Malware analysis hidakibest.sh Malicious activity | ANY.RUN

Add for printing

File name:	hidakibest.sh
Full analysis:	https://app.any.run/tasks/9003a724-5e32-4fde-8cb0-4e7862af92cd
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	February 25, 2025, 18:20:48
OS:	Ubuntu 22.04.2 LTS
Tags:	mirai botnet opendir
Indicators:
MIME:	text/plain
File info:	ASCII text
MD5:	E6E23796AEF7F3471F0BB8A233C5CEC5
SHA1:	0B287815A3DF4A8C394EB2351FD9D99CF07DF4DB
SHA256:	F9088F7148CBAECC27CF50B03B24DB448DCED3FAA3CE31961BA5300E95B8D7BF
SSDEEP:	12:GHvjvGpzpZSuVoNanacaJvnT/RPMLZM/Q92aMapaSs3NITnec4Klq:TLVA49W76yoQNIrGKk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - wget (PID: 40662)
SUSPICIOUS
- Executes commands using command-line interpreter
  - sudo (PID: 40656)
- Modifies file or directory owner
  - sudo (PID: 40653)
- Potential Corporate Privacy Violation
  - wget (PID: 40680)
  - wget (PID: 40668)
  - wget (PID: 40693)
  - wget (PID: 40674)
  - wget (PID: 40706)
  - wget (PID: 40700)
  - wget (PID: 40662)
  - wget (PID: 40686)
  - wget (PID: 40713)
- Executes the "rm" command to delete files or directories
  - bash (PID: 40657)
- Gets information about currently running processes
  - bash (PID: 40657)
- Uses wget to download content
  - bash (PID: 40657)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

285

Monitored processes

65

Malicious processes

3

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
40652	/bin/sh -c "sudo chown user /tmp/hidakibest\.sh && chmod +x /tmp/hidakibest\.sh && DISPLAY=:0 sudo -iu user /tmp/hidakibest\.sh "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
40653	sudo chown user /tmp/hidakibest.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40654	chown user /tmp/hidakibest.sh	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
40655	chmod +x /tmp/hidakibest.sh	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40656	sudo -iu user /tmp/hidakibest.sh	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40657	-bash --login -c \/tmp\/hidakibest\.sh	/usr/bin/bash	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
40658	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	bash
User: user Integrity Level: UNKNOWN Exit code: 0
40659	-bash --login -c \/tmp\/hidakibest\.sh	/usr/bin/bash	—	bash
User: user Integrity Level: UNKNOWN Exit code: 32512
40660	-bash --login -c \/tmp\/hidakibest\.sh	/usr/bin/bash	—	bash
User: user Integrity Level: UNKNOWN Exit code: 32512
40661	pkill - 9 hidakibest.mips	/usr/bin/pgrep	—	bash
User: user Integrity Level: UNKNOWN Exit code: 512

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

10

TCP/UDP connections

19

DNS requests

12

Threats

20

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted
40668	wget	GET	—	95.164.52.33:80	http://95.164.52.33/hidakibest.mpsl	unknown	—	—	unknown
40662	wget	GET	—	95.164.52.33:80	http://95.164.52.33/hidakibest.mips	unknown	—	—	unknown
40686	wget	GET	—	95.164.52.33:80	http://95.164.52.33/hidakibest.sparc	unknown	—	—	unknown
40693	wget	GET	—	95.164.52.33:80	http://95.164.52.33/hidakibest.arm4	unknown	—	—	unknown
40713	wget	GET	—	95.164.52.33:80	http://95.164.52.33/hidakibest.arm7	unknown	—	—	unknown
40700	wget	GET	—	95.164.52.33:80	http://95.164.52.33/hidakibest.arm5	unknown	—	—	unknown
40706	wget	GET	—	95.164.52.33:80	http://95.164.52.33/hidakibest.arm6	unknown	—	—	unknown
40674	wget	GET	—	95.164.52.33:80	http://95.164.52.33/hidakibest.x86	unknown	—	—	unknown
40680	wget	GET	—	95.164.52.33:80	http://95.164.52.33/hidakibest.ppc	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	195.181.175.41:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
40662	wget	95.164.52.33:80	—	NetAssist LLC	UA	unknown
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
40668	wget	95.164.52.33:80	—	NetAssist LLC	UA	unknown
40674	wget	95.164.52.33:80	—	NetAssist LLC	UA	unknown
40680	wget	95.164.52.33:80	—	NetAssist LLC	UA	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2620:2d:4000:1::2a 2620:2d:4000:1::2b 2620:2d:4000:1::23 2620:2d:4002:1::198 2620:2d:4002:1::197 2001:67c:1562::24 2620:2d:4000:1::22 2620:2d:4000:1::98 2001:67c:1562::23 2620:2d:4000:1::96 2620:2d:4002:1::196 2620:2d:4000:1::97 91.189.91.96 185.125.190.96 185.125.190.17 185.125.190.97 91.189.91.97 91.189.91.98 185.125.190.48 185.125.190.18 91.189.91.48 185.125.190.98 91.189.91.49 185.125.190.49	whitelisted
google.com	142.250.181.238 2a00:1450:4001:82f::200e	whitelisted
odrs.gnome.org	195.181.175.41 207.211.211.26 169.150.255.184 195.181.170.18 37.19.194.80 169.150.255.180 212.102.56.179 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::18 2a02:6ea0:c700::19 2a02:6ea0:c700::101 2a02:6ea0:c700::107 2a02:6ea0:c700::11	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.59 185.125.188.55 185.125.188.54 2620:2d:4000:1010::42 2620:2d:4000:1010::117 2620:2d:4000:1010::6d 2620:2d:4000:1010::344	whitelisted
196.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
40662	wget	A Network Trojan was detected	AV INFO Possible Mirai .mips Executable Download
40662	wget	Potentially Bad Traffic	ET INFO MIPS File Download Request from IP Address
40674	wget	Potentially Bad Traffic	ET INFO x86 File Download Request from IP Address
40674	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .x86
40680	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .ppc File
40693	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
40686	wget	Potentially Bad Traffic	ET INFO SPARC File Download Request from IP Address
40700	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
40713	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File
40706	wget	Potentially Bad Traffic	ET HUNTING Suspicious GET Request for .arm file File

Add for printing

No debug info

General Info

hidakibest.sh

E6E23796AEF7F3471F0BB8A233C5CEC5

0B287815A3DF4A8C394EB2351FD9D99CF07DF4DB

F9088F7148CBAECC27CF50B03B24DB448DCED3FAA3CE31961BA5300E95B8D7BF

12:GHvjvGpzpZSuVoNanacaJvnT/RPMLZM/Q92aMapaSs3NITnec4Klq:TLVA49W76yoQNIrGKk

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

SUSPICIOUS

Executes commands using command-line interpreter

Modifies file or directory owner

Potential Corporate Privacy Violation

Executes the "rm" command to delete files or directories

Gets information about currently running processes

Uses wget to download content

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings