ANY.RUN Interactive Sandbox
- Full browser-level visibility into phishing
- Huge database of samples and IOCs
- Interactivity in a safe environment
- Actionable Tier 1 reports
Get full visibility into malware and phishing behavior in a safe environment.
| File name: | dlr.arm7 |
| Full analysis: | https://app.any.run/tasks/1366d1e9-c44d-43c9-96fb-91d3c0624120 |
| Verdict: | Malicious activity |
| Analysis date: | October 25, 2025, 19:27:09 |
| OS: | Debian 12.2 |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header |
| MD5: | B3012126081F0E166BB5DF8E23D48BC6 |
| SHA1: | E2E61B7DADCF0BAD2DC0E23E7A2F3942561F91A3 |
| SHA256: | BF0B7A3BAB54D71D6EC17E19E603671F36325BA0701499EDDA0163A35FAD3FA7 |
| SSDEEP: | 3072:pkgTFI69CuNLM5wb6SRkjVbgUl59B6DZbT:pva6jNw5wmS2Ws5Av |
MALICIOUS
MIRAI has been detected (SURICATA)
- dlr.arm7.elf (deleted) (PID: 2083)
SUSPICIOUS
Modifies file or directory owner
- sudo (PID: 2071)
Contacting a server suspected of hosting an CnC
- dlr.arm7.elf (deleted) (PID: 2083)
Connects to unusual port
- dlr.arm7.elf (deleted) (PID: 2083)
Starts itself from another location
- dlr.arm7.elf (PID: 2077)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .o | | | ELF Executable and Linkable format (generic) (100) |
|---|
EXIF
EXE
| CPUArchitecture: | 32 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | Arm (up to Armv7/AArch32) |
Total processes
202
Monitored processes
10
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2070 | /bin/sh -c "sudo chown user /tmp/dlr\.arm7\.elf && chmod +x /tmp/dlr\.arm7\.elf && DISPLAY=:0 sudo -iu user /tmp/dlr\.arm7\.elf " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2071 | sudo chown user /tmp/dlr.arm7.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2072 | chown user /tmp/dlr.arm7.elf | /usr/bin/chown | — | sudo |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2073 | chmod +x /tmp/dlr.arm7.elf | /usr/bin/chmod | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2074 | sudo -iu user /tmp/dlr.arm7.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2077 | /tmp/dlr.arm7.elf | /tmp/dlr.arm7.elf | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2079 | id -u | /usr/bin/id | — | dlr.arm7.elf |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2083 | dalqlffqnhlq .elf | /tmp/dlr.arm7.elf (deleted) | dlr.arm7.elf | |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2084 | dalqlffqnhlq .elf | /tmp/dlr.arm7.elf (deleted) | — | dlr.arm7.elf (deleted) |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2085 | dalqlffqnhlq .elf | /tmp/dlr.arm7.elf (deleted) | — | dlr.arm7.elf (deleted) |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
2
Threats
2
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
481 | avahi-daemon | 224.0.0.251:5353 | — | — | — | whitelisted |
2083 | dlr.arm7.elf (deleted) | 213.209.143.62:1348 | — | Moon Dc | DE | unknown |
447 | systemd-timesyncd | 168.119.211.223:123 | — | — | — | unknown |
447 | systemd-timesyncd | 94.130.184.193:123 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2083 | dlr.arm7.elf (deleted) | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Possible Mirai.Gen (Linux) |
2083 | dlr.arm7.elf (deleted) | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Possible Mirai.Gen (Linux) |