MB-3d1980eb72941c86d986b84be11fa2fc4bf1ffe213f0ae8d87dc3d4238f7f3cf
high
📛 Threat Title
Mirai: aarch64
Description
File type: elf. Size: 699240 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-23 23:36:28.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
3d1980eb72941c86d986b84be11fa2fc4bf1ffe213f0ae8d87dc3d4238f7f3cf
IOC database
- Type
- hash_sha256
- Value
3d1980eb72941c86d986b84be11fa2fc4bf1ffe213f0ae8d87dc3d4238f7f3cf- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
c72e4a0482445eeda7cf03c58e91d0278e1c3cd3
IOC database
- Type
- hash_sha1
- Value
c72e4a0482445eeda7cf03c58e91d0278e1c3cd3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
2a83b0dcf31c1caab989a3a838d25d8a
IOC database
- Type
- hash_md5
- Value
2a83b0dcf31c1caab989a3a838d25d8a- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 699240 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-23 23:36:28.
Remediations (10)
-
web:ansible-lockdown.readthedocs.io
ARM64/ aarch64 Architecture Guide Overview Support Status Getting Started on ARM64 Prerequisites Running Remediation Running Audit Known Limitations auditd System Call Differences Kernel Module Differences Validation Steps Troubleshooting Audit Binary Issues auditd Rule Failures Reporting ARM64 Issues Best Practices Overview With the growing adoption of ARM64 ( aarch64 ) processors in servers ...
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:dailysecurityreview.com
A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.
-
web:dailysecurityreview.com
A new Mirai botnet is using zero-day exploits to target industrial routers and smart home devices, launching high-intensity DDoS attacks. Learn about the vulnerabilities and how to protect your systems.
-
web:github.com
Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...
-
web:trainsec.net
Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...
-
web:unit42.paloaltonetworks.com
Mirai is a still-active botnet with new variants. We highlight observed exploitation of IoT vulnerabilities — due to low complexity and high impact.
-
web:www.akamai.com
Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .
-
web:www.joesandbox.com
Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Yara detected Mirai Found strings indicative of a multi-platform dropper Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable Sample has stripped symbol table
-
web:www.joesandbox.com
Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Yara detected Mirai Connects to many ports of the same IP (likely port scanning) Uses STUN server to do NAT traversial Detected TCP or UDP traffic on non-standard ports
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.