Malware analysis illnet.i586 Malicious activity | ANY.RUN

Add for printing

File name:	illnet.i586
Full analysis:	https://app.any.run/tasks/e63eef81-2870-4d73-94e6-2e820fa6bcaf
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	June 23, 2025, 12:30:08
OS:	Ubuntu 22.04.2
Tags:	ddos mirai botnet
Indicators:
MIME:	application/x-executable
File info:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
MD5:	1B5526B3F08E6EBAE3406213EEE6A2E6
SHA1:	47D1EBD3E3883EC870898337BC60BE710736E172
SHA256:	8FCDFC0B167BF5BF7824473536B480C781DF06569E1C3F081B1387322E89487F
SSDEEP:	3072:EBMsReIYshCzTbAutjAhAPjD+feP0K5eM5h/NTzo5F9mwi0HjKpuy:EBMsReIYsh7cjAhAzcVM5h/NTzo5F9ml

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Connects to the CnC server
  - illnet.i586.elf (deleted) (PID: 41407)
- MIRAI has been detected (SURICATA)
  - illnet.i586.elf (deleted) (PID: 41407)
SUSPICIOUS
- Executes commands using command-line interpreter
  - sudo (PID: 41403)
- Starts itself from another location
  - illnet.i586.elf (PID: 41404)
- Modifies file or directory owner
  - sudo (PID: 41400)
- Connects to unusual port
  - illnet.i586.elf (deleted) (PID: 41407)
- Contacting a server suspected of hosting an CnC
  - illnet.i586.elf (deleted) (PID: 41407)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture:	32 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	i386

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

144

Monitored processes

10

Malicious processes

2

Suspicious processes

2

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

41399

/bin/sh -c "sudo chown user /tmp/illnet\.i586\.elf && chmod +x /tmp/illnet\.i586\.elf && DISPLAY=:0 sudo -iu user /tmp/illnet\.i586\.elf "

/usr/bin/dash

—

UbvyYXL4x2mYa65Q

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41400

sudo chown user /tmp/illnet.i586.elf

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

41401

chown user /tmp/illnet.i586.elf

/usr/bin/chown

—

sudo

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41402

chmod +x /tmp/illnet.i586.elf

/usr/bin/chmod

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41403

sudo -iu user /tmp/illnet.i586.elf

/usr/bin/sudo

—

dash

User:

root

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11

41404

/tmp/illnet.i586.elf

—

sudo

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6

41405

/usr/bin/locale-check C.UTF-8

/usr/bin/locale-check

—

illnet.i586.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

41406

1evxmxvxajvxleez5j8x

/tmp/illnet.i586.elf (deleted)

—

illnet.i586.elf

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

41407

1evxmxvxajvxleez5j8x

/tmp/illnet.i586.elf (deleted)

illnet.i586.elf (deleted)

User:

user

Integrity Level:

UNKNOWN

Exit code:

0

41408

1evxmxvxajvxleez5j8x

/tmp/illnet.i586.elf (deleted)

—

illnet.i586.elf (deleted)

User:

user

Integrity Level:

UNKNOWN

Exit code:

32512

Modules

Images
/usr/lib/x86_64-linux-gnu/libc.so.6

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

12

DNS requests

12

Threats

2

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.48:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	185.125.190.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	whitelisted
—	—	212.102.56.178:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
—	—	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.57:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
—	—	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
41407	illnet.i586.elf (deleted)	176.96.131.92:182	—	—	US	malicious

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2620:2d:4000:1::23 2620:2d:4002:1::196 2620:2d:4000:1::22 2620:2d:4000:1::98 2001:67c:1562::24 2620:2d:4000:1::2b 2620:2d:4002:1::197 2620:2d:4000:1::97 2001:67c:1562::23 2620:2d:4000:1::96 2620:2d:4000:1::2a 2620:2d:4002:1::198 185.125.190.49 185.125.190.48 91.189.91.97 91.189.91.96 185.125.190.17 185.125.190.96 185.125.190.98 185.125.190.97 91.189.91.48 91.189.91.49 91.189.91.98 185.125.190.18	whitelisted
google.com	142.250.185.110 2a00:1450:4001:81d::200e	whitelisted
odrs.gnome.org	212.102.56.178 37.19.194.81 207.211.211.26 195.181.175.40 195.181.170.19 169.150.255.181 169.150.255.184 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::19 2a02:6ea0:c700::107 2a02:6ea0:c700::11 2a02:6ea0:c700::18 2a02:6ea0:c700::101	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.59 185.125.188.57 185.125.188.54 2620:2d:4000:1010::117 2620:2d:4000:1010::344 2620:2d:4000:1010::42 2620:2d:4000:1010::2e6	whitelisted
4.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
41407	illnet.i586.elf (deleted)	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Mirai.Gen Check-In (Linux DDoS)
41407	illnet.i586.elf (deleted)	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)

Add for printing

No debug info

General Info

illnet.i586

1B5526B3F08E6EBAE3406213EEE6A2E6

47D1EBD3E3883EC870898337BC60BE710736E172

8FCDFC0B167BF5BF7824473536B480C781DF06569E1C3F081B1387322E89487F

3072:EBMsReIYshCzTbAutjAhAPjD+feP0K5eM5h/NTzo5F9mwi0HjKpuy:EBMsReIYsh7cjAhAzcVM5h/NTzo5F9ml

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Connects to the CnC server

MIRAI has been detected (SURICATA)

SUSPICIOUS

Executes commands using command-line interpreter

Starts itself from another location

Modifies file or directory owner

Connects to unusual port

Contacting a server suspected of hosting an CnC

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Information

Modules

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings