Overview

overview

10

Static

static

10

iran.mipsrouter.elf

debian-9-mips

10

Analysis

  • max time kernel
    124s
  • max time network
    140s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    12/10/2026, 23:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    iran.mipsrouter.elf
  • Size 230KB
  • Sample261012-3jvxkagy6x
  • SHA256 3108e22a83bb6fda42c62af4c30e5b998d0b45acd5dbcd803b38f9fbada73efb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdiscoveryexecutionflylegitbotpersistenceprivilege_escalation

Malware Config

Signatures

  • Family: FlyLegitBot

    FlyLegitBot is a Mirai-based botnet.

    botnetflylegitbot
  • Detects FlyLegitBot 1 IoCs
  • Deletes itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 1 IoCs
    persistence
  • Changes its process name 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/iran.mipsrouter.elf
    /tmp/iran.mipsrouter.elf
    1⤵
    • Deletes itself
    • Modifies init.d
    • Modifies systemd
    • Write file to user bin folder
    • Changes its process name
    • Reads runtime system information
    • System Network Configuration Discovery
    PID:711
    • /bin/sh
      sh -c "systemctl enable NbfDe7jjSXd.service >/dev/null 2>&1 || true"
      2⤵
        PID:715
        • /bin/systemctl
          systemctl enable NbfDe7jjSXd.service
          3⤵
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:717
      • /bin/sh
        sh -c "crontab -l 2>/dev/null"
        2⤵
          PID:753
          • /usr/bin/crontab
            crontab -l
            3⤵
            • Reads runtime system information
            PID:754
        • /bin/sh
          sh -c "(crontab -l 2>/dev/null; echo '@reboot /usr/local/bin/NbfDe7jjSXdE925 &') | crontab -"
          2⤵
            PID:755
            • /usr/bin/crontab
              crontab -
              3⤵
              • Creates/modifies Cron job
              PID:757
            • /usr/bin/crontab
              crontab -l
              3⤵
              • Reads runtime system information
              PID:758

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Cron

              1
              T1053.003

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              XDG Autostart Entries

              1
              T1547.013

              Boot or Logon Initialization Scripts

              1
              T1037

              RC Scripts

              1
              T1037.004

              Create or Modify System Process

              1
              T1543

              Systemd Service

              1
              T1543.002

              Scheduled Task/Job

              1
              T1053

              Cron

              1
              T1053.003

              Privilege Escalation

              Boot or Logon Autostart Execution

              2
              T1547

              XDG Autostart Entries

              1
              T1547.013

              Boot or Logon Initialization Scripts

              1
              T1037

              RC Scripts

              1
              T1037.004

              Create or Modify System Process

              1
              T1543

              Systemd Service

              1
              T1543.002

              Scheduled Task/Job

              1
              T1053

              Cron

              1
              T1053.003

              Defense Evasion

              Credential Access

              Discovery

              System Information Discovery

              1
              T1082

              System Network Configuration Discovery

              1
              T1016

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              nUR7hfhtJ7F
              • Path /etc/init.d/nUR7hfhtJ7F
              • Size 181B
              • SHA256 cf94021398de52e6851da0002921acfd2782743e6b489e8bf7af906f5d85eba0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              NbfDe7jjSXd.service
              • Path /etc/systemd/system/NbfDe7jjSXd.service
              • Size 186B
              • SHA256 676fafc4afdf3763d1700556f069cb597aca41f3a684915ce8defae9f6dd67e9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              NbfDe7jjSXdE925
              • Path /usr/local/bin/NbfDe7jjSXdE925
              • Size 230KB
              • SHA256 3108e22a83bb6fda42c62af4c30e5b998d0b45acd5dbcd803b38f9fbada73efb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmp.TeiXht
              • Path /var/spool/cron/crontabs/tmp.TeiXht
              • Size 216B
              • SHA256 55ba18f610b706b285a43858a88f8f295473e0f7eeb01109e340a6c76f181df5
              • MD5 SHA1 SHA512 TLSH
              Submit Download