| File name: | iran.armv7l |
| Full analysis: | https://app.any.run/tasks/34be4691-faf1-4a7d-9a77-3c438f1b3ab8 |
| Verdict: | Malicious activity |
| Threats: | A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. |
| Analysis date: | February 13, 2026, 20:14:52 |
| OS: | Debian 12.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped |
| MD5: | DBC1ADEF4B52A9A3C312DD67D576D129 |
| SHA1: | 8CCF2ED54464D2213F206E8098502FF47D9171CE |
| SHA256: | 15D91619E057771F5B006FDFA9EC842A213FA1022D5A2060813B81C200B24012 |
| SSDEEP: | 3072:NU/2oSnuEKnMyVWneR+zpEgXZlgnuESdNrRH33s6p:NU/2Z74/+zmgJlgnuESdNrRH33s6p |
| .o | | | ELF Executable and Linkable format (generic) (100) |
|---|
| CPUArchitecture: | 32 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | Arm (up to Armv7/AArch32) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1284 | /bin/sh -c "sudo chown user /tmp/iran\.armv7l\.elf && chmod +x /tmp/iran\.armv7l\.elf && DISPLAY=:0 sudo -iu user /tmp/iran\.armv7l\.elf " | /usr/bin/dash | — | Ue2Gpj9VHeCVU2RW | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1285 | sudo chown user /tmp/iran.armv7l.elf | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1286 | chown user /tmp/iran.armv7l.elf | /usr/bin/chown | — | sudo | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1287 | chmod +x /tmp/iran.armv7l.elf | /usr/bin/chmod | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1288 | sudo -iu user /tmp/iran.armv7l.elf | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1291 | /tmp/iran.armv7l.elf | /tmp/iran.armv7l.elf | — | sudo | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1292 | id -u | /usr/bin/id | — | iran.armv7l.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1295 | /tmp/iran.armv7l.elf | /tmp/iran.armv7l.elf | — | iran.armv7l.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
| 1296 | /tmp/iran.armv7l.elf | /tmp/iran.armv7l.elf | iran.armv7l.elf | ||||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
| 1317 | /bin/sh -c "cd / && run-parts --report /etc/cron\.hourly" | /usr/bin/dash | — | cron | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | whitelisted |
— | — | 152.53.15.80:123 | 2.debian.pool.ntp.org | NETCUP-AS netcup GmbH | DE | whitelisted |
1296 | iran.armv7l.elf | 130.12.180.85:7080 | — | OMEGATECH-AS | SC | unknown |
445 | systemd-timesyncd | 152.53.15.80:123 | 2.debian.pool.ntp.org | NETCUP-AS netcup GmbH | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
2.debian.pool.ntp.org |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1296 | iran.armv7l.elf | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 24 |
1296 | iran.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen CnC packet outbound |
1296 | iran.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen CnC packet outbound |
1296 | iran.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen CnC packet outbound |
1296 | iran.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen CnC packet outbound |
1296 | iran.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen CnC packet outbound |
1296 | iran.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen CnC packet outbound |
1296 | iran.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen CnC packet outbound |
1296 | iran.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen CnC packet outbound |
1296 | iran.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen CnC packet outbound |