Find similar analyses in TI Lookup
Analysis date (UTC): 25 February 2025, 01:35Analysis environment: Ubuntu 22.04.2 LTS

poop.sh

MD5:60F9EB9A23741F849155463E874BB783
SHA1:3F08EA1FC5BBCF12967C80A0DD927FF48B3DBEE0
SHA256:05DF307CDB2F2EFD2563E03027BED1BDDCC8B0067A48AF2949E18BB1E39B3B83

Analysis result

Threat level:Malicious activity
Tags:
miraibotnet
Full analysis:Analysis poop.sh (MD5: 60F9EB9A23741F849155463E874BB783) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

  • RpcSecurity.x86 (PID: 40717)

SUSPICIOUS

Potential Corporate Privacy Violation

  • busybox (PID: 40675)
  • busybox (PID: 40670)
  • busybox (PID: 40680)
  • busybox (PID: 40685)
  • busybox (PID: 40699)
  • busybox (PID: 40694)
  • busybox (PID: 40704)
  • busybox (PID: 40714)
  • busybox (PID: 40709)

Executes the "rm" command to delete files or directories

  • bash (PID: 40668)

Executes commands using command-line interpreter

  • sudo (PID: 40666)

Modifies file or directory owner

  • sudo (PID: 40663)

Connects to the server without a host name

  • busybox (PID: 40675)
  • busybox (PID: 40680)
  • busybox (PID: 40690)
  • busybox (PID: 40699)
  • busybox (PID: 40694)
  • busybox (PID: 40685)
  • busybox (PID: 40704)
  • busybox (PID: 40709)
  • busybox (PID: 40714)

Contacting a server suspected of hosting an CnC

  • RpcSecurity.x86 (PID: 40717)

Connects to unusual port

  • RpcSecurity.x86 (PID: 40717)

INFO

No info indicators.

Threats

PIDProcessClassMessage
40670busyboxPotentially Bad TrafficET INFO ARM File Download Request from IP Address
40670busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
40675busyboxPotentially Bad TrafficET HUNTING Suspicious GET Request for .arm file File
40675busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
40680busyboxPotentially Bad TrafficET HUNTING Suspicious GET Request for .arm file File
40680busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
40685busyboxPotentially Bad TrafficET HUNTING Suspicious GET Request for .arm file File
40685busyboxPotentially Bad TrafficET INFO ARM7 File Download Request from IP Address
40685busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
40694busyboxPotentially Bad TrafficET INFO MIPS File Download Request from IP Address

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED