TF-1853576
high
📛 Threat Title
Mirai: URL that delivers a malware payload http://103.83.87.122/iran.aarch64
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mirai (aliases: Katana). Confidence: 100. First seen: 2026-07-19 07:08:37 UTC. Reporter: anonymous.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
http://103.83.87.122/iran.aarch64
IOC database
- Type
- url
- Value
http://103.83.87.122/iran.aarch64- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://urlhaus.abuse.ch/downloads/text_recent/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mirai (aliases: Katana). Confidence: 100. First seen: 2026-07-18 23:58:02 UTC. Reporter: anonymous.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:github.com
This repository contains a static malware analysis of the IoT Mirai malware (loader component) obtained from theZoo malware repository. The objective of this project is to understand Mirai's infection mechanism, network behavior, architecture-specific payload delivery, and execution flow using reverse engineering techniques.
-
web:ismalicious.com
784 indicators (96 domains, 235 IPs, 63 URLs , 390 hashes) attributed to the Mirai malware family.
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL .
-
web:www.akamai.com
The SIRT honeypots caught samples of Mirai using this vulnerability to infect devices as early as June 13, 2023 (Figures 1 and 2). The payload attempts to inject a wget command by downloading a 32-bit Mips compiled Mirai binary, setting it to be world executable, and then executing it (Figures 3 and 4).
-
web:www.akamai.com
Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .
-
web:www.radware.com
Mirai as an Evolving IoT Botnet Ecosystem As of 2026, Mirai is a reusable malware lineage and attack framework that continues to shape IoT-driven DDoS activity. Radware describes Mirai as one of the defining IoT botnets because its leaked source code enabled attackers to create customized variants and rapidly expand DDoS capabilities across poorly secured connected devices. The key risk is ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.