Find similar analyses in TI Lookup
Analysis date (UTC): 1 January 2026, 07:58Analysis environment: Ubuntu 22.04.2

px86

MD5:285428AD78AD81335AE73E3DED243340
SHA1:2A13D4B6831C64038483DFCDFBB800F945E7D0C1
SHA256:8FD4AF07431AD9132F52CC11F2BEDCAA13059FE45C50D0262399F17A5FB28954

Analysis result

Threat level:Malicious activity
Tags:
miraibotnet
Full analysis:Analysis px86 (MD5: 285428AD78AD81335AE73E3DED243340) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

  • px86.elf (deleted) (PID: 1862)

SUSPICIOUS

Reads passwd file

  • crontab (PID: 1865)
  • crontab (PID: 1876)
  • crontab (PID: 1881)
  • crontab (PID: 1879)
  • crontab (PID: 1878)
  • crontab (PID: 1866)
  • crontab (PID: 1880)
  • crontab (PID: 1877)

Modifies file or directory owner

  • sudo (PID: 1856)

Starts itself from another location

  • px86.elf (PID: 1860)

Modifies Cron jobs

  • px86.elf (deleted) (PID: 1869)
  • px86.elf (deleted) (PID: 1863)
  • px86.elf (deleted) (PID: 1871)
  • px86.elf (deleted) (PID: 1872)

Contacting a server suspected of hosting an CnC

  • px86.elf (deleted) (PID: 1862)

Connects to unusual port

  • px86.elf (deleted) (PID: 1862)

INFO

Checks timezone

  • crontab (PID: 1866)
  • crontab (PID: 1865)
  • crontab (PID: 1878)
  • crontab (PID: 1877)
  • crontab (PID: 1881)
  • crontab (PID: 1880)
  • crontab (PID: 1879)
  • crontab (PID: 1876)

Creates file in the temporary folder

  • dash (PID: 1925)
  • dash (PID: 1889)
  • dash (PID: 1887)
  • dash (PID: 1888)
  • dash (PID: 1909)
  • dash (PID: 1908)
  • dash (PID: 1910)
  • dash (PID: 1926)
  • dash (PID: 1924)

Threats

PIDProcessClassMessage
1862px86.elf (deleted)Misc activityINFO [ANY.RUN] Connection to IP from commonly abused ASN (AS214943 RAILNET)
1862px86.elf (deleted)Malware Command and Control Activity DetectedBOTNET [ANY.RUN] Linux/Mirai.B Client Hello
1862px86.elf (deleted)Malware Command and Control Activity DetectedBOTNET [ANY.RUN] Linux/Mirai.B Client Hello
1862px86.elf (deleted)Malware Command and Control Activity DetectedBOTNET [ANY.RUN] Linux/Mirai.Gen heartbeat packet outbound
1862px86.elf (deleted)Malware Command and Control Activity DetectedBOTNET [ANY.RUN] Linux/Mirai.Gen heartbeat packet outbound
1862px86.elf (deleted)Malware Command and Control Activity DetectedBOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
1862px86.elf (deleted)Malware Command and Control Activity DetectedBOTNET [ANY.RUN] Possible Mirai.Gen (Linux)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED