Analysis date (UTC): 18 October 2025, 15:50Analysis environment: Debian 12.2

bot.armv7l

MD5:EACD273C38B5373576185DC3F13B02CC
SHA1:A5568F63DD186BEA05EE021E0B1DCCAEAFDE0D2A
SHA256:EAF3447663D95584650861C8C2AFA0CCEFF6DF64E0215B27EBBFA777A0C65EC7

Analysis result

Threat level:Malicious activity
Tags:
botnetmiraiscansshsshscan

Behavior activities

MALICIOUS

Attempting to scan the network

  • bot.armv7l.elf (PID: 2155)

SSHSCAN has been detected (SURICATA)

  • bot.armv7l.elf (PID: 2155)

Attempting to connect via SSH

  • bot.armv7l.elf (PID: 2155)

MIRAI has been detected (SURICATA)

  • bot.armv7l.elf (PID: 2153)

SUSPICIOUS

Modifies file or directory owner

  • sudo (PID: 2142)

Reads network configuration

  • bot.armv7l.elf (PID: 2147)

Reads /proc/mounts (likely used to find writable filesystems)

  • bot.armv7l.elf (PID: 2152)

Gets active TCP connections

  • bot.armv7l.elf (PID: 2147)

Contacting a server suspected of hosting an CnC

  • bot.armv7l.elf (PID: 2153)

Potential Corporate Privacy Violation

  • bot.armv7l.elf (PID: 2155)

Connects to unusual port

  • bot.armv7l.elf (PID: 2153)

INFO

No info indicators.

Threats

PIDProcessClassMessage
2155bot.armv7l.elfPotential Corporate Privacy ViolationPOLICY [ANY.RUN] Attempting to SSH scan external network
2153bot.armv7l.elfMisc AttackET CINS Active Threat Intelligence Poor Reputation IP group 5
2153bot.armv7l.elfMalware Command and Control Activity DetectedBOTNET [ANY.RUN] Mirai Initial Packet
2153bot.armv7l.elfMalware Command and Control Activity DetectedBOTNET [ANY.RUN] Mirai Initial Packet
2153bot.armv7l.elfMalware Command and Control Activity DetectedBOTNET [ANY.RUN] Mirai Initial Packet
2153bot.armv7l.elfMalware Command and Control Activity DetectedBOTNET [ANY.RUN] Mirai Initial Packet
2155bot.armv7l.elfPotential Corporate Privacy ViolationPOLICY [ANY.RUN] Attempting to SSH scan external network
2153bot.armv7l.elfMalware Command and Control Activity DetectedBOTNET [ANY.RUN] Mirai Initial Packet
2153bot.armv7l.elfMalware Command and Control Activity DetectedBOTNET [ANY.RUN] Mirai Initial Packet
2153bot.armv7l.elfMalware Command and Control Activity DetectedBOTNET [ANY.RUN] Mirai Initial Packet

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN