File name:

iran.powerpc

Full analysis: https://app.any.run/tasks/e5c19e32-56cd-433e-ac3f-0fff95933d48
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Analysis date: May 27, 2026, 20:52:34
OS: Ubuntu 22.04.2
Tags:
auto
mirai
botnet
Indicators:
MIME: application/x-executable
File info: ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV)
MD5:

DD012C4DB19389386F76B82A55260DB7

SHA1:

3F5F6CA2793FE9FF69ECDD2386F0AEE6EBF221FF

SHA256:

4F675107416CD512D3F6120C34A6EA2C765A471DB9D3C0D8CB30A7469B619CB9

SSDEEP:

1536:hDr2QFF4EvZFZbWXEQqTzOhRpeBWvaUq+N1WyPS3uvbcGDRHH7ZTJvcxME80KpTS:cK3FZqXEPzOviUq+ZdDBmTYjqP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.o | ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture: 32 bit
CPUByteOrder: Big endian
ObjectFileType: Executable file
CPUType: PowerPC
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
5
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
3179/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus /tmp/iran\.powerpc\.o "/usr/bin/dashN00yyFAAJQjQ6JFp
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
3180sudo -iu user nautilus /tmp/iran.powerpc.o/usr/bin/sudodash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
3181nautilus /tmp/iran.powerpc.o/usr/bin/nautilussudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libnautilus-extension.so.1.5.0
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
/usr/lib/x86_64-linux-gnu/libgtk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libgdk-3.so.0.2404.29
/usr/lib/x86_64-linux-gnu/libpango-1.0.so.0.5000.6
/usr/lib/x86_64-linux-gnu/libatk-1.0.so.0.23609.1
/usr/lib/x86_64-linux-gnu/libcairo-gobject.so.2.11600.0
/usr/lib/x86_64-linux-gnu/libcairo.so.2.11600.0
3182/usr/bin/locale-check C.UTF-8/usr/bin/locale-checknautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
3202/lib/systemd/systemd-hostnamed/usr/lib/systemd/systemd-hostnamedsystemd
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301
/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
/usr/lib/x86_64-linux-gnu/libcap.so.2.44
/usr/lib/x86_64-linux-gnu/libcrypt.so.1.1.0
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
/usr/lib/x86_64-linux-gnu/libip4tc.so.2.0.0
/usr/lib/x86_64-linux-gnu/libkmod.so.2.3.7
/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
/usr/lib/x86_64-linux-gnu/libmount.so.1.1.0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
457
NetworkManager
GET
204
91.189.91.98:80
http://connectivity-check.ubuntu.com/
GB
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
452
avahi-daemon
224.0.0.251:5353
whitelisted
185.125.190.99:80
connectivity-check.ubuntu.com
CANONICAL-AS
GB
whitelisted
37.19.194.80:443
odrs.gnome.org
CDN77 _
GB
whitelisted
185.125.188.55:443
api.snapcraft.io
CANONICAL-AS
GB
whitelisted
457
NetworkManager
91.189.91.98:80
connectivity-check.ubuntu.com
CANONICAL-AS
GB
whitelisted
415
systemd-timesyncd
185.125.190.57:123
CANONICAL-AS
GB
whitelisted
415
systemd-timesyncd
185.125.190.58:123
CANONICAL-AS
GB
whitelisted

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 185.125.190.99
  • 91.189.91.97
  • 185.125.190.101
  • 91.189.91.96
  • 91.189.91.98
  • 185.125.190.100
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::1099
  • 2620:2d:4002:1::196
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::1101
  • 2620:2d:4000:1::1100
whitelisted
google.com
  • 192.178.183.102
  • 192.178.183.100
  • 192.178.183.113
  • 192.178.183.138
  • 192.178.183.101
  • 192.178.183.139
  • 2a00:1450:4001:c25::66
  • 2a00:1450:4001:c25::65
  • 2a00:1450:4001:c25::71
  • 2a00:1450:4001:c25::8a
whitelisted
odrs.gnome.org
  • 37.19.194.80
  • 79.127.211.90
  • 79.127.216.203
  • 195.181.175.41
  • 212.102.56.179
  • 195.181.170.19
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c77a::48
  • 2a02:6ea0:c77a::47
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::101
whitelisted
api.snapcraft.io
  • 185.125.188.55
  • 185.125.188.58
  • 185.125.188.57
  • 185.125.188.60
  • 185.125.188.54
  • 185.125.188.59
  • 2620:2d:4000:1010::117
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::2cc
  • 2620:2d:4000:1010::6d
whitelisted
6.100.168.192.in-addr.arpa
whitelisted

Threats

No threats detected
No debug info