MalwareBazaar Database

This page shows some basic information the YARA rule Linux_Ancient_Bot including corresponding malware samples.

Database Entry

YARA Rule:Linux_Ancient_Bot
Create hunting rule
Author:KSI Digital
Description:Ancient (ANCT) IoT bot ELF: persistence modules (home_persist, cron_deb, android_rc, rc_local), sysd init script and sys.service unit, toybox/busybox download chain. C2 is built at runtime, so the rule keys on the persistence layer.
Firstseen:2026-10-03 17:42:33 UTC
Lastseen:2026-10-05 00:24:13 UTC
Sightings:10

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter