Find similar analyses in TI Lookup
Analysis date (UTC): 17 February 2025, 17:57Analysis environment: Ubuntu 22.04.2 LTS

wget.sh

MD5:D011EEE1C3EE60B1A1DB3AE1E9E65AD6
SHA1:18F4CEE16484157375F8BBCF21ACCA220A258D66
SHA256:DD5851B5AB04287B30ED4D1BED6F7940D256849C8D6CFC9936DF59AFA4C328AA

Analysis result

Threat level:Malicious activity
Tags:
autobotnetmirai
Full analysis:Analysis wget.sh (MD5: D011EEE1C3EE60B1A1DB3AE1E9E65AD6) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

MIRAI has been found (auto)

  • busybox (PID: 38764)
  • busybox (PID: 38795)
  • busybox (PID: 38790)
  • busybox (PID: 38784)
  • busybox (PID: 38800)
  • busybox (PID: 38813)
  • busybox (PID: 38777)
  • busybox (PID: 38771)
  • busybox (PID: 38823)
  • busybox (PID: 38818)
  • busybox (PID: 38828)

SUSPICIOUS

Connects to the server without a host name

  • busybox (PID: 38771)
  • busybox (PID: 38790)
  • busybox (PID: 38784)
  • busybox (PID: 38795)
  • busybox (PID: 38800)
  • busybox (PID: 38813)
  • busybox (PID: 38777)
  • busybox (PID: 38764)
  • busybox (PID: 38823)
  • busybox (PID: 38834)
  • busybox (PID: 38828)
  • busybox (PID: 38818)

Modifies file or directory owner

  • sudo (PID: 38758)

Potential Corporate Privacy Violation

  • busybox (PID: 38771)
  • busybox (PID: 38784)
  • busybox (PID: 38795)
  • busybox (PID: 38790)
  • busybox (PID: 38800)
  • busybox (PID: 38764)
  • busybox (PID: 38813)
  • busybox (PID: 38818)
  • busybox (PID: 38823)
  • busybox (PID: 38777)
  • busybox (PID: 38828)

INFO

No info indicators.

Threats

PIDProcessClassMessage
38764busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
38771busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
38777busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
38784busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
38790busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
38795busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
38800busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
38813busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
38818busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP
38823busyboxPotential Corporate Privacy ViolationET INFO Executable and linking format (ELF) file download Over HTTP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED