Analysis date (UTC): 13 December 2024, 14:49Analysis environment: Ubuntu 22.04.2 LTS

elitebotnet.x86.elf

MD5:5A7D6BAA6E0EC7FE3E4B8D70F7C97598
SHA1:5E320DB909D429468D2CA012B7128A121272791B
SHA256:4A4D2CB9F318D3B31C134D7DDFF8B0D02B00B023A8079D064C177BB7E760F9B2

Analysis result

Threat level:Malicious activity
Tags:
miraibotnetmoobotscansshsshscan

Behavior activities

MALICIOUS

SSHSCAN has been detected (SURICATA)

  • busybox (PID: 38779)

Attempting to scan the network

  • busybox (PID: 38779)

Attempting to connect via SSH

  • busybox (PID: 38779)

MIRAI has been detected (SURICATA)

  • busybox (PID: 38778)

Connects to the CnC server

  • busybox (PID: 38778)

SUSPICIOUS

Modifies file or directory owner

  • sudo (PID: 38759)

Modify startup scripts of the system services

  • busybox (PID: 38778)

Executes the "rm" command to delete files or directories

  • dash (PID: 38771)

Potential Corporate Privacy Violation

  • busybox (PID: 38779)

Connects to unusual port

  • busybox (PID: 38779)
  • busybox (PID: 38778)

Contacting a server suspected of hosting an CnC

  • busybox (PID: 38778)

INFO

No info indicators.

Threats

PIDProcessClassMessage
38778busyboxMalware Command and Control Activity DetectedET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
38779busyboxPotential Corporate Privacy ViolationPOLICY [ANY.RUN] Attempting to SSH scan external network
38778busyboxMalware Command and Control Activity DetectedET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
——Misc AttackET DROP Spamhaus DROP Listed Traffic Inbound group 3
——Misc AttackET DROP Spamhaus DROP Listed Traffic Inbound group 24
——Misc AttackET DROP Spamhaus DROP Listed Traffic Inbound group 48
——Potential Corporate Privacy ViolationPOLICY [ANY.RUN] Attempting to SSH scan external network
——Misc AttackET DROP Spamhaus DROP Listed Traffic Inbound group 24
——Misc AttackET DROP Spamhaus DROP Listed Traffic Inbound group 3
——Misc AttackET DROP Spamhaus DROP Listed Traffic Inbound group 24

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN