| File name: | bot.armv7l |
| Full analysis: | https://app.any.run/tasks/b9a17d69-a854-4d0c-b466-98975cfba0c4 |
| Verdict: | Malicious activity |
| Threats: | A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. |
| Analysis date: | October 18, 2025, 15:50:02 |
| OS: | Debian 12.2 |
| Tags: | |
| Indicators: | |
| MIME: | application/x-executable |
| File info: | ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped |
| MD5: | EACD273C38B5373576185DC3F13B02CC |
| SHA1: | A5568F63DD186BEA05EE021E0B1DCCAEAFDE0D2A |
| SHA256: | EAF3447663D95584650861C8C2AFA0CCEFF6DF64E0215B27EBBFA777A0C65EC7 |
| SSDEEP: | 1536:yt9VQaNrWqy5ochbi7UHtqNBfK9uEMNENNlxnNm0sT7:cAgyScc7iUBfK9vMNENlnN |
| .o | | | ELF Executable and Linkable format (generic) (100) |
|---|
| CPUArchitecture: | 32 bit |
|---|---|
| CPUByteOrder: | Little endian |
| ObjectFileType: | Executable file |
| CPUType: | Arm (up to Armv7/AArch32) |
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2141 | /bin/sh -c "sudo chown user /tmp/bot\.armv7l\.elf && chmod +x /tmp/bot\.armv7l\.elf && DISPLAY=:0 sudo -iu user /tmp/bot\.armv7l\.elf " | /usr/bin/dash | — | any-guest-agent |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2142 | sudo chown user /tmp/bot.armv7l.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2143 | chown user /tmp/bot.armv7l.elf | /usr/bin/chown | — | sudo |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2144 | chmod +x /tmp/bot.armv7l.elf | /usr/bin/chmod | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2145 | sudo -iu user /tmp/bot.armv7l.elf | /usr/bin/sudo | — | dash |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2147 | /tmp/bot.armv7l.elf | /tmp/bot.armv7l.elf | — | sudo |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2149 | id -u | /usr/bin/id | — | bot.armv7l.elf |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2152 | /tmp/bot.armv7l.elf | /tmp/bot.armv7l.elf | — | bot.armv7l.elf |
User: user Integrity Level: UNKNOWN Exit code: 1 | ||||
| 2153 | dhclient | /tmp/bot.armv7l.elf | bot.armv7l.elf | |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2154 | dhclient | /tmp/bot.armv7l.elf | — | bot.armv7l.elf |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
481 | avahi-daemon | 224.0.0.251:5353 | — | — | — | whitelisted |
2155 | bot.armv7l.elf | 160.23.178.85:23 | — | Seinan Gakuin University | JP | unknown |
2155 | bot.armv7l.elf | 129.162.151.33:23 | — | SWRI | US | unknown |
2155 | bot.armv7l.elf | 23.41.165.96:23 | — | AKAMAI-AS | US | unknown |
2155 | bot.armv7l.elf | 81.205.192.40:23 | — | KPN B.V. | NL | unknown |
2155 | bot.armv7l.elf | 131.136.229.108:23 | — | SSC-299-Z-74 | CA | unknown |
2155 | bot.armv7l.elf | 16.61.219.136:23 | — | — | US | unknown |
2155 | bot.armv7l.elf | 136.155.240.63:23 | — | Region Stockholm | SE | unknown |
2155 | bot.armv7l.elf | 124.222.192.148:23 | — | Shenzhen Tencent Computer Systems Company Limited | CN | unknown |
2155 | bot.armv7l.elf | 182.9.24.80:23 | — | PT. Telekomunikasi Selular | ID | unknown |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
SENHOSERTAKESSORROWBOTS2025WORKINGTUTORIAL.fawkingblodibastard.ru |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
2155 | bot.armv7l.elf | Potential Corporate Privacy Violation | POLICY [ANY.RUN] Attempting to SSH scan external network |
2153 | bot.armv7l.elf | Misc Attack | ET CINS Active Threat Intelligence Poor Reputation IP group 5 |
2153 | bot.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Mirai Initial Packet |
2153 | bot.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Mirai Initial Packet |
2153 | bot.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Mirai Initial Packet |
2153 | bot.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Mirai Initial Packet |
2155 | bot.armv7l.elf | Potential Corporate Privacy Violation | POLICY [ANY.RUN] Attempting to SSH scan external network |
2153 | bot.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Mirai Initial Packet |
2153 | bot.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Mirai Initial Packet |
2153 | bot.armv7l.elf | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Mirai Initial Packet |