mksh(1) is “just” the system shell on Android (has been for a few versions by now). The request basically means that some other application is trying to run a shell command with root permissions, which the dialogue then attributes to the shell instead of the program/library actually requesting it (on whose behalf
mksh is operating).
There are several very long threads acting on it; this one has got a good summary, out of which the most important points are:
- the "ip route add" command comes from libChange.so in HTC Sense ROMs (thanks to chrisch1974 for finding it), which itself is already running as a system component
- the command itself is not malicious, but there's no clear reason why HTC Sense should run this command
- the reason it shows up in SuperSU v0.97 and does not show up in older versions is because v0.97 no longer automatically grants root to the shell and system processes
- 126.96.36.199/4 is the standard IP multicast range - this command just forces multicasting out of the wifi interface (since AFAIK cell carriers don't allow multicasting on their data connections). This prevents multicast traffic from attempting to use the mobile network connection and failing.
- If you have used the adb shell command on any previous phone and got the root prompt,
#, instead of the user prompt,
$, by default then your shell has been this way before. I've seen it come and go.
In the end, most people agree that saying Yes here seems to be harmless.
Disclaimer: I’m the