| File name: | boatnet.arm7 |
| Full analysis: | https://app.any.run/tasks/06889758-78e7-416c-91ff-2c16308b0a09 |
| Verdict: | Malicious activity |
| Threats: | A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. |
| Analysis date: | January 10, 2026, 07:46:09 |
| OS: | Debian 12.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header |
| MD5: | BC0C817342FE0B1ADC68D2D76D2E33F2 |
| SHA1: | 4D713B3D4E37E3B0A63584BECE96CB6B4018E96B |
| SHA256: | 2454B591827E78BF8FF728EF6BDA5CAF8B240C6ED856C718407A957E4B8B240C |
| SSDEEP: | 3072:y3H1foKTFG87oa2hbLzns+xcJ28JT1fT1uoTZR6sLT9A1O:yX1f6uOhn9xcJDfT8onTj |
| .o | | | ELF Executable and Linkable format (generic) (100) |
|---|
| CPUArchitecture: | 32 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | Arm (up to Armv7/AArch32) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1385 | /bin/sh -c "sudo chown user /tmp/boatnet\.arm7\.elf && chmod +x /tmp/boatnet\.arm7\.elf && DISPLAY=:0 sudo -iu user /tmp/boatnet\.arm7\.elf " | /usr/bin/dash | — | eOLRkkNCsAxcqyAk | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1386 | sudo chown user /tmp/boatnet.arm7.elf | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1387 | chown user /tmp/boatnet.arm7.elf | /usr/bin/chown | — | sudo | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1388 | chmod +x /tmp/boatnet.arm7.elf | /usr/bin/chmod | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1389 | sudo -iu user /tmp/boatnet.arm7.elf | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1392 | /tmp/boatnet.arm7.elf | /tmp/boatnet.arm7.elf | — | sudo | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1393 | id -u | /usr/bin/id | — | boatnet.arm7.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1398 | /tmp/boatnet.arm7.elf | /tmp/boatnet.arm7.elf | — | boatnet.arm7.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
| 1399 | /tmp/boatnet.arm7.elf | /tmp/boatnet.arm7.elf | — | boatnet.arm7.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
| 1400 | /tmp/boatnet.arm7.elf | /tmp/boatnet.arm7.elf | boatnet.arm7.elf | ||||||||||||
User: user Integrity Level: UNKNOWN Exit code: 9 | |||||||||||||||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
459 | avahi-daemon | 224.0.0.251:5353 | — | — | — | whitelisted |
— | — | 212.132.97.26:123 | 2.debian.pool.ntp.org | IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE. | DE | whitelisted |
1400 | boatnet.arm7.elf | 144.172.110.33:3778 | — | ROUTERHOSTING | US | malicious |
438 | systemd-timesyncd | 212.132.97.26:123 | 2.debian.pool.ntp.org | IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE. | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
2.debian.pool.ntp.org |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1400 | boatnet.arm7.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.B Client Hello |
1400 | boatnet.arm7.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.B Client Hello |
1400 | boatnet.arm7.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Possible Mirai.Gen (Linux) |
1400 | boatnet.arm7.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Possible Mirai.Gen (Linux) |