Malware analysis nigganet.sh Malicious activity | ANY.RUN

Add for printing

File name:	nigganet.sh
Full analysis:	https://app.any.run/tasks/82d58d57-5064-464c-b6f7-9e36bf47aeed
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	April 28, 2025, 15:13:34
OS:	Ubuntu 22.04.2
Tags:	mirai botnet
Indicators:
MIME:	text/x-shellscript
File info:	Bourne-Again shell script, ASCII text executable
MD5:	8177AF298E73DA8D68302A598AA2B6CB
SHA1:	D42177610207CDE5522990F4718E59D875552F6C
SHA256:	E317D159E6275AA73BBD30892108D0D28075F42857C066AC44FAC2764C1A495D
SSDEEP:	12:JCkp0FEv+Cr0FEVI+VfhW0FEYi+YE60FEX2+XnW0FEc+q0FEg+Qr0FEfONi+fONZ:ItF+Df/UBnDIAcadaTo1g1l2SyGv/NjZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - wget (PID: 40712)
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 40660)
- Executes commands using command-line interpreter
  - sudo (PID: 40663)
- Reads passwd file
  - dumpe2fs (PID: 40702)
  - dumpe2fs (PID: 40693)
  - curl (PID: 40672)
  - curl (PID: 40777)
  - curl (PID: 40714)
  - curl (PID: 40746)
  - curl (PID: 40838)
  - curl (PID: 40807)
  - curl (PID: 40898)
  - curl (PID: 40868)
  - curl (PID: 40958)
  - curl (PID: 40988)
  - curl (PID: 40928)
  - curl (PID: 41018)
  - curl (PID: 41048)
  - curl (PID: 41110)
  - curl (PID: 41079)
- Check the Environment Variables Related to System Identification (os-release)
  - curl (PID: 40672)
  - curl (PID: 40714)
  - curl (PID: 40746)
  - curl (PID: 40777)
  - curl (PID: 40838)
  - curl (PID: 40868)
  - curl (PID: 40807)
  - curl (PID: 40898)
  - curl (PID: 40928)
  - curl (PID: 40988)
  - curl (PID: 40958)
  - curl (PID: 41018)
  - curl (PID: 41048)
  - curl (PID: 41110)
  - curl (PID: 41079)
- Reads /proc/mounts (likely used to find writable filesystems)
  - curl (PID: 40746)
  - curl (PID: 40777)
  - curl (PID: 40714)
  - curl (PID: 40807)
  - curl (PID: 40838)
  - curl (PID: 40898)
  - curl (PID: 40928)
  - curl (PID: 40868)
  - curl (PID: 40958)
  - curl (PID: 40988)
  - curl (PID: 41048)
  - curl (PID: 41018)
  - curl (PID: 41110)
  - curl (PID: 41079)
- Uses wget to download content
  - bash (PID: 40667)
- Potential Corporate Privacy Violation
  - wget (PID: 40670)
  - curl (PID: 40672)
  - wget (PID: 40712)
  - curl (PID: 40714)
  - curl (PID: 40898)
  - wget (PID: 40897)
  - curl (PID: 40868)
  - wget (PID: 40927)
  - wget (PID: 40867)
  - wget (PID: 40986)
  - wget (PID: 40957)
  - curl (PID: 40958)
  - wget (PID: 41017)
  - curl (PID: 40988)
  - curl (PID: 41018)
  - curl (PID: 41048)
  - wget (PID: 41047)
  - wget (PID: 41077)
  - curl (PID: 41079)
  - wget (PID: 41108)
  - curl (PID: 41110)
  - curl (PID: 40928)
- Connects to the server without a host name
  - wget (PID: 40670)
  - curl (PID: 40714)
  - wget (PID: 40745)
  - curl (PID: 40988)
  - curl (PID: 41018)
  - wget (PID: 41017)
  - curl (PID: 41048)
  - curl (PID: 41079)
  - wget (PID: 41077)
  - wget (PID: 41108)
  - curl (PID: 41110)
INFO
- Checks timezone
  - wget (PID: 40670)
  - dumpe2fs (PID: 40702)
  - dumpe2fs (PID: 40693)
  - wget (PID: 40712)
  - wget (PID: 40776)
  - wget (PID: 40745)
  - wget (PID: 40837)
  - wget (PID: 40867)
  - wget (PID: 40806)
  - wget (PID: 40927)
  - wget (PID: 40897)
  - wget (PID: 40986)
  - wget (PID: 40957)
  - wget (PID: 41047)
  - wget (PID: 41017)
  - wget (PID: 41108)
  - wget (PID: 41077)
- Creates file in the temporary folder
  - wget (PID: 40670)
  - cp (PID: 40669)
  - curl (PID: 40672)
  - wget (PID: 40712)
  - cat (PID: 40707)
  - curl (PID: 40746)
  - curl (PID: 40777)
  - bash (PID: 40770)
  - bash (PID: 40800)
  - curl (PID: 40714)
  - bash (PID: 40739)
  - curl (PID: 40807)
  - curl (PID: 40838)
  - bash (PID: 40861)
  - wget (PID: 40867)
  - bash (PID: 40831)
  - wget (PID: 40897)
  - curl (PID: 40898)
  - bash (PID: 40921)
  - wget (PID: 40927)
  - curl (PID: 40928)
  - curl (PID: 40868)
  - bash (PID: 40891)
  - curl (PID: 40958)
  - bash (PID: 40981)
  - wget (PID: 40986)
  - bash (PID: 40951)
  - wget (PID: 40957)
  - wget (PID: 41017)
  - wget (PID: 41047)
  - bash (PID: 41041)
  - curl (PID: 41018)
  - curl (PID: 40988)
  - bash (PID: 41011)
  - curl (PID: 41048)
  - bash (PID: 41134)
  - wget (PID: 41108)
  - curl (PID: 41110)
  - curl (PID: 41079)
  - bash (PID: 41103)
  - wget (PID: 41077)
  - bash (PID: 41072)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.sh	\|	Linux/UNIX shell script (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

400

Monitored processes

179

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
40659	/bin/sh -c "sudo chown user /tmp/nigganet\.sh && chmod +x /tmp/nigganet\.sh && DISPLAY=:0 sudo -iu user /tmp/nigganet\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
40660	sudo chown user /tmp/nigganet.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40661	chown user /tmp/nigganet.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
40662	chmod +x /tmp/nigganet.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40663	sudo -iu user /tmp/nigganet.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40664	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
40665	systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service	/usr/bin/systemctl	—	snapd
User: root Integrity Level: UNKNOWN Exit code: 0
40667	/bin/bash /tmp/nigganet.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
40668	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
40669	cp /bin/busybox /tmp/	/usr/bin/cp	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
40669	cp	/tmp/busybox		binary
		MD5:—	SHA256:—
40670	wget	/tmp/nigga.x86		binary
		MD5:—	SHA256:—
40707	cat	/tmp/WTF		binary
		MD5:—	SHA256:—
40712	wget	/tmp/nigga.mips		binary
		MD5:—	SHA256:—
40867	wget	/tmp/nigga.mpsl		binary
		MD5:—	SHA256:—
40897	wget	/tmp/nigga.arm		binary
		MD5:—	SHA256:—
40927	wget	/tmp/nigga.arm5		binary
		MD5:—	SHA256:—
40957	wget	/tmp/nigga.arm6		binary
		MD5:—	SHA256:—
40986	wget	/tmp/nigga.arm7		binary
		MD5:—	SHA256:—
41017	wget	/tmp/nigga.ppc		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.97:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
—	—	GET	204	91.189.91.97:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
40670	wget	GET	200	87.121.79.109:80	http://87.121.79.109/niggabin/nigga.x86	unknown	—	—	unknown
40672	curl	GET	200	87.121.79.109:80	http://87.121.79.109/niggabin/nigga.x86	unknown	—	—	unknown
40712	wget	GET	200	87.121.79.109:80	http://87.121.79.109/niggabin/nigga.mips	unknown	—	—	unknown
40714	curl	GET	200	87.121.79.109:80	http://87.121.79.109/niggabin/nigga.mips	unknown	—	—	unknown
40745	wget	GET	404	87.121.79.109:80	http://87.121.79.109/niggabin/nigga.arc	unknown	—	—	unknown
40746	curl	GET	404	87.121.79.109:80	http://87.121.79.109/niggabin/nigga.arc	unknown	—	—	unknown
40776	wget	GET	404	87.121.79.109:80	http://87.121.79.109/niggabin/nigga.i468	unknown	—	—	unknown
40777	curl	GET	404	87.121.79.109:80	http://87.121.79.109/niggabin/nigga.i468	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
—	—	212.102.56.178:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
40670	wget	87.121.79.109:80	—	Neterra Ltd.	BG	unknown
40672	curl	87.121.79.109:80	—	Neterra Ltd.	BG	unknown
40711	WTF	87.121.79.109:443	—	Neterra Ltd.	BG	unknown
40712	wget	87.121.79.109:80	—	Neterra Ltd.	BG	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	91.189.91.97 185.125.190.98 185.125.190.48 185.125.190.96 91.189.91.96 185.125.190.97 91.189.91.49 185.125.190.49 185.125.190.17 91.189.91.48 185.125.190.18 91.189.91.98 2620:2d:4002:1::196 2620:2d:4002:1::198 2620:2d:4000:1::97 2001:67c:1562::24 2620:2d:4000:1::2b 2620:2d:4000:1::2a 2620:2d:4002:1::197 2620:2d:4000:1::96 2620:2d:4000:1::22 2001:67c:1562::23 2620:2d:4000:1::23 2620:2d:4000:1::98	whitelisted
google.com	142.250.186.110 2a00:1450:4001:829::200e	whitelisted
odrs.gnome.org	212.102.56.178 169.150.255.183 169.150.255.181 37.19.194.81 195.181.175.40 207.211.211.27 195.181.170.18 2a02:6ea0:c700::107 2a02:6ea0:c700::18 2a02:6ea0:c700::11 2a02:6ea0:c700::19 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::101	whitelisted
api.snapcraft.io	185.125.188.59 185.125.188.58 185.125.188.54 185.125.188.55 2620:2d:4000:1010::6d 2620:2d:4000:1010::117 2620:2d:4000:1010::42 2620:2d:4000:1010::344	whitelisted
14.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
40670	wget	Potentially Bad Traffic	ET INFO x86 File Download Request from IP Address
40670	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .x86
40670	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40672	curl	Potentially Bad Traffic	ET INFO x86 File Download Request from IP Address
40672	curl	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .x86
40672	curl	Potentially Bad Traffic	ET HUNTING curl User-Agent to Dotted Quad
40745	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arc File
40712	wget	A Network Trojan was detected	AV INFO Possible Mirai .mips Executable Download
40672	curl	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
40712	wget	Potentially Bad Traffic	ET INFO MIPS File Download Request from IP Address

Add for printing

No debug info

General Info

nigganet.sh

8177AF298E73DA8D68302A598AA2B6CB

D42177610207CDE5522990F4718E59D875552F6C

E317D159E6275AA73BBD30892108D0D28075F42857C066AC44FAC2764C1A495D

12:JCkp0FEv+Cr0FEVI+VfhW0FEYi+YE60FEX2+XnW0FEc+q0FEg+Qr0FEfONi+fONZ:ItF+Df/UBnDIAcadaTo1g1l2SyGv/NjZ

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Reads passwd file

Check the Environment Variables Related to System Identification (os-release)

Reads /proc/mounts (likely used to find writable filesystems)

Uses wget to download content

Potential Corporate Privacy Violation

Connects to the server without a host name

INFO

Checks timezone

Creates file in the temporary folder

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings