Analysis
- max time kernel
0s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
02/11/2026, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
iranbot-ultimate.mipsel.elf
Resource
debian12-mipsel-20260513-en
4 signatures
150 seconds
Errors
Reason
Reading agent response: unexpected EOF
General
- Target iranbot-ultimate.mipsel.elf
- Size 211KB
- Sample261102-s792aaxt8r
- SHA256 27ca6bc2a7b05f067b593dfaac4866a0cff39207d500ab87ffff0c9881f962fc
- MD5 02cc4b3c002bad22cbf131597e1ca4a0
- SHA1 bccf6174b8daebcf027c6e5cb7b0933cc2bd7229
- SHA512 b8785fe89a1e4a4673c5d1913ed5790d70b60884b6659a6e262b4f1e66daea2a3090cd7e9519de0f1d2d84edad6da6063282b7a8c75e6f403b877c3ac7302ac5
- SSDEEP 6144:KdTchOr9xIK34tZMPuwqjL/znZOwKwkvg47zWIK5G:KV/xzOZMGpkS
- TLSH T13224E8099F910FBBD8AFDE3702E90A1635CCA54722A43B753678D528F54E90B49E3C78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 800 iranbot-ultimate.mipsel.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 800 iranbot-ultimate.mipsel.elf -
description ioc Process File opened for reading /proc/self/status iranbot-ultimate.mipsel.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 800 iranbot-ultimate.mipsel.elf