130e02593bf69b73c9d81b0a3fbc94bd6bd09ded86a189878e5018535848e265

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/09/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libbot.so.elf
Size 181KB
Sample260919-m1swjazbme
SHA256 130e02593bf69b73c9d81b0a3fbc94bd6bd09ded86a189878e5018535848e265
MD5 54644471f6f6ea35feb6b0145dc7869b
SHA1 d26ca28d5cfe1d05df7f3d4d17b941a5c70e50e5
SHA512 d487fad1644b7be72d9f858d91d26e59f5173f913c6998ec45105de3025d2040ffa4f51e29ebbcdea30f0b5a2c9169b3c4e21bcad67bcbf94e020e07cfc849ae
SSDEEP 3072:+bO7iih3bFu/+AM8Gsb0wKdovzuMkqB3NpU7evtrwC+usQhaXMTROiaavvwm:+bEiKuxMW01dovzuMPkhuRwkOq
TLSH
T161046C1BEA42E170F0738071514ADB739635A9314306C817FBA63F35EDB46C5E68AB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	libbot.so.elf
File opened for modification	/dev/misc/watchdog	libbot.so.elf

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/flutter	libbot.so.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	libbot.so.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	libbot.so.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/network-dispatch.service	libbot.so.elf

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/network-dispatch	libbot.so.elf

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1502	libbot.so.elf
Changes the process name, possibly in an attempt to hide itself	1502	libbot.so.elf
Changes the process name, possibly in an attempt to hide itself	1503	libbot.so.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	libbot.so.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/7/fd	libbot.so.elf
File opened for reading	/proc/473/fd	libbot.so.elf
File opened for reading	/proc/468/cmdline	libbot.so.elf
File opened for reading	/proc/13/fd	libbot.so.elf
File opened for reading	/proc/84/fd	libbot.so.elf
File opened for reading	/proc/481/fd	libbot.so.elf
File opened for reading	/proc/1070/fd	libbot.so.elf
File opened for reading	/proc/1264/fd	libbot.so.elf
File opened for reading	/proc/516/cmdline	libbot.so.elf
File opened for reading	/proc/1499/cmdline	libbot.so.elf
File opened for reading	/proc/16/fd	libbot.so.elf
File opened for reading	/proc/78/fd	libbot.so.elf
File opened for reading	/proc/463/fd	libbot.so.elf
File opened for reading	/proc/477/fd	libbot.so.elf
File opened for reading	/proc/580/fd	libbot.so.elf
File opened for reading	/proc/1169/fd	libbot.so.elf
File opened for reading	/proc/451/cmdline	libbot.so.elf
File opened for reading	/proc/14/fd	libbot.so.elf
File opened for reading	/proc/21/fd	libbot.so.elf
File opened for reading	/proc/177/fd	libbot.so.elf
File opened for reading	/proc/272/fd	libbot.so.elf
File opened for reading	/proc/522/fd	libbot.so.elf
File opened for reading	/proc/626/fd	libbot.so.elf
File opened for reading	/proc/1506/fd	libbot.so.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/167/fd	libbot.so.elf
File opened for reading	/proc/468/fd	libbot.so.elf
File opened for reading	/proc/558/fd	libbot.so.elf
File opened for reading	/proc/625/fd	libbot.so.elf
File opened for reading	/proc/1075/fd	libbot.so.elf
File opened for reading	/proc/1103/fd	libbot.so.elf
File opened for reading	/proc/1505/fd	libbot.so.elf
File opened for reading	/proc/466/cmdline	libbot.so.elf
File opened for reading	/proc/731/cmdline	libbot.so.elf
File opened for reading	/proc/83/fd	libbot.so.elf
File opened for reading	/proc/89/fd	libbot.so.elf
File opened for reading	/proc/1005/fd	libbot.so.elf
File opened for reading	/proc/925/cmdline	libbot.so.elf
File opened for reading	/proc/1394/cmdline	libbot.so.elf
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/137/fd	libbot.so.elf
File opened for reading	/proc/175/fd	libbot.so.elf
File opened for reading	/proc/466/fd	libbot.so.elf
File opened for reading	/proc/587/fd	libbot.so.elf
File opened for reading	/proc/1502/fd	libbot.so.elf
File opened for reading	/proc/680/cmdline	libbot.so.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/179/fd	libbot.so.elf
File opened for reading	/proc/1208/fd	libbot.so.elf
File opened for reading	/proc/1313/fd	libbot.so.elf
File opened for reading	/proc/1394/fd	libbot.so.elf
File opened for reading	/proc/1499/fd	libbot.so.elf
File opened for reading	/proc/1532/fd	libbot.so.elf
File opened for reading	/proc/6/fd	libbot.so.elf
File opened for reading	/proc/19/fd	libbot.so.elf
File opened for reading	/proc/516/fd	libbot.so.elf
File opened for reading	/proc/981/fd	libbot.so.elf
File opened for reading	/proc/990/fd	libbot.so.elf
File opened for reading	/proc/1096/fd	libbot.so.elf
File opened for reading	/proc/1113/fd	libbot.so.elf
File opened for reading	/proc/1189/fd	libbot.so.elf
File opened for reading	/proc/481/cmdline	libbot.so.elf
File opened for reading	/proc/sys/kernel/osrelease	systemctl

/tmp/libbot.so.elf
/tmp/libbot.so.elf
1⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Enumerates active TCP sockets
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1501
- /usr/local/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1507
- /usr/local/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1507
- /usr/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1507
- /usr/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1507
- /sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1507
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1507
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1537
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1537
- /usr/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1537
- /usr/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1537
- /sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1537
- /bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  - Reads runtime system information
  PID:1537

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

flutter

Path /etc/cron.d/flutter
Size 34B
SHA256 f6c1b51b251ecce83aea27f5e98dacd1b19e8165388b591f2d66f36ef901cd7a
MD5 a4f24d7270133b6296e438b12b0b0e91
SHA1 73e8d6070f4c0180bc2b1312bf7822c9629a1b66
SHA512 87e3b204234ceb602607020b1b7c5f1d12614bc8fd5d1fbea6d68e64325f8322f0376b5a71748415c5683da01be467863f8a9a6ed3b9883e8e6c7c4c52d58bc3
MD5 SHA1 SHA512

Submit Download

network-dispatch.service

Path /etc/systemd/system/network-dispatch.service
Size 228B
SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
MD5 93d4d91e631d6cc85d978e996f3316b9
SHA1 9fc4ded5573510502cbb231b2c8d3ab5fc2d5503
SHA512 c0b9d9ac33434e11a8ccebf386492e4baa7206cb61968694e06d4eb911eaee4ffa74e7b106a402bfb8bfd1c3b725fd29f9d59b8fb090b643dbb3f42a3db409fe
TLSH
T149D0A7A2DAB05091CA1618764F977B50894521401D8EA2BD0A952F4546D2245502DA5E
MD5 SHA1 SHA512 TLSH

Submit Download

network-dispatch

Path /usr/local/bin/network-dispatch
Size 181KB
SHA256 130e02593bf69b73c9d81b0a3fbc94bd6bd09ded86a189878e5018535848e265
MD5 54644471f6f6ea35feb6b0145dc7869b
SHA1 d26ca28d5cfe1d05df7f3d4d17b941a5c70e50e5
SHA512 d487fad1644b7be72d9f858d91d26e59f5173f913c6998ec45105de3025d2040ffa4f51e29ebbcdea30f0b5a2c9169b3c4e21bcad67bcbf94e020e07cfc849ae
SSDEEP 3072:+bO7iih3bFu/+AM8Gsb0wKdovzuMkqB3NpU7evtrwC+usQhaXMTROiaavvwm:+bEiKuxMW01dovzuMPkhuRwkOq
TLSH
T161046C1BEA42E170F0738071514ADB739635A9314306C817FBA63F35EDB46C5E68AB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads