MB-26d365cb80c309e42a88e0091f15a3c5de80409d18d141c83c8802e82abab22f
high
📛 Threat Title
Mirai: data_arm4
Description
File type: elf. Size: 125588 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-08-04 21:57:37.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
26d365cb80c309e42a88e0091f15a3c5de80409d18d141c83c8802e82abab22f
IOC database
- Type
- hash_sha256
- Value
26d365cb80c309e42a88e0091f15a3c5de80409d18d141c83c8802e82abab22f- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
cbf0833f9bc206c1ca56376c5b47119e
IOC database
- Type
- hash_md5
- Value
cbf0833f9bc206c1ca56376c5b47119e- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
7e78e4592d01c78b6d39ce50587c0ce3ddeb6665
IOC database
- Type
- hash_sha1
- Value
7e78e4592d01c78b6d39ce50587c0ce3ddeb6665- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 125588 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-08-04 21:57:37.
Remediations (10)
-
web:dailysecurityreview.com
A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.
-
web:github.com
📝 Overview This project adapts the work of @Its-Just-Nans to simulate a Mirai botnet attack in a controlled virtual environment. The setup demonstrates the effectiveness of Snort (IDS) and Cowrie (honeypot) in mitigating botnet attacks.
-
web:github.com
This repository contains a comprehensive malware analysis report focusing on the Mirai IoT botnet. The project details the setup of a secure malware analysis laboratory and presents a research-based analysis of the Mirai malware. It covers the critical aspects of establishing an isolated analysis environment, the selection of appropriate tools, and a thorough investigation of Mirai's ...
-
web:link.springer.com
Following the public release of its source code in 2016, numerous variants have proliferated, broadening its attack surface and complicating detection and mitigation efforts. Despite extensive research on Mirai , existing analyses remain fragmented and informal, lacking a structured representation of its attack patterns.
-
web:trainsec.net
Mirai botnets have been around for several years, enslaving IoT devices, routers, DVRs, and Linux servers to build extensive networks of "zombie" machines. These machines are then leveraged to launch devastating Distributed Denial of Service (DDoS) attacks, exfiltrate data, and establish stealthy backdoors.
-
web:westoahu.hawaii.edu
Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.
-
web:www.corero.com
Introduction Mirai has been a notorious botnet since its code was released in 2016. There are many Mirai variants using exploits that target IoT devices to turn them to zombies. When substantial botnets are used in record-breaking DDoS attacks, they become headline news. (1)(2)(3)(4)(5) The smart device market is rapidly expanding and with it, the pool of vulnerable devices that botnets can ...
-
web:www.joesandbox.com
Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Yara detected Mirai Performs DNS TXT record lookups Creates hidden files and/or directories Creates hidden files without content (potentially used as a mutex) Detected TCP or UDP traffic on non-standard ports Enumerates processes within the "proc" file system Executes the "rm" command ...
-
web:www.joesandbox.com
Signatures Multi AV Scanner detection for submitted file Yara detected Mirai Detected TCP or UDP traffic on non-standard ports Executes the "rm" command used to delete files or directories Sample has stripped symbol table Uses the "uname" system call to query kernel version information (possible evasion)
-
web:www.techtimes.com
Tengu botnet, a newly disclosed Mirai variant, weaponizes the hardware watchdog timer in routers and IP cameras to force a reboot when a responder kills the process — erasing forensic evidence ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.