| File name: | arm7.uhavenobotsxd |
| Full analysis: | https://app.any.run/tasks/7bcc58cb-11ea-4507-9e30-5af4b6a8dad5 |
| Verdict: | Malicious activity |
| Threats: | A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. |
| Analysis date: | November 06, 2025, 05:54:28 |
| OS: | Debian 12.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped |
| MD5: | C90067AFBA502E812999FBB5B018ACDF |
| SHA1: | AA2BBBFF17BF27E2400335CA519E4EDE1B83CA97 |
| SHA256: | 683B7FCB91A3D1482B707933F25D7902E318401958E04880D24803BEA2EAA524 |
| SSDEEP: | 3072:+65qStHKpKw51H3qWXw1N6tZe1AM/1hCV/:RHHo61N2Ze2M/Tk |
| .o | | | ELF Executable and Linkable format (generic) (100) |
|---|
| CPUArchitecture: | 32 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | Arm (up to Armv7/AArch32) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1308 | /bin/sh -c "sudo chown user /tmp/arm7\.uhavenobotsxd\.elf && chmod +x /tmp/arm7\.uhavenobotsxd\.elf && DISPLAY=:0 sudo -iu user /tmp/arm7\.uhavenobotsxd\.elf " | /usr/bin/dash | — | O4np7NL7eDTfcokD | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1309 | sudo chown user /tmp/arm7.uhavenobotsxd.elf | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1310 | chown user /tmp/arm7.uhavenobotsxd.elf | /usr/bin/chown | — | sudo | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1311 | chmod +x /tmp/arm7.uhavenobotsxd.elf | /usr/bin/chmod | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1312 | sudo -iu user /tmp/arm7.uhavenobotsxd.elf | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1314 | /tmp/arm7.uhavenobotsxd.elf | /tmp/arm7.uhavenobotsxd.elf | — | sudo | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1316 | id -u | /usr/bin/id | — | arm7.uhavenobotsxd.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1318 | tmp/arm7.uhavenobotsxd.elf | /tmp/arm7.uhavenobotsxd.elf | arm7.uhavenobotsxd.elf | ||||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
| 1324 | tmp/arm7.uhavenobotsxd.elf | /tmp/arm7.uhavenobotsxd.elf | — | arm7.uhavenobotsxd.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
| 1325 | tmp/arm7.uhavenobotsxd.elf | /tmp/arm7.uhavenobotsxd.elf | — | arm7.uhavenobotsxd.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1612 | gnome-shell | /var/lib/gdm3/.local/share/icc/edid-bb6ad72dc802b000932c73ad20996ae5.icc | binary | |
MD5:— | SHA256:— | |||
| 1318 | arm7.uhavenobotsxd.elf | /tmp/.taunt | text | |
MD5:— | SHA256:— | |||
| 1318 | arm7.uhavenobotsxd.elf | /tmp/.mock | text | |
MD5:— | SHA256:— | |||
| 1318 | arm7.uhavenobotsxd.elf | /tmp/.broken_shell | text | |
MD5:— | SHA256:— | |||
| 1568 | wireplumber | /var/lib/gdm3/.local/state/wireplumber/restore-stream.CZS6E3 | text | |
MD5:— | SHA256:— | |||
| 1612 | gnome-shell | /tmp/.X1024-lock | text | |
MD5:— | SHA256:— | |||
| 1612 | gnome-shell | /tmp/.X1025-lock | text | |
MD5:— | SHA256:— | |||
| 1620 | tracker-miner-fs-3 | /var/lib/gdm3/.cache/tracker3/files/http%3A%2F%2Ftracker.api.gnome.org%2Fontology%2Fv3%2Ftracker%23Pictures.db-wal | binary | |
MD5:— | SHA256:— | |||
| 1620 | tracker-miner-fs-3 | /var/lib/gdm3/.cache/tracker3/files/http%3A%2F%2Ftracker.api.gnome.org%2Fontology%2Fv3%2Ftracker%23Audio.db-wal | binary | |
MD5:— | SHA256:— | |||
| 1620 | tracker-miner-fs-3 | /var/lib/gdm3/.cache/tracker3/files/http%3A%2F%2Ftracker.api.gnome.org%2Fontology%2Fv3%2Ftracker%23Video.db-wal | binary | |
MD5:— | SHA256:— | |||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
467 | avahi-daemon | 224.0.0.251:5353 | — | — | — | whitelisted |
1318 | arm7.uhavenobotsxd.elf | 94.154.35.153:6969 | — | WINDSTREAM | US | malicious |
450 | systemd-timesyncd | 194.59.205.229:123 | — | — | — | unknown |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1318 | arm7.uhavenobotsxd.elf | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 16 |
1318 | arm7.uhavenobotsxd.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Possible Mirai.Gen (Linux) |
1318 | arm7.uhavenobotsxd.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Possible Mirai.Gen (Linux) |