| File name: | data.arm6 |
| Full analysis: | https://app.any.run/tasks/69eb856f-1ff4-4bf4-96b4-f1fb92980a73 |
| Verdict: | Malicious activity |
| Threats: | A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. |
| Analysis date: | January 31, 2026, 18:26:47 |
| OS: | Debian 12.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, stripped |
| MD5: | 322FFED6BF3F3111C70C28CC97E15A0C |
| SHA1: | 7E8D7C705F5B45CB1DA81334B8F77B3F19529782 |
| SHA256: | 848980BB54A77CEBE70DBE69DA2136F12E9C015C9EEC8D18C732B23F28699A54 |
| SSDEEP: | 12288:VTdrykeaTPLJ1+C5T1PlH8vg5gpuUrhjQEmys:VTdryraTPt1+C5T1PlHig0NjQEhs |
| .o | | | ELF Executable and Linkable format (generic) (100) |
|---|
| CPUArchitecture: | 32 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | Arm (up to Armv7/AArch32) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1276 | /bin/sh -c "sudo chown user /tmp/data\.arm6\.elf && chmod +x /tmp/data\.arm6\.elf && DISPLAY=:0 sudo -iu user /tmp/data\.arm6\.elf " | /usr/bin/dash | — | eOLRkkNCsAxcqyAk | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1277 | sudo chown user /tmp/data.arm6.elf | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1278 | chown user /tmp/data.arm6.elf | /usr/bin/chown | — | sudo | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1279 | chmod +x /tmp/data.arm6.elf | /usr/bin/chmod | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1280 | sudo -iu user /tmp/data.arm6.elf | /usr/bin/sudo | — | dash | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1283 | /tmp/data.arm6.elf | /tmp/data.arm6.elf | — | sudo | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1284 | id -u | /usr/bin/id | — | data.arm6.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 1286 | /tmp/data.arm6.elf | /tmp/data.arm6.elf | — | data.arm6.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
| 1287 | /tmp/data.arm6.elf | /tmp/data.arm6.elf | — | data.arm6.elf | |||||||||||
User: user Integrity Level: UNKNOWN Exit code: 9 | |||||||||||||||
| 1288 | bdi-default | /tmp/data.arm6.elf | data.arm6.elf | ||||||||||||
User: user Integrity Level: UNKNOWN Exit code: 0 | |||||||||||||||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
459 | avahi-daemon | 224.0.0.251:5353 | — | — | — | whitelisted |
— | — | 82.165.178.31:123 | 2.debian.pool.ntp.org | IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE. | DE | whitelisted |
1288 | data.arm6.elf | 130.12.180.108:25565 | cyber-reborn.com | RAILNET | US | unknown |
438 | systemd-timesyncd | 82.165.178.31:123 | 2.debian.pool.ntp.org | IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE. | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
2.debian.pool.ntp.org |
| whitelisted |
cyber-reborn.com |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
1288 | data.arm6.elf | Domain Observed Used for C2 Detected | BOTNET [ANY.RUN] Mirai Botnet CnC related domain (cyber-reborn .com) |
1288 | data.arm6.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.K Client Hello |
1288 | data.arm6.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen heartbeat packet outbound |
1288 | data.arm6.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Linux/Mirai.Gen heartbeat packet inbound |