MB-af98bf71fa326f58e7e4f370cd16c030aaca2159538f630c2f158f87c6a94f7b
high
📛 Threat Title
Mirai: bot.armv7l
Description
File type: elf. Size: 1013228 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:38:23.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
af98bf71fa326f58e7e4f370cd16c030aaca2159538f630c2f158f87c6a94f7b
VT 26 / 75
IOC database
- Type
- hash_sha256
- Value
af98bf71fa326f58e7e4f370cd16c030aaca2159538f630c2f158f87c6a94f7b- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 26 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| ALYac | malicious | Gen:Variant.Linux.Gafgyt.13 |
| Antiy-AVL | malicious | Trojan[Exploit]/Linux.CVE-2018-10561 |
| Arcabit | malicious | Trojan.Linux.Gafgyt.13 |
| Avast | malicious | ELF:Hajime-Q [Trj] |
| Avast-Mobile | malicious | ELF:Mirai-QL [Trj] |
| AVG | malicious | ELF:Hajime-Q [Trj] |
| Avira | malicious | TR/LINUX.Hajime.Q |
| BitDefender | malicious | Gen:Variant.Linux.Gafgyt.13 |
| CTX | malicious | elf.unknown.gafgyt |
| Cynet | malicious | Malicious (score: 99) |
| DrWeb | malicious | Linux.Rootkit.420 |
| Emsisoft | malicious | Gen:Variant.Linux.Gafgyt.13 (B) |
| ESET-NOD32 | malicious | Linux/Mirai.FLD trojan |
| F-Secure | malicious | Trojan.TR/LINUX.Hajime.Q |
| Fortinet | malicious | Linux/Mirai.REAL!tr |
| GData | malicious | Gen:Variant.Linux.Gafgyt.13 |
| malicious | Detected |
|
| huorong | malicious | Trojan/Linux.Mirai.f |
| Ikarus | malicious | Trojan.Linux.Mirai |
| Kaspersky | malicious | HEUR:Exploit.Linux.CVE-2018-10561.a |
| Microsoft | malicious | Backdoor:Linux/Gafgyt.BA!xp |
| MicroWorld-eScan | malicious | Gen:Variant.Linux.Gafgyt.13 |
| Rising | malicious | Backdoor.Mirai/Linux!1.BAFE (CLASSIC) |
| SentinelOne | malicious | Static AI - Malicious ELF |
| Tencent | malicious | Backdoor.Linux.Mirai.yar |
| VIPRE | malicious | Gen:Variant.Linux.Gafgyt.13 |
Details From VirusTotal
Basic Properties
| MD5 | 2a32fc4bb25383b3de26cc5d2dad12f4 |
| SHA-1 | 73140e600d6aee264cf8bfcc04a72a50b6ec5188 |
| SHA-256 | af98bf71fa326f58e7e4f370cd16c030aaca2159538f630c2f158f87c6a94f7b |
| VHash | f48ca1cd65b8a8cf4aba295d5716deeb |
| SSDEEP | 24576:zkgJ32jpc+SrNUCSfc+Fp4Wop9657yD/hGnm5:r4f1L89657yDAm5 |
| TLSH | T159254B54F890DF63C5D46B7AF65E82A833234778C3E7720699148B383B97A5F0B3A641 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped |
| File size | 989.5 KB |
History
| First seen on VirusTotal | 2026-09-25 11:41 UTC |
| Last submission | 2026-09-25 11:41 UTC |
| Last analysis | 2026-09-25 11:41 UTC |
| Last modified on VirusTotal | 2026-09-25 13:47 UTC |
Known Names
a779z08.exebot.armv7l.elf
hash_sha1
73140e600d6aee264cf8bfcc04a72a50b6ec5188
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/73140e600d6aee264cf8bfcc04a72a50b6ec5188
IOC database
- Type
- hash_sha1
- Value
73140e600d6aee264cf8bfcc04a72a50b6ec5188- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/73140e600d6aee264cf8bfcc04a72a50b6ec5188
hash_md5
2a32fc4bb25383b3de26cc5d2dad12f4
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/2a32fc4bb25383b3de26cc5d2dad12f4
IOC database
- Type
- hash_md5
- Value
2a32fc4bb25383b3de26cc5d2dad12f4- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/2a32fc4bb25383b3de26cc5d2dad12f4
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 1013228 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:38:23.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:arxiv.org
Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...
-
web:dailysecurityreview.com
A new Mirai botnet is using zero-day exploits to target industrial routers and smart home devices, launching high-intensity DDoS attacks. Learn about the vulnerabilities and how to protect your systems.
-
web:github.com
Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...
-
web:trainsec.net
Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...
-
web:unit42.paloaltonetworks.com
Mirai is a still-active botnet with new variants. We highlight observed exploitation of IoT vulnerabilities — due to low complexity and high impact.
-
web:www.akamai.com
Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .
-
web:www.joesandbox.com
Signatures Detected Mirai Sample tries to kill a massive number of system processes Suricata IDS alerts for network traffic Drops files in suspicious directories Executes the "crontab" command typically for achieving persistence Sample deletes itself Sample tries to kill multiple processes (SIGKILL) Sample tries to persist itself using System V runlevels Sample tries to persist itself using ...
-
web:www.joesandbox.com
Signatures Antivirus detection for dropped file Detected Mirai Found malware configuration Malicious sample detected (through community Yara rule) Sample tries to kill a massive number of system processes Suricata IDS alerts for network traffic Yara detected Gafgyt Connects to many ports of the same IP (likely port scanning) Drops files in suspicious directories Executes the "crontab" command ...
-
web:www.sciencedirect.com
In the specific context of Mirai botnet detection and mitigation , several approaches have been presented in the literature. Some works focus on studying the behavior of the Mirai botnet, examining and monitoring its propagation and impact within networked systems [85], [86], [87].
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.