Find similar analyses in TI Lookup
Analysis date (UTC): 16 February 2026, 09:17Analysis environment: Debian 12.2

mirai.arm7

MD5:A7EDCE059E27A6F460A2BB2E625400C7
SHA1:ACAC091D056613E14CAB155854DDD5021C5933F4
SHA256:011B013CDE23FE0E24629D4030D95C6880032EB7E16CB6640D4DD1B377F87A50

Analysis result

Threat level:Malicious activity
Full analysis:Analysis mirai.arm7 (MD5: A7EDCE059E27A6F460A2BB2E625400C7) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Reads network configuration

  • mirai.arm7.elf (PID: 1294)

Modifies file or directory owner

  • sudo (PID: 1288)

Gets active TCP connections

  • mirai.arm7.elf (PID: 1294)

INFO

No info indicators.

Threats

PIDProcessClassMessage
1294mirai.arm7.elfPotentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.govt .hu Domain
1294mirai.arm7.elfNot Suspicious TrafficINFO [ANY.RUN] UDP Query to Cloudflare DNS observed
1294mirai.arm7.elfPotentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.govt .hu Domain
1294mirai.arm7.elfNot Suspicious TrafficINFO [ANY.RUN] UDP Query to Cloudflare DNS observed
1294mirai.arm7.elfPotentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.govt .hu Domain
1294mirai.arm7.elfNot Suspicious TrafficINFO [ANY.RUN] UDP Query to Cloudflare DNS observed
1294mirai.arm7.elfPotentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.govt .hu Domain
1294mirai.arm7.elfNot Suspicious TrafficINFO [ANY.RUN] UDP Query to Cloudflare DNS observed
1294mirai.arm7.elfPotentially Bad TrafficET DYN_DNS DYNAMIC_DNS Query to a *.govt .hu Domain
1294mirai.arm7.elfNot Suspicious TrafficINFO [ANY.RUN] UDP Query to Cloudflare DNS observed

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED