| File name: | boatnet.arm7 |
| Full analysis: | https://app.any.run/tasks/934a28b0-02ac-41ec-bd52-3da6045d95d9 |
| Verdict: | Malicious activity |
| Threats: | A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. |
| Analysis date: | August 14, 2025, 17:59:05 |
| OS: | Debian 12.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped |
| MD5: | 3A75F5E28842F5F5B912ADB64C240465 |
| SHA1: | AD2C6AF35C94623C7FC97A016E136BCEB2D8B221 |
| SHA256: | A7DFA89B51B664EFC52597B3070FCABFB3B9AC24E88A395FF31670E005596661 |
| SSDEEP: | 3072:cLDGmOhsyWQiqH2n/EibgrNTM/wY24RjxYik:1mLQhH2n/EibgrxM/wT4RjWik |
| .o | | | ELF Executable and Linkable format (generic) (100) |
|---|
| CPUArchitecture: | 32 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | Arm (up to Armv7/AArch32) |
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1264 | /bin/sh -c "sudo chown user /tmp/boatnet\.arm7\.elf && chmod +x /tmp/boatnet\.arm7\.elf && DISPLAY=:0 sudo -iu user /tmp/boatnet\.arm7\.elf " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1265 | sudo chown user /tmp/boatnet.arm7.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1266 | chown user /tmp/boatnet.arm7.elf | /usr/bin/chown | — | sudo |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1267 | chmod +x /tmp/boatnet.arm7.elf | /usr/bin/chmod | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1268 | sudo -iu user /tmp/boatnet.arm7.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1271 | /tmp/boatnet.arm7.elf | /tmp/boatnet.arm7.elf | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1272 | id -u | /usr/bin/id | — | boatnet.arm7.elf |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1274 | /tmp/boatnet.arm7.elf | /tmp/boatnet.arm7.elf | — | boatnet.arm7.elf |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1275 | /tmp/boatnet.arm7.elf | /tmp/boatnet.arm7.elf | — | boatnet.arm7.elf |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1276 | /tmp/boatnet.arm7.elf | /tmp/boatnet.arm7.elf | boatnet.arm7.elf | |
User: user Integrity Level: UNKNOWN Exit code: 9 | ||||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 148.251.54.81:123 | 2.debian.pool.ntp.org | — | — | whitelisted |
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
1276 | boatnet.arm7.elf | 213.209.150.107:3778 | — | Alsycon B.V. | GB | malicious |
446 | systemd-timesyncd | 85.216.100.221:123 | 2.debian.pool.ntp.org | — | — | whitelisted |
Domain | IP | Reputation |
|---|---|---|
2.debian.pool.ntp.org |
| whitelisted |
google.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1276 | boatnet.arm7.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Possible Mirai.Gen (Linux) |
1276 | boatnet.arm7.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Possible Mirai.Gen (Linux) |