MB-918a0a4cde273e289a846a5e21e160c2caf84372cc13c717d707458c7fd561a8
high
📛 Threat Title
Mirai: data_arm7
Description
File type: elf. Size: 150372 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-08-04 21:57:40.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
918a0a4cde273e289a846a5e21e160c2caf84372cc13c717d707458c7fd561a8
IOC database
- Type
- hash_sha256
- Value
918a0a4cde273e289a846a5e21e160c2caf84372cc13c717d707458c7fd561a8- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
03a2ee34e4320374b76fac09f265159c
IOC database
- Type
- hash_md5
- Value
03a2ee34e4320374b76fac09f265159c- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
527c5666a6757860e7f1ee9ec8e36e9af10de154
IOC database
- Type
- hash_sha1
- Value
527c5666a6757860e7f1ee9ec8e36e9af10de154- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 150372 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-08-04 21:57:40.
Remediations (10)
-
web:arxiv.org
A heavy emphasis is placed on how the researchers extracted the data and used it to classify and track Mirai variants. The researchers take a more holistic approach to discuss the variants and provide details specifically on Masuta, Owari, and Wicked.
-
web:cyberpress.org
Remote, unauthenticated attackers are able to inject arbitrary system commands, enabling full device compromise without user interaction. Investigation revealed that threat actors are leveraging the compromised endpoint to download and execute Mirai -based ARM malware, notably a variant referred to as "LZRD" (typically named boatnet.arm7). Upon execution, this Mirai variant displays a ...
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:github.com
This repository contains a comprehensive malware analysis report focusing on the Mirai IoT botnet. The project details the setup of a secure malware analysis laboratory and presents a research-based analysis of the Mirai malware. It covers the critical aspects of establishing an isolated analysis environment, the selection of appropriate tools, and a thorough investigation of Mirai's ...
-
web:trainsec.net
Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...
-
web:westoahu.hawaii.edu
A botnet called Mirai infected hundreds of thousands of Internet of Things (IoT) devices, amassing a wide network of compromised devices. Mitigations against the Mirai botnet involve taking proactive security measures, properly hardening systems, and updating to the latest software to reduce the risk of compromise.
-
web:www.akamai.com
Conclusion Mirai -based botnets continue to be a call for divorce for many organizations, and the prevalence of outdated IoT devices help propagate this threat. Like security researchers, some threat actors keep up to date on the latest vulnerability disclosures relevant to their illicit activities.
-
web:www.joesandbox.com
Linux Analysis Report data.arm7.elf Overview General Information ... Detection Mirai , Xmrig
-
web:www.joesandbox.com
Behavior Graph ID: 481779 Sample: mirai .arm7 Startdate: 12/09/2021 Architecture: LINUX Score: 80 Malicious sample detected (through community Yara rule) Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file
-
web:www.quorumcyber.com
Mirai initially infected and weaponised devices such as smart cameras and Realtek routers2. The botnet variant was created in a racketeering attempt by the cofounders of Protraf Solutions, an organisation offering DDoS mitigation services.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.