File name:

bot.armv7l

Full analysis: https://app.any.run/tasks/b9a17d69-a854-4d0c-b466-98975cfba0c4
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Analysis date: October 18, 2025, 15:50:02
OS: Debian 12.2
Tags:
botnet
mirai
scan
ssh
sshscan
Indicators:
MIME: application/x-executable
File info: ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
MD5:

EACD273C38B5373576185DC3F13B02CC

SHA1:

A5568F63DD186BEA05EE021E0B1DCCAEAFDE0D2A

SHA256:

EAF3447663D95584650861C8C2AFA0CCEFF6DF64E0215B27EBBFA777A0C65EC7

SSDEEP:

1536:yt9VQaNrWqy5ochbi7UHtqNBfK9uEMNENNlxnNm0sT7:cAgyScc7iUBfK9vMNENlnN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • MIRAI has been detected (SURICATA)

      • bot.armv7l.elf (PID: 2153)
    • Attempting to scan the network

      • bot.armv7l.elf (PID: 2155)
    • SSHSCAN has been detected (SURICATA)

      • bot.armv7l.elf (PID: 2155)
    • Attempting to connect via SSH

      • bot.armv7l.elf (PID: 2155)
  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 2142)
    • Reads network configuration

      • bot.armv7l.elf (PID: 2147)
    • Gets active TCP connections

      • bot.armv7l.elf (PID: 2147)
    • Reads /proc/mounts (likely used to find writable filesystems)

      • bot.armv7l.elf (PID: 2152)
    • Contacting a server suspected of hosting an CnC

      • bot.armv7l.elf (PID: 2153)
    • Potential Corporate Privacy Violation

      • bot.armv7l.elf (PID: 2155)
    • Connects to unusual port

      • bot.armv7l.elf (PID: 2153)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.o | ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture: 32 bit
CPUByteOrder: Little endian
ObjectFileType: Executable file
CPUType: Arm (up to Armv7/AArch32)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
201
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
2141/bin/sh -c "sudo chown user /tmp/bot\.armv7l\.elf && chmod +x /tmp/bot\.armv7l\.elf && DISPLAY=:0 sudo -iu user /tmp/bot\.armv7l\.elf "/usr/bin/dashany-guest-agent
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2142sudo chown user /tmp/bot.armv7l.elf/usr/bin/sudodash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2143chown user /tmp/bot.armv7l.elf/usr/bin/chownsudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2144chmod +x /tmp/bot.armv7l.elf/usr/bin/chmoddash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2145sudo -iu user /tmp/bot.armv7l.elf/usr/bin/sudodash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2147/tmp/bot.armv7l.elf/tmp/bot.armv7l.elfsudo
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
2149id -u/usr/bin/idbot.armv7l.elf
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
2152/tmp/bot.armv7l.elf/tmp/bot.armv7l.elfbot.armv7l.elf
User:
user
Integrity Level:
UNKNOWN
Exit code:
1
2153dhclient /tmp/bot.armv7l.elf
bot.armv7l.elf
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
2154dhclient /tmp/bot.armv7l.elfbot.armv7l.elf
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
35 072
DNS requests
80
Threats
160

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
481
avahi-daemon
224.0.0.251:5353
whitelisted
2155
bot.armv7l.elf
160.23.178.85:23
Seinan Gakuin University
JP
unknown
2155
bot.armv7l.elf
129.162.151.33:23
SWRI
US
unknown
2155
bot.armv7l.elf
23.41.165.96:23
AKAMAI-AS
US
unknown
2155
bot.armv7l.elf
81.205.192.40:23
KPN B.V.
NL
unknown
2155
bot.armv7l.elf
131.136.229.108:23
SSC-299-Z-74
CA
unknown
2155
bot.armv7l.elf
16.61.219.136:23
US
unknown
2155
bot.armv7l.elf
136.155.240.63:23
Region Stockholm
SE
unknown
2155
bot.armv7l.elf
124.222.192.148:23
Shenzhen Tencent Computer Systems Company Limited
CN
unknown
2155
bot.armv7l.elf
182.9.24.80:23
PT. Telekomunikasi Selular
ID
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
  • 2a00:1450:4001:80f::200e
whitelisted
SENHOSERTAKESSORROWBOTS2025WORKINGTUTORIAL.fawkingblodibastard.ru
  • 5.253.86.21
unknown

Threats

PID
Process
Class
Message
2155
bot.armv7l.elf
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Attempting to SSH scan external network
2153
bot.armv7l.elf
Misc Attack
ET CINS Active Threat Intelligence Poor Reputation IP group 5
2153
bot.armv7l.elf
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Mirai Initial Packet
2153
bot.armv7l.elf
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Mirai Initial Packet
2153
bot.armv7l.elf
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Mirai Initial Packet
2153
bot.armv7l.elf
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Mirai Initial Packet
2155
bot.armv7l.elf
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Attempting to SSH scan external network
2153
bot.armv7l.elf
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Mirai Initial Packet
2153
bot.armv7l.elf
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Mirai Initial Packet
2153
bot.armv7l.elf
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Mirai Initial Packet
No debug info