s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-03ddc2c68c69cfe9bd9b965644382ad3086c5babe39d11a89f33a1b6de11530a high

📛 Threat Title

Mirai: bot.mips64

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 1139508 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:05:50.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 03ddc2c68c69cfe9bd9b965644382ad3086c5babe39d11a89f33a1b6de11530a VT 26 / 75

IOC database

Type
hash_sha256
Value
03ddc2c68c69cfe9bd9b965644382ad3086c5babe39d11a89f33a1b6de11530a
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Gen:Variant.Linux.Gafgyt.13
Antiy-AVL malicious Trojan[Exploit]/Linux.CVE-2018-10561
Arcabit malicious Trojan.Linux.Gafgyt.13
Avast malicious ELF:CVE-2021-36260-A [Expl]
Avast-Mobile malicious ELF:Mirai-QL [Trj]
AVG malicious ELF:CVE-2021-36260-A [Expl]
Avira malicious EXP/LINUX.CVE-2021-.A
BitDefender malicious Gen:Variant.Linux.Gafgyt.13
ClamAV malicious Unix.Trojan.Mirai-10004218-0
CTX malicious elf.unknown.gafgyt
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Rootkit.420
Emsisoft malicious Gen:Variant.Linux.Gafgyt.13 (B)
ESET-NOD32 malicious Linux/Mirai.FLD trojan
F-Secure malicious Exploit.EXP/LINUX.CVE-2021-.A
Fortinet malicious Linux/Mirai.REAL!tr
GData malicious Gen:Variant.Linux.Gafgyt.13
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.f
Kaspersky malicious HEUR:Exploit.Linux.CVE-2018-10561.a
Microsoft malicious Backdoor:Linux/Gafgyt.BA!xp
MicroWorld-eScan malicious Gen:Variant.Linux.Gafgyt.13
Rising malicious Backdoor.Mirai/Linux!1.BAFE (CLASSIC)
Tencent malicious Backdoor.Linux.Mirai.yar
Varist malicious E32/Mirai.NS2.gen!Eldorado
VIPRE malicious Gen:Variant.Linux.Gafgyt.13

Details From VirusTotal

Basic Properties
MD5f7a5db093c56e2425ecd539c87b72d65
SHA-1508c1444cf811adc81d40174fb6a06dd862954c7
SHA-25603ddc2c68c69cfe9bd9b965644382ad3086c5babe39d11a89f33a1b6de11530a
VHashf450b1f84114f9c89f749d9473f4ffce
SSDEEP24576:YesFxBjjCsbj4T+VrCMofsWit4spTJrQhKxTCnOKW8u:YesFxwY4T+VrCu4SrgKxTCnzu
TLSHT149357C633F11CF69E314D67048F3C6527AD524A31AE24095B26CC3283A61B6E6D9FFE4
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size1.1 MB
History
First seen on VirusTotal2026-09-25 11:09 UTC
Last submission2026-09-25 11:09 UTC
Last analysis2026-09-25 11:09 UTC
Last modified on VirusTotal2026-09-25 18:09 UTC
Known Names
  • rwqghp.exe
  • bot.mips64.elf
hash_sha1 508c1444cf811adc81d40174fb6a06dd862954c7 VT 26 / 75

IOC database

Type
hash_sha1
Value
508c1444cf811adc81d40174fb6a06dd862954c7
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Gen:Variant.Linux.Gafgyt.13
Antiy-AVL malicious Trojan[Exploit]/Linux.CVE-2018-10561
Arcabit malicious Trojan.Linux.Gafgyt.13
Avast malicious ELF:CVE-2021-36260-A [Expl]
Avast-Mobile malicious ELF:Mirai-QL [Trj]
AVG malicious ELF:CVE-2021-36260-A [Expl]
Avira malicious EXP/LINUX.CVE-2021-.A
BitDefender malicious Gen:Variant.Linux.Gafgyt.13
ClamAV malicious Unix.Trojan.Mirai-10004218-0
CTX malicious elf.unknown.gafgyt
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Rootkit.420
Emsisoft malicious Gen:Variant.Linux.Gafgyt.13 (B)
ESET-NOD32 malicious Linux/Mirai.FLD trojan
F-Secure malicious Exploit.EXP/LINUX.CVE-2021-.A
Fortinet malicious Linux/Mirai.REAL!tr
GData malicious Gen:Variant.Linux.Gafgyt.13
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.f
Kaspersky malicious HEUR:Exploit.Linux.CVE-2018-10561.a
Microsoft malicious Backdoor:Linux/Gafgyt.BA!xp
MicroWorld-eScan malicious Gen:Variant.Linux.Gafgyt.13
Rising malicious Backdoor.Mirai/Linux!1.BAFE (CLASSIC)
Tencent malicious Backdoor.Linux.Mirai.yar
Varist malicious E32/Mirai.NS2.gen!Eldorado
VIPRE malicious Gen:Variant.Linux.Gafgyt.13

Details From VirusTotal

Basic Properties
MD5f7a5db093c56e2425ecd539c87b72d65
SHA-1508c1444cf811adc81d40174fb6a06dd862954c7
SHA-25603ddc2c68c69cfe9bd9b965644382ad3086c5babe39d11a89f33a1b6de11530a
VHashf450b1f84114f9c89f749d9473f4ffce
SSDEEP24576:YesFxBjjCsbj4T+VrCMofsWit4spTJrQhKxTCnOKW8u:YesFxwY4T+VrCu4SrgKxTCnzu
TLSHT149357C633F11CF69E314D67048F3C6527AD524A31AE24095B26CC3283A61B6E6D9FFE4
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size1.1 MB
History
First seen on VirusTotal2026-09-25 11:09 UTC
Last submission2026-09-25 11:09 UTC
Last analysis2026-09-25 11:09 UTC
Last modified on VirusTotal2026-09-25 18:09 UTC
Known Names
  • rwqghp.exe
  • bot.mips64.elf
hash_md5 f7a5db093c56e2425ecd539c87b72d65 VT 26 / 75

IOC database

Type
hash_md5
Value
f7a5db093c56e2425ecd539c87b72d65
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Gen:Variant.Linux.Gafgyt.13
Antiy-AVL malicious Trojan[Exploit]/Linux.CVE-2018-10561
Arcabit malicious Trojan.Linux.Gafgyt.13
Avast malicious ELF:CVE-2021-36260-A [Expl]
Avast-Mobile malicious ELF:Mirai-QL [Trj]
AVG malicious ELF:CVE-2021-36260-A [Expl]
Avira malicious EXP/LINUX.CVE-2021-.A
BitDefender malicious Gen:Variant.Linux.Gafgyt.13
ClamAV malicious Unix.Trojan.Mirai-10004218-0
CTX malicious elf.unknown.gafgyt
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Rootkit.420
Emsisoft malicious Gen:Variant.Linux.Gafgyt.13 (B)
ESET-NOD32 malicious Linux/Mirai.FLD trojan
F-Secure malicious Exploit.EXP/LINUX.CVE-2021-.A
Fortinet malicious Linux/Mirai.REAL!tr
GData malicious Gen:Variant.Linux.Gafgyt.13
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.f
Kaspersky malicious HEUR:Exploit.Linux.CVE-2018-10561.a
Microsoft malicious Backdoor:Linux/Gafgyt.BA!xp
MicroWorld-eScan malicious Gen:Variant.Linux.Gafgyt.13
Rising malicious Backdoor.Mirai/Linux!1.BAFE (CLASSIC)
Tencent malicious Backdoor.Linux.Mirai.yar
Varist malicious E32/Mirai.NS2.gen!Eldorado
VIPRE malicious Gen:Variant.Linux.Gafgyt.13

Details From VirusTotal

Basic Properties
MD5f7a5db093c56e2425ecd539c87b72d65
SHA-1508c1444cf811adc81d40174fb6a06dd862954c7
SHA-25603ddc2c68c69cfe9bd9b965644382ad3086c5babe39d11a89f33a1b6de11530a
VHashf450b1f84114f9c89f749d9473f4ffce
SSDEEP24576:YesFxBjjCsbj4T+VrCMofsWit4spTJrQhKxTCnOKW8u:YesFxwY4T+VrCu4SrgKxTCnzu
TLSHT149357C633F11CF69E314D67048F3C6527AD524A31AE24095B26CC3283A61B6E6D9FFE4
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size1.1 MB
History
First seen on VirusTotal2026-09-25 11:09 UTC
Last submission2026-09-25 11:09 UTC
Last analysis2026-09-25 11:09 UTC
Last modified on VirusTotal2026-09-25 18:09 UTC
Known Names
  • rwqghp.exe
  • bot.mips64.elf

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 1139508 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:05:50.

Remediations (10)

  • A_Survey_on_The_Mirai_IoT_Botnet_and_Its_Recent_Variants (2)
    web:arxiv.org

    Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • Mirai Malware Spreads Via GeoVision Zero-Day Exploit
    web:dailysecurityreview.com

    A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.

  • Mirai Source Code - GitHub
    web:github.com

    Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...

  • Mirai Botnet | ARM Reverse Engineering Walkthrough
    web:trainsec.net

    In this particular case, I found an ARM-compiled Mirai botnet sample. The anti-virus checks labeled it as " Mirai ," matching what I found in the documentation, sandbox analyses, and community threat intelligence sources. Mirai is known to compile variants for multiple architectures (ARM, MIPS, x86, x64, etc.), making it adaptable and widespread.

  • Mirai Botnet Forensic Analysis - Cyber - westoahu.hawaii.edu
    web:westoahu.hawaii.edu

    Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.

  • The Mirai Botnet - Threats and Mitigations - CIS
    web:www.cisecurity.org

    The Mirai botnet soon spread to infect thousands of internet of things (IoT) devices and evolved to conduct full, large-scale attacks. After noticing an increase in infections, Mirai caught the attention of the nonprofit organization MalwareMustDie in August 2016, who then started to research, analyze, and track the botnet [2].

  • PDF Mirai Botnet - Quorum Cyber
    web:www.quorumcyber.com

    Mirai initially infected and weaponised devices such as smart cameras and Realtek routers2. The botnet variant was created in a racketeering attempt by the cofounders of Protraf Solutions, an organisation offering DDoS mitigation services.

  • The evolution of Mirai botnet scans over a six-year period
    web:www.sciencedirect.com

    In the specific context of Mirai botnet detection and mitigation , several approaches have been presented in the literature. Some works focus on studying the behavior of the Mirai botnet, examining and monitoring its propagation and impact within networked systems [85], [86], [87].

  • Akamai SIRT Identifies Zerobot Botnet Exploiting n8n and Tenda ...
    web:www.threatintelreport.com

    YARA rule Mirai_Malware_IOCs_1 detects strings including "bruh why again", "mamakmukekkontol" and the listed domains and hashes. Mitigation Recommendations Upgrade n8n immediately to version 1.122.0 or later. Update Tenda AC1206 firmware or isolate devices from the internet. Block all listed IOCs at network perimeter and endpoint layers.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.