Analysis date (UTC): 2 February 2025, 07:37Analysis environment: Ubuntu 22.04.2 LTS

bot.x86_64

MD5:EC3D77C5FF9B1B32735523DB9EEAA5C3
SHA1:B2146F9696442CF998E46900DFD886D0291BD17F
SHA256:EC287D35D0E7014FF31EF18AC233C73EB43E12366D7141177C34DE9D25E147B8

Analysis result

Behavior activities

MALICIOUS

Connects to the CnC server

  • bot.x86_64.elf (PID: 38755)

MIRAI has been detected (SURICATA)

  • bot.x86_64.elf (PID: 38755)

SUSPICIOUS

Modifies file or directory owner

  • sudo (PID: 38749)

Connects to unusual port

  • bot.x86_64.elf (PID: 38755)

Contacting a server suspected of hosting an CnC

  • bot.x86_64.elf (PID: 38755)

INFO

No info indicators.

Threats

PIDProcessClassMessage
38755bot.x86_64.elfPotentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
38755bot.x86_64.elfMisc activityET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
38755bot.x86_64.elfMalware Command and Control Activity DetectedET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
——Potentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
——Misc activityET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
——Malware Command and Control Activity DetectedET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
——Potentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
——Misc activityET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
——Malware Command and Control Activity DetectedET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
——Potentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN