Find similar analyses in TI Lookup
Analysis date (UTC): 14 August 2025, 23:00Analysis environment: Debian 12.2

bot.armv7l

MD5:839C887C88E89DD3727104F5EA6CECDC
SHA1:7392AF7CB4E44446D23B050A12E5BC9326C620E2
SHA256:3D2197FFFCF40449C05F9B4DBD995534D8EA7D0954DCAE563322CCBF67929352

Analysis result

Threat level:Malicious activity
Full analysis:Analysis bot.armv7l (MD5: 839C887C88E89DD3727104F5EA6CECDC) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

  • bot.armv7l.elf (PID: 1277)

SUSPICIOUS

Modifies file or directory owner

  • sudo (PID: 1263)

Executes commands using command-line interpreter

  • sudo (PID: 1266)

Connects to unusual port

  • bot.armv7l.elf (PID: 1277)

Gets active network interfaces

  • sudo (PID: 1266)

Reads network configuration

  • sudo (PID: 1266)

Contacting a server suspected of hosting an CnC

  • bot.armv7l.elf (PID: 1277)

INFO

No info indicators.

Threats

PIDProcessClassMessage
1277bot.armv7l.elfMisc AttackET DROP Spamhaus DROP Listed Traffic Inbound group 13
1277bot.armv7l.elfMisc AttackET DROP Dshield Block Listed Source group 1
1277bot.armv7l.elfMalware Command and Control Activity DetectedBOTNET [ANY.RUN] Possible Mirai.Gen (Linux)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED