s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-1eccc189bde4cd2fba7e4e7c739c6715e416578c42180524d4603a2400080603 high

📛 Threat Title

Mirai: stub.mips64

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 728211 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:12:28.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 1eccc189bde4cd2fba7e4e7c739c6715e416578c42180524d4603a2400080603 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/1eccc189bde4cd2fba7e4e7c739c6715e416578c42180524d4603a2400080603

IOC database

Type
hash_sha256
Value
1eccc189bde4cd2fba7e4e7c739c6715e416578c42180524d4603a2400080603
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/1eccc189bde4cd2fba7e4e7c739c6715e416578c42180524d4603a2400080603

hash_sha1 aa7671343d377a2d6cbbf9c9dfad10cb8c11e959 VT 4 / 75

IOC database

Type
hash_sha1
Value
aa7671343d377a2d6cbbf9c9dfad10cb8c11e959
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 4 of 75 VirusTotal vendors

VendorVerdictDetection
Antiy-AVL malicious Trojan[Exploit]/Linux.CVE-2018-10561
ESET-NOD32 malicious Linux/Agent.BMJ trojan
huorong malicious Trojan/Linux.Agent.es
Microsoft malicious Trojan:Script/Wacatac.B!ml

Details From VirusTotal

Basic Properties
MD5b5365d8a2b7858ba280785b6d7369f1c
SHA-1aa7671343d377a2d6cbbf9c9dfad10cb8c11e959
SHA-2561eccc189bde4cd2fba7e4e7c739c6715e416578c42180524d4603a2400080603
VHasha59702de030a04055302b0092aea9ca9
SSDEEP12288:4EO7hT7XQRW4tWl9B11U+bs/w7iGtgpiGGhQi3BF1PNMBHUJTxVt:o7Vh4t+9B1do/w7iG+SQiZa0JTxr
TLSHT18DF48D273B21DF65D355D67049F3C7914AE920A20AE340D6B2A8C3287E6172D2D9FFE4
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size711.1 KB
History
First seen on VirusTotal2026-09-25 11:15 UTC
Last submission2026-09-25 11:15 UTC
Last analysis2026-09-25 11:15 UTC
Last modified on VirusTotal2026-09-25 13:46 UTC
Known Names
  • gb7imb3a5.exe
  • ftkr1ai2.exe
  • stub.mips64.elf
hash_md5 b5365d8a2b7858ba280785b6d7369f1c VT 4 / 75

IOC database

Type
hash_md5
Value
b5365d8a2b7858ba280785b6d7369f1c
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 4 of 75 VirusTotal vendors

VendorVerdictDetection
Antiy-AVL malicious Trojan[Exploit]/Linux.CVE-2018-10561
ESET-NOD32 malicious Linux/Agent.BMJ trojan
huorong malicious Trojan/Linux.Agent.es
Microsoft malicious Trojan:Script/Wacatac.B!ml

Details From VirusTotal

Basic Properties
MD5b5365d8a2b7858ba280785b6d7369f1c
SHA-1aa7671343d377a2d6cbbf9c9dfad10cb8c11e959
SHA-2561eccc189bde4cd2fba7e4e7c739c6715e416578c42180524d4603a2400080603
VHasha59702de030a04055302b0092aea9ca9
SSDEEP12288:4EO7hT7XQRW4tWl9B11U+bs/w7iGtgpiGGhQi3BF1PNMBHUJTxVt:o7Vh4t+9B1do/w7iG+SQiZa0JTxr
TLSHT18DF48D273B21DF65D355D67049F3C7914AE920A20AE340D6B2A8C3287E6172D2D9FFE4
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size711.1 KB
History
First seen on VirusTotal2026-09-25 11:15 UTC
Last submission2026-09-25 11:15 UTC
Last analysis2026-09-25 11:15 UTC
Last modified on VirusTotal2026-09-25 13:46 UTC
Known Names
  • gb7imb3a5.exe
  • ftkr1ai2.exe
  • stub.mips64.elf

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 728211 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:12:28.

Remediations (10)

  • Mirai Malware Analysis, Overview by ANY.RUN
    web:any.run

    Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  • Anti-UPX Unpacking Technique - JPCERT/CC Eyes
    web:blogs.jpcert.or.jp

    The most well-known malware using Anti-UPX Unpacking technique is Mirai and its variants, which target IoT devices. Figure 1 shows the headers of UPX-packed binary and Mirai .

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • GitHub - endorlabs/MIRAI
    web:github.com

    MIRAI is an abstract interpreter for the Rust compiler's mid-level intermediate representation (MIR). It is intended to become a widely used static analysis tool for Rust.

  • Mirai Source Code - GitHub
    web:github.com

    Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...

  • Dissecting Mirai: Spatio-Sequential Analysis and Restoration ... - Springer
    web:link.springer.com

    Following the public release of its source code in 2016, numerous variants have proliferated, broadening its attack surface and complicating detection and mitigation efforts. Despite extensive research on Mirai , existing analyses remain fragmented and informal, lacking a structured representation of its attack patterns.

  • mirai-advisors.com
    web:mirai-advisors.com

    Mirai runs red-team grade reviews on decentralized trust systems, smart contracts, agent orchestration, and critical APIs—shipping reproducible exploits, remediation PRs, and benchmarks against the standards your auditors expect.

  • Mirai Botnet Forensic Analysis - Cyber - westoahu.hawaii.edu
    web:westoahu.hawaii.edu

    Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2400 samples tracked, 24 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

  • [TOOL] Unofficial Bootloader Unlock (ROLLBACK METHOD)
    web:xdaforums.com

    Components runbook.sh (method), scripts/helpers.sh (shared), scripts/gpt_verify.py (payload-vs-device GPT verification), scripts/fetch_mifirm.js (stock-ROM fetch helper, optional) config.sh (generic, parametrized; no device-specific identifiers) payloads/README.md (per-SoC payload files + the GPT-rename trick), docs/sources.md (documented method) tools/ (fastboot/adb) is gitignored — fetch ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.