Malware analysis elitebotnet.x86 Malicious activity | ANY.RUN

Add for printing

File name:	elitebotnet.x86
Full analysis:	https://app.any.run/tasks/c81e3782-b549-4793-9894-5261edfee932
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	January 13, 2025, 09:43:04
OS:	Ubuntu 22.04.2 LTS
Tags:	mirai botnet moobot
Indicators:
MIME:	application/x-executable
File info:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
MD5:	D0E41BBBDD2DFC55E138D300228887B7
SHA1:	157B9F9B631FE4D7628801BBFB88828524F55D54
SHA256:	A9CFA78FCB204C246319DD3D3A47CE2FA17137A7924756C8B4688D227443D34B
SSDEEP:	1536:osR/NhyfotNMCqg0cH/GA1LpHVg8FDrwbZnHtV:osR/NhyfotNMCqgeA1LpHVLFDrwbZnH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MOOBOT has been detected (SURICATA)
  - watchdog (PID: 38763)
- Connects to the CnC server
  - watchdog (PID: 38763)
- MIRAI has been detected (SURICATA)
  - watchdog (PID: 38763)
SUSPICIOUS
- Modifies file or directory owner
  - sudo (PID: 38752)
- Executes the "rm" command to delete files or directories
  - dash (PID: 38758)
- Connects to unusual port
  - watchdog (PID: 38763)
- Contacting a server suspected of hosting an CnC
  - watchdog (PID: 38763)
- Potential Corporate Privacy Violation
  - watchdog (PID: 38790)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

254

Monitored processes

47

Malicious processes

5

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
38751	/bin/sh -c "sudo chown user /tmp/elitebotnet\.x86\.elf && chmod +x /tmp/elitebotnet\.x86\.elf && DISPLAY=:0 sudo -iu user /tmp/elitebotnet\.x86\.elf "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
38752	sudo chown user /tmp/elitebotnet.x86.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38753	chown user /tmp/elitebotnet.x86.elf	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
38754	chmod +x /tmp/elitebotnet.x86.elf	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38755	sudo -iu user /tmp/elitebotnet.x86.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
38756	/tmp/elitebotnet.x86.elf	/tmp/elitebotnet.x86.elf	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
38757	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	elitebotnet.x86.elf
User: user Integrity Level: UNKNOWN Exit code: 0
38758	sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/elitebotnet\.x86\.elf bin/watchdog; chmod 777 bin/watchdog"	/usr/bin/dash	—	elitebotnet.x86.elf
User: user Integrity Level: UNKNOWN Exit code: 0
38759	rm -rf bin/watchdog	/usr/bin/rm	—	dash
User: user Integrity Level: UNKNOWN Exit code: 0
38760	mkdir bin	/usr/bin/mkdir	—	dash
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

5

DNS requests

8

Threats

27

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
38763	watchdog	91.212.166.7:6666	—	IT Resheniya LLC	RU	malicious
512	snapd	185.125.188.55:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.185.142 2a00:1450:4001:80e::200e	whitelisted
odrs.gnome.org	195.181.175.41 37.19.194.81 212.102.56.179 195.181.170.19 207.211.211.26 169.150.255.180 169.150.255.184 2a02:6ea0:c700::101 2a02:6ea0:c700::21 2a02:6ea0:c700::18 2a02:6ea0:c700::107 2a02:6ea0:c700::19 2a02:6ea0:c700::112 2a02:6ea0:c700::11	whitelisted
api.snapcraft.io	185.125.188.54 185.125.188.55 185.125.188.59 185.125.188.58 2620:2d:4000:1010::2e6 2620:2d:4000:1010::117 2620:2d:4000:1010::6d 2620:2d:4000:1010::42	whitelisted
15.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
38763	watchdog	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
38763	watchdog	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
38763	watchdog	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 13
38763	watchdog	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
38763	watchdog	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response M2
38790	watchdog	Potential Corporate Privacy Violation	ET P2P ThunderNetwork UDP Traffic
38763	watchdog	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response M2
38763	watchdog	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
38763	watchdog	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
38763	watchdog	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response M2

Add for printing

No debug info

General Info

elitebotnet.x86

D0E41BBBDD2DFC55E138D300228887B7

157B9F9B631FE4D7628801BBFB88828524F55D54

A9CFA78FCB204C246319DD3D3A47CE2FA17137A7924756C8B4688D227443D34B

1536:osR/NhyfotNMCqg0cH/GA1LpHVg8FDrwbZnHtV:osR/NhyfotNMCqgeA1LpHVLFDrwbZnH

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MOOBOT has been detected (SURICATA)

Connects to the CnC server

MIRAI has been detected (SURICATA)

SUSPICIOUS

Modifies file or directory owner

Executes the "rm" command to delete files or directories

Connects to unusual port

Contacting a server suspected of hosting an CnC

Potential Corporate Privacy Violation

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings