ANY.RUN Interactive Sandbox
- Full browser-level visibility into phishing
- Huge database of samples and IOCs
- Interactivity in a safe environment
- Actionable Tier 1 reports
Get full visibility into malware and phishing behavior in a safe environment.
| File name: | bot.armv5l |
| Full analysis: | https://app.any.run/tasks/2939b232-662c-4fb5-a7e2-1794b65f905b |
| Verdict: | Malicious activity |
| Threats: | A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. |
| Analysis date: | August 14, 2025, 18:49:08 |
| OS: | Debian 12.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped |
| MD5: | A6E8AE770036A27DF965B994ED99640C |
| SHA1: | 6DE98DE52ECFC3AA839F672CE3524659A51A5F97 |
| SHA256: | E3AEE6623E61A458C649A7E6114B1DDE1812DAF3E24D87C7BBCA9D38A26B624E |
| SSDEEP: | 1536:K289RzbrIs3yjnK8twyW24D5in/uSWRJ9:K3mCW7GSKJ9 |
| .o | | | ELF Executable and Linkable format (generic) (100) |
|---|
| CPUArchitecture: | 32 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | Arm (up to Armv7/AArch32) |
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1260 | /bin/sh -c "sudo chown user /tmp/bot\.armv5l\.elf && chmod +x /tmp/bot\.armv5l\.elf && DISPLAY=:0 sudo -iu user /tmp/bot\.armv5l\.elf " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 32256 | ||||
| 1261 | sudo chown user /tmp/bot.armv5l.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1262 | chown user /tmp/bot.armv5l.elf | /usr/bin/chown | — | sudo |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1263 | chmod +x /tmp/bot.armv5l.elf | /usr/bin/chmod | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 1264 | sudo -iu user /tmp/bot.armv5l.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 32256 | ||||
| 1267 | -bash --login -c \/tmp\/bot\.armv5l\.elf | /usr/bin/bash | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 32256 | ||||
| 1268 | id -u | /usr/bin/id | — | bash |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 144.76.76.107:123 | 2.debian.pool.ntp.org | — | — | whitelisted |
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
446 | systemd-timesyncd | 144.76.76.107:123 | 2.debian.pool.ntp.org | — | — | whitelisted |
Domain | IP | Reputation |
|---|---|---|
2.debian.pool.ntp.org |
| whitelisted |
google.com |
| whitelisted |