Find similar analyses in TI Lookup
Analysis date (UTC): 4 April 2025, 20:07Analysis environment: Ubuntu 22.04.2

/and

MD5:F5D0486980C03EB547C154DAF9276458
SHA1:1A0B453A6EE18AE90A75D859C6DFD935BA5BDF61
SHA256:52416BD2866FD5BFF683577CD1BAFD19CA179FD9B4366A7F0A478912B35ADEC8

Analysis result

Threat level:Malicious activity
Tags:
miraibotnetmoobot
Full analysis:Analysis /and (MD5: F5D0486980C03EB547C154DAF9276458) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

  • most-x86 (PID: 39592)

SUSPICIOUS

Reads passwd file

  • su (PID: 39515)
  • su (PID: 39516)
  • su (PID: 39518)
  • su (PID: 39521)
  • su (PID: 39517)
  • su (PID: 39519)
  • su (PID: 39523)
  • su (PID: 39616)
  • su (PID: 39603)
  • su (PID: 39600)
  • su (PID: 39601)
  • su (PID: 39604)
  • su (PID: 39610)
  • su (PID: 39606)
  • su (PID: 39609)
  • su (PID: 39615)
  • su (PID: 39612)
  • su (PID: 39613)
  • su (PID: 39618)
  • su (PID: 39619)
  • su (PID: 39624)
  • su (PID: 39621)
  • su (PID: 39627)
  • su (PID: 39628)
  • su (PID: 39625)
  • su (PID: 39631)
  • su (PID: 39630)
  • su (PID: 39633)

Modifies file or directory owner

  • sudo (PID: 39503)

Executes commands using command-line interpreter

  • sudo (PID: 39506)

Gets information about currently running processes

  • bash (PID: 39508)

Potential Corporate Privacy Violation

  • busybox (PID: 39532)
  • busybox (PID: 39541)
  • busybox (PID: 39560)
  • busybox (PID: 39556)
  • busybox (PID: 39537)
  • busybox (PID: 39564)
  • busybox (PID: 39569)
  • busybox (PID: 39582)
  • busybox (PID: 39589)

Connects to the server without a host name

  • busybox (PID: 39532)
  • busybox (PID: 39541)
  • busybox (PID: 39537)
  • busybox (PID: 39556)
  • busybox (PID: 39560)
  • busybox (PID: 39564)
  • busybox (PID: 39579)
  • busybox (PID: 39569)
  • busybox (PID: 39582)
  • busybox (PID: 39589)
  • busybox (PID: 39586)

Executes the "rm" command to delete files or directories

  • bash (PID: 39508)

Connects to unusual port

  • most-x86 (PID: 39592)

Contacting a server suspected of hosting an CnC

  • most-x86 (PID: 39592)

INFO

No info indicators.

Threats

PIDProcessClassMessage
39532busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
39537busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
39541busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
39556busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
39560busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
39564busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
39569busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
39582busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
39592most-x86Potentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.ooguy .com Domain
39589busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED