Find similar analyses in TI Lookup
Analysis date (UTC): 23 January 2025, 20:03Analysis environment: Ubuntu 22.04.2 LTS

dwadjs.sh

MD5:BC815D01F3DAAA64DAD68D7A53DBA833
SHA1:0B863F78748E1006DE55E05A895508B802EFF2D0
SHA256:A128A46E8288473F3EFCA2BC493B04906A4760385D64D80EAE19E142FB372415

Analysis result

Threat level:Malicious activity
Tags:
opendirmiraibotnet
Full analysis:Analysis dwadjs.sh (MD5: BC815D01F3DAAA64DAD68D7A53DBA833) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

  • telnet.x86 (PID: 38808)

SUSPICIOUS

Connects to unusual port

  • busybox (PID: 38799)
  • busybox (PID: 38788)
  • busybox (PID: 38777)
  • busybox (PID: 38767)
  • busybox (PID: 38792)
  • busybox (PID: 38783)
  • busybox (PID: 38772)
  • busybox (PID: 38811)
  • busybox (PID: 38814)
  • busybox (PID: 38795)
  • busybox (PID: 38802)
  • busybox (PID: 38805)
  • telnet.x86 (PID: 38808)

Potential Corporate Privacy Violation

  • busybox (PID: 38795)
  • busybox (PID: 38777)
  • busybox (PID: 38788)
  • busybox (PID: 38783)
  • busybox (PID: 38772)
  • busybox (PID: 38767)
  • busybox (PID: 38805)

Modifies file or directory owner

  • sudo (PID: 38757)

Executes commands using command-line interpreter

  • sudo (PID: 38762)

Executes the "rm" command to delete files or directories

  • bash (PID: 38765)

Contacting a server suspected of hosting an CnC

  • telnet.x86 (PID: 38808)

INFO

No info indicators.

Threats

PIDProcessClassMessage
38767busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download
38767busyboxPotentially Bad TrafficET INFO ARM File Download Request from IP Address
38772busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download
38772busyboxPotentially Bad TrafficET HUNTING Suspicious GET Request for .arm file File
38777busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download
38777busyboxPotentially Bad TrafficET HUNTING Suspicious GET Request for .arm file File
38783busyboxPotentially Bad TrafficET HUNTING Suspicious GET Request for .arm file File
38783busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download
38783busyboxPotentially Bad TrafficET INFO ARM7 File Download Request from IP Address
38788busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED