Malware analysis bot.x86 Malicious activity | ANY.RUN

Add for printing

File name:	bot.x86
Full analysis:	https://app.any.run/tasks/52251417-8060-4ad6-a1d0-c114bc8f5a3d
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	May 18, 2025, 07:55:51
OS:	Ubuntu 22.04.2
Tags:	mirai botnet moobot
Indicators:
MIME:	application/x-executable
File info:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
MD5:	0F2FAC1B746C349B55C1A8781C5B8BA3
SHA1:	C68AEDDC6245D877BF118F2A8B8D907FE7B35B92
SHA256:	536082C01AEEFE4A548686EFF9A99C5BBB0F9E99A11071BE2350817C09D6C282
SSDEEP:	3072:JfOFlwAsrTKyl3xWPKv0cFBmIfVCXhNgn3n9vS:JfOFlwAsrTKyl3xzFf8XhNgn3nVS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - bot.x86.elf (PID: 41033)
- Connects to the CnC server
  - bot.x86.elf (PID: 41033)
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 41027)
- Executes commands using command-line interpreter
  - sudo (PID: 41030)
- Contacting a server suspected of hosting an CnC
  - bot.x86.elf (PID: 41033)
- Connects to unusual port
  - bot.x86.elf (PID: 41033)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture:	32 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	i386

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

141

Monitored processes

9

Malicious processes

4

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

41026

/bin/sh -c "sudo chown user /tmp/bot\.x86\.elf && chmod +x /tmp/bot\.x86\.elf && DISPLAY=:0 sudo -iu user /tmp/bot\.x86\.elf "

/usr/bin/dash

—

IntiFjKCklFyPMJr

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41027

sudo chown user /tmp/bot.x86.elf

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

41028

chown user /tmp/bot.x86.elf

/usr/bin/chown

—

sudo

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41029

chmod +x /tmp/bot.x86.elf

/usr/bin/chmod

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41030

sudo -iu user /tmp/bot.x86.elf

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

41031

/tmp/bot.x86.elf

—

sudo

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6

41032

/usr/bin/locale-check C.UTF-8

/usr/bin/locale-check

—

bot.x86.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41033

/tmp/bot.x86.elf

bot.x86.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

41034

/tmp/bot.x86.elf

—

bot.x86.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

26

DNS requests

30

Threats

50

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	169.150.255.181:443	odrs.gnome.org	—	GB	unknown
—	—	212.102.56.178:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
41033	bot.x86.elf	5.180.82.194:43957	kniznetwork.duckdns.org	Ipxo Uk Limited	DE	malicious

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	91.189.91.49 185.125.190.98 185.125.190.48 91.189.91.98 185.125.190.97 185.125.190.96 185.125.190.17 185.125.190.18 185.125.190.49 91.189.91.96 91.189.91.48 2620:2d:4000:1::97 2620:2d:4000:1::22 2620:2d:4002:1::196 2001:67c:1562::23 2620:2d:4002:1::198 2620:2d:4000:1::2b 2001:67c:1562::24 2620:2d:4000:1::2a 2620:2d:4000:1::98 2620:2d:4000:1::23 2620:2d:4000:1::96	whitelisted
google.com	142.250.186.174 2a00:1450:4001:82b::200e	whitelisted
odrs.gnome.org	169.150.255.181 212.102.56.178 169.150.255.183 195.181.170.19 195.181.175.40 207.211.211.27 37.19.194.81 2a02:6ea0:c700::18 2a02:6ea0:c700::11 2a02:6ea0:c700::21 2a02:6ea0:c700::101 2a02:6ea0:c700::19 2a02:6ea0:c700::107 2a02:6ea0:c700::112	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.57 185.125.188.54 185.125.188.59 2620:2d:4000:1010::2e6 2620:2d:4000:1010::42 2620:2d:4000:1010::344 2620:2d:4000:1010::117	whitelisted
kniznetwork.duckdns.org	5.180.82.194	unknown
5.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
41033	bot.x86.elf	Misc activity	ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
41033	bot.x86.elf	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
41033	bot.x86.elf	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
41033	bot.x86.elf	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
41033	bot.x86.elf	Misc activity	ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
41033	bot.x86.elf	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
41033	bot.x86.elf	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
41033	bot.x86.elf	Misc activity	ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
41033	bot.x86.elf	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
41033	bot.x86.elf	Potentially Bad Traffic	ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain

Add for printing

No debug info

General Info

bot.x86

0F2FAC1B746C349B55C1A8781C5B8BA3

C68AEDDC6245D877BF118F2A8B8D907FE7B35B92

536082C01AEEFE4A548686EFF9A99C5BBB0F9E99A11071BE2350817C09D6C282

3072:JfOFlwAsrTKyl3xWPKv0cFBmIfVCXhNgn3n9vS:JfOFlwAsrTKyl3xzFf8XhNgn3nVS

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

Connects to the CnC server

SUSPICIOUS

Modifies file or directory owner

Executes commands using command-line interpreter

Contacting a server suspected of hosting an CnC

Connects to unusual port

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings