s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-5f1d4024dced8e8cb685fa9bfe4ff7141e79937283060eab0d54b175ddddf8ec high

📛 Threat Title

Mirai: iran.armv6l

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 169012 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-08-31 16:14:32.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 5f1d4024dced8e8cb685fa9bfe4ff7141e79937283060eab0d54b175ddddf8ec VT 27 / 75

IOC database

Type
hash_sha256
Value
5f1d4024dced8e8cb685fa9bfe4ff7141e79937283060eab0d54b175ddddf8ec
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 27 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Gafgyt.BBB
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-10056448-0
CTX malicious elf.trojan.mirai
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.WN!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Gafgyt.bs
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Mirai.GJ!MTB
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!13A0FD3BCF59
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!13A0FD3BCF59
Varist malicious E32/Mirai.EN.gen!Camelot

Details From VirusTotal

Basic Properties
MD513a0fd3bcf59bc2a128edb375f76c97e
SHA-1c2b0e993781ecafcb41b4047284d712fbd61f2ee
SHA-2565f1d4024dced8e8cb685fa9bfe4ff7141e79937283060eab0d54b175ddddf8ec
VHash8392799d7739ad72225fd3b9fa512aa9
SSDEEP3072:Oo0R0M1GwnMVkH8VMFU79wfmPtK93ura4hCG3yx67uk6nD2c62+hhz:Oo0R0M1GwnMVc+MFwCOPtU3oaKCMl7uc
TLSHT1A8F31A56F9819B11C5C156BAFF0E528D73231B78E3DE72129E246B347B8A87B0E3B015
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
File size165.1 KB
History
First seen on VirusTotal2026-08-31 16:24 UTC
Last submission2026-08-31 16:24 UTC
Last analysis2026-08-31 18:03 UTC
Last modified on VirusTotal2026-08-31 23:39 UTC
Known Names
  • armv6l
  • iran.armv6l
  • iae7tin88.exe
hash_sha1 c2b0e993781ecafcb41b4047284d712fbd61f2ee VT 27 / 75

IOC database

Type
hash_sha1
Value
c2b0e993781ecafcb41b4047284d712fbd61f2ee
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 27 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Gafgyt.BBB
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-10056448-0
CTX malicious elf.trojan.mirai
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.WN!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Gafgyt.bs
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Mirai.GJ!MTB
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!13A0FD3BCF59
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!13A0FD3BCF59
Varist malicious E32/Mirai.EN.gen!Camelot

Details From VirusTotal

Basic Properties
MD513a0fd3bcf59bc2a128edb375f76c97e
SHA-1c2b0e993781ecafcb41b4047284d712fbd61f2ee
SHA-2565f1d4024dced8e8cb685fa9bfe4ff7141e79937283060eab0d54b175ddddf8ec
VHash8392799d7739ad72225fd3b9fa512aa9
SSDEEP3072:Oo0R0M1GwnMVkH8VMFU79wfmPtK93ura4hCG3yx67uk6nD2c62+hhz:Oo0R0M1GwnMVc+MFwCOPtU3oaKCMl7uc
TLSHT1A8F31A56F9819B11C5C156BAFF0E528D73231B78E3DE72129E246B347B8A87B0E3B015
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
File size165.1 KB
History
First seen on VirusTotal2026-08-31 16:24 UTC
Last submission2026-08-31 16:24 UTC
Last analysis2026-08-31 18:03 UTC
Last modified on VirusTotal2026-08-31 23:39 UTC
Known Names
  • armv6l
  • iran.armv6l
  • iae7tin88.exe
hash_md5 13a0fd3bcf59bc2a128edb375f76c97e VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/13a0fd3bcf59bc2a128edb375f76c97e

IOC database

Type
hash_md5
Value
13a0fd3bcf59bc2a128edb375f76c97e
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/13a0fd3bcf59bc2a128edb375f76c97e

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 169012 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-08-31 16:14:32.

Remediations (10)

  • Mirai Malware Analysis, Overview by ANY.RUN
    web:any.run

    Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  • Hackers Target TP-Link Routers With Mirai Malware in CVE-2023-33538 ...
    web:cybersecuritynews.com

    EOL TP-Link routers hit by CVE-2023-33538, letting hackers install Mirai botnet via web flaws with no official patches available.

  • New Mirai Botnet Leverages Zero-Day Exploits on Routers
    web:dailysecurityreview.com

    A new Mirai botnet is using zero-day exploits to target industrial routers and smart home devices, launching high-intensity DDoS attacks. Learn about the vulnerabilities and how to protect your systems.

  • Mirai Source Code - GitHub
    web:github.com

    Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...

  • Mirai Botnet | ARM Reverse Engineering Walkthrough
    web:trainsec.net

    Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...

  • URLhaus | http://83.168.110.191/iran.armv6l
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • URLhaus | http://94.154.43.88/iran.armv6l
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • Mirai Botnet Forensic Analysis - Cyber - westoahu.hawaii.edu
    web:westoahu.hawaii.edu

    A botnet called Mirai infected hundreds of thousands of Internet of Things (IoT) devices, amassing a wide network of compromised devices. Mitigations against the Mirai botnet involve taking proactive security measures, properly hardening systems, and updating to the latest software to reduce the risk of compromise.

  • Linux Analysis Report iran.armv6l.elf - Joe Sandbox
    web:www.joesandbox.com

    General Information Joe Sandbox version: 44.0.0 Smoke Quartz Analysis ID: 1937818 Start date and time: 2026-07-06 13:08:07 +02:00 Joe Sandbox product: CloudBasic Overall analysis duration: 0h 4m 47s Hypervisor based Inspection enabled: false Report type: full Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0 ...

  • Linux Analysis Report iran.armv6l.elf
    web:www.joesandbox.com

    Multi AV Scanner detection for submitted file Yara detected Mirai Executes the "rm" command used to delete files or directories Found strings indicative of a multi-platform dropper Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable Sample has stripped symbol table

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.