.sh

/usr/bin/bash

—

sudo

User:

user

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6

41397

/usr/bin/locale-check C.UTF-8

/usr/bin/locale-check

—

bash

User:

user

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
41398	wget	/home/user/main.arm		binary
		MD5:—	SHA256:—
41402	wget	/home/user/main.arm5		binary
		MD5:—	SHA256:—
41412	wget	/home/user/main.arm6		binary
		MD5:—	SHA256:—
41416	wget	/home/user/main.arm7		binary
		MD5:—	SHA256:—
41420	wget	/home/user/main.m68k		binary
		MD5:—	SHA256:—
41424	wget	/home/user/main.mips		binary
		MD5:—	SHA256:—
41430	wget	/home/user/main.mpsl		binary
		MD5:—	SHA256:—
41439	wget	/home/user/main.sh4		binary
		MD5:—	SHA256:—
41448	wget	/home/user/main.x86		binary
		MD5:—	SHA256:—
41452	wget	/home/user/main.x86_64 (deleted)		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.98:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	204	91.189.91.98:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
41402	wget	GET	200	103.149.252.178:80	http://103.149.252.178/main.arm5	unknown	—	—	unknown
41398	wget	GET	200	103.149.252.178:80	http://103.149.252.178/main.arm	unknown	—	—	unknown
41416	wget	GET	200	103.149.252.178:80	http://103.149.252.178/main.arm7	unknown	—	—	unknown
41412	wget	GET	200	103.149.252.178:80	http://103.149.252.178/main.arm6	unknown	—	—	unknown
41424	wget	GET	200	103.149.252.178:80	http://103.149.252.178/main.mips	unknown	—	—	unknown
41420	wget	GET	200	103.149.252.178:80	http://103.149.252.178/main.m68k	unknown	—	—	unknown
41436	wget	GET	404	103.149.252.178:80	http://103.149.252.178/main.powerpc	unknown	—	—	unknown
41430	wget	GET	200	103.149.252.178:80	http://103.149.252.178/main.mpsl	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.98:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
1178	snap-store	169.150.255.183:443	odrs.gnome.org	—	GB	whitelisted
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
41398	wget	103.149.252.178:80	voucher.io.vn	VIET DIGITAL TECHNOLOGY LIABILITY COMPANY	VN	unknown
41402	wget	103.149.252.178:80	voucher.io.vn	VIET DIGITAL TECHNOLOGY LIABILITY COMPANY	VN	unknown
41412	wget	103.149.252.178:80	voucher.io.vn	VIET DIGITAL TECHNOLOGY LIABILITY COMPANY	VN	unknown
41416	wget	103.149.252.178:80	voucher.io.vn	VIET DIGITAL TECHNOLOGY LIABILITY COMPANY	VN	unknown
41420	wget	103.149.252.178:80	voucher.io.vn	VIET DIGITAL TECHNOLOGY LIABILITY COMPANY	VN	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	91.189.91.98 91.189.91.97 185.125.190.49 185.125.190.48 185.125.190.96 91.189.91.96 185.125.190.97 185.125.190.98 91.189.91.48 185.125.190.17 185.125.190.18 91.189.91.49 2620:2d:4000:1::97 2620:2d:4002:1::198 2620:2d:4002:1::197 2620:2d:4000:1::98 2620:2d:4000:1::2b 2001:67c:1562::24 2620:2d:4002:1::196 2620:2d:4000:1::2a 2001:67c:1562::23 2620:2d:4000:1::96 2620:2d:4000:1::22 2620:2d:4000:1::23	whitelisted
google.com	142.250.185.238 2a00:1450:4001:813::200e	whitelisted
odrs.gnome.org	169.150.255.183 37.19.194.80 212.102.56.179 169.150.255.181 195.181.175.40 207.211.211.26 195.181.170.19 2a02:6ea0:c700::11 2a02:6ea0:c700::112 2a02:6ea0:c700::18 2a02:6ea0:c700::101 2a02:6ea0:c700::107 2a02:6ea0:c700::21 2a02:6ea0:c700::19	whitelisted
api.snapcraft.io	185.125.188.54 185.125.188.57 185.125.188.59 185.125.188.58 2620:2d:4000:1010::42 2620:2d:4000:1010::2e6 2620:2d:4000:1010::344 2620:2d:4000:1010::117	whitelisted
10.100.168.192.in-addr.arpa	—	unknown
voucher.io.vn	103.149.252.178	unknown

Threats

PID	Process	Class	Message
41398	wget	Potentially Bad Traffic	ET INFO ARM File Download Request from IP Address
41398	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41402	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
41402	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41412	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
41412	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41416	wget	Potentially Bad Traffic	ET INFO ARM7 File Download Request from IP Address
41416	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
41416	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41420	wget	Potentially Bad Traffic	ET INFO m68k File Download Request from IP Address

Add for printing

No debug info

General Info

wget.sh

2F05F4373E3DA24AD387EA59A76F5706

FB917CCF246A000A6823763A0D0E692ADEC87D54

7F3B5F8D7EB6FBA8A1A9FF8C8177F20ADFF2DAB75CCA40BF38161F6AFD82EF9C

24:9cs6v16csEvcsBNIv+csyWAKSqycs2QcslSJl5csvqAcsmZ/x+FcsOc8csmApcsx:9d6v16dEvd2+dyWAxqyd2QdlSX5dvqAg

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

Application was dropped or rewritten from another process

SUSPICIOUS

Starts itself from another location

Modifies file or directory owner

Uses wget to download content

Executes commands using command-line interpreter

Potential Corporate Privacy Violation

Connects to the server without a host name

Executes the "rm" command to delete files or directories

Connects to unusual port

Contacting a server suspected of hosting an CnC

INFO

Checks timezone

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings