Find similar analyses in TI Lookup

Analysis date (UTC): 18 June 2025, 12:03Analysis environment: Ubuntu 22.04.2

realtek.sh

MD5:328D00329E19D164140E81251E29024C

SHA1:B5D957153F9F5FF33D70DAA58BCB50D7C8503576

SHA256:AB2FDC150B5FCDAFEF70DEE90D6B4C405F5FC25D6B19D77CACBC0F1C0A265AFE

Analysis result

Threat level:Malicious activity

Tags:

autogenericmiraibotnet

Full analysis:Analysis realtek.sh (MD5: 328D00329E19D164140E81251E29024C) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

GENERIC has been found (auto)

wget (PID: 41411)
wget (PID: 41404)
wget (PID: 41416)
wget (PID: 41421)
wget (PID: 41431)
busybox (PID: 41452)
wget (PID: 41438)
busybox (PID: 41475)
busybox (PID: 41487)
busybox (PID: 41494)
busybox (PID: 41509)
busybox (PID: 41504)
busybox (PID: 41518)

MIRAI has been found (auto)

wget (PID: 41426)
busybox (PID: 41499)

Application was dropped or rewritten from another process

tt27 (deleted) (PID: 41441)
xle1 (PID: 41440)
tt27 (deleted) (PID: 41445)
tt27 (deleted) (PID: 41447)
tt27 (deleted) (PID: 41444)
tt27 (deleted) (PID: 41442)
tt27 (deleted) (PID: 41480)
tt27 (deleted) (PID: 41481)
tt27 (deleted) (PID: 41482)
tt27 (deleted) (PID: 41489)
tt27 (deleted) (PID: 41488)
8lg4 (deleted) (PID: 41517)
8lg4 (deleted) (PID: 41512)
xle1 (PID: 41511)
8lg4 (deleted) (PID: 41514)
8lg4 (deleted) (PID: 41515)
8lg4 (deleted) (PID: 41516)
xale1 (PID: 41520)

SUSPICIOUS

Executes commands using command-line interpreter

bash (PID: 41402)
sudo (PID: 41401)

Potential Corporate Privacy Violation

wget (PID: 41404)
wget (PID: 41411)
wget (PID: 41421)
wget (PID: 41416)
wget (PID: 41431)
wget (PID: 41438)
wget (PID: 41426)
busybox (PID: 41452)
busybox (PID: 41475)
busybox (PID: 41487)
busybox (PID: 41499)
busybox (PID: 41504)
busybox (PID: 41509)
busybox (PID: 41494)
busybox (PID: 41518)

Executes the "rm" command to delete files or directories

bash (PID: 41402)

Modifies file or directory owner

sudo (PID: 41398)

Starts itself from another location

xle1 (PID: 41511)
xle1 (PID: 41440)
xale1 (PID: 41520)

Uses wget to download content

bash (PID: 41402)

Connects to the server without a host name

wget (PID: 41411)
wget (PID: 41404)
wget (PID: 41416)
wget (PID: 41421)
wget (PID: 41426)
wget (PID: 41446)
busybox (PID: 41452)
wget (PID: 41438)
wget (PID: 41431)
busybox (PID: 41475)
busybox (PID: 41494)
busybox (PID: 41504)
busybox (PID: 41509)
busybox (PID: 41518)
busybox (PID: 41487)
busybox (PID: 41499)

Reads /proc/mounts (likely used to find writable filesystems)

xale1 (PID: 41520)

INFO

Creates file in the temporary folder

wget (PID: 41411)
wget (PID: 41404)
wget (PID: 41416)
wget (PID: 41426)
wget (PID: 41421)
busybox (PID: 41452)
wget (PID: 41431)
wget (PID: 41438)
busybox (PID: 41475)
busybox (PID: 41487)
busybox (PID: 41494)
busybox (PID: 41499)
busybox (PID: 41504)
busybox (PID: 41509)
busybox (PID: 41518)

Checks timezone

wget (PID: 41411)
wget (PID: 41404)
wget (PID: 41416)
wget (PID: 41421)
wget (PID: 41426)
wget (PID: 41431)
wget (PID: 41446)
wget (PID: 41438)

Threats

PID	Process	Class	Message
41404	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41411	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41416	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41421	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41426	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41431	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41438	wget	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41452	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41475	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP
41487	busybox	Potential Corporate Privacy Violation	ET INFO Executable and linking format (ELF) file download Over HTTP

Rows per page