| File name: | bot.armv7l |
| Full analysis: | https://app.any.run/tasks/a60215bc-1c8d-4055-ae26-3a4a2e30efa0 |
| Verdict: | Malicious activity |
| Analysis date: | August 14, 2025, 23:00:22 |
| OS: | Debian 12.2 |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped |
| MD5: | 839C887C88E89DD3727104F5EA6CECDC |
| SHA1: | 7392AF7CB4E44446D23B050A12E5BC9326C620E2 |
| SHA256: | 3D2197FFFCF40449C05F9B4DBD995534D8EA7D0954DCAE563322CCBF67929352 |
| SSDEEP: | 6144:om6jHQLM5jlUn7IxcgndJN9eTELtL5nmV/Vv0mp2RQZ4I1:oljHQLqdJLYsU/CmpoQZ4I1 |
MALICIOUS
MIRAI has been detected (SURICATA)
- bot.armv7l.elf (PID: 1277)
SUSPICIOUS
Modifies file or directory owner
- sudo (PID: 1263)
Reads network configuration
- sudo (PID: 1266)
Executes commands using command-line interpreter
- sudo (PID: 1266)
Connects to unusual port
- bot.armv7l.elf (PID: 1277)
Contacting a server suspected of hosting an CnC
- bot.armv7l.elf (PID: 1277)
Gets active network interfaces
- sudo (PID: 1266)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .o | | | ELF Executable and Linkable format (generic) (100) |
|---|
EXIF
EXE
| CPUArchitecture: | 32 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | Arm (up to Armv7/AArch32) |
Total processes
205
Monitored processes
11
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1262 | /bin/sh -c "sudo chown user /tmp/bot\.armv7l\.elf && chmod +x /tmp/bot\.armv7l\.elf && DISPLAY=:0 sudo -iu user /tmp/bot\.armv7l\.elf " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1263 | sudo chown user /tmp/bot.armv7l.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1264 | chown user /tmp/bot.armv7l.elf | /usr/bin/chown | — | sudo |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1265 | chmod +x /tmp/bot.armv7l.elf | /usr/bin/chmod | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1266 | sudo -iu user /tmp/bot.armv7l.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1270 | /tmp/bot.armv7l.elf | /tmp/bot.armv7l.elf | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1272 | id -u | /usr/bin/id | — | bot.armv7l.elf |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1275 | /bin/sh -c "command -v curl >/dev/null 2>&1" | /usr/bin/dash | — | bot.armv7l.elf |
User: user Integrity Level: UNKNOWN Exit code: 32512 | ||||
| 1276 | /tmp/bot.armv7l.elf | /tmp/bot.armv7l.elf | — | bot.armv7l.elf |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1277 | /tmp/bot.armv7l.elf | /tmp/bot.armv7l.elf | bot.armv7l.elf | |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1270 | bot.armv7l.elf | /home/user/.config/autostart/misiubomba.desktop | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
4
Threats
3
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 129.250.35.251:123 | 2.debian.pool.ntp.org | — | — | whitelisted |
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
1277 | bot.armv7l.elf | 87.121.84.206:3072 | — | SKAT TV Ltd. | BG | malicious |
446 | systemd-timesyncd | 85.215.229.230:123 | 2.debian.pool.ntp.org | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
2.debian.pool.ntp.org |
| whitelisted |
google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1277 | bot.armv7l.elf | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 13 |
1277 | bot.armv7l.elf | Misc Attack | ET DROP Dshield Block Listed Source group 1 |
1277 | bot.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Possible Mirai.Gen (Linux) |