MB-b26ea764e9b01665ba3eec34e001b29bfe9f1c727e76d74cd44ddd2f6d15b88c
high
📛 Threat Title
Mirai: stub.armv7
Description
File type: elf. Size: 625562 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:58:38.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
b26ea764e9b01665ba3eec34e001b29bfe9f1c727e76d74cd44ddd2f6d15b88c
VT 11 / 75
IOC database
- Type
- hash_sha256
- Value
b26ea764e9b01665ba3eec34e001b29bfe9f1c727e76d74cd44ddd2f6d15b88c- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 11 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Arcabit | malicious | Trojan.Linux.Generic.D3946B2E |
| BitDefender | malicious | Trojan.Linux.GenericKD.60058414 |
| CTX | malicious | elf.trojan.generic |
| Emsisoft | malicious | Trojan.Linux.GenericKD.60058414 (B) |
| ESET-NOD32 | malicious | Linux/Agent.BMJ trojan |
| GData | malicious | Trojan.Linux.GenericKD.60058414 |
| huorong | malicious | Trojan/Linux.Agent.es |
| Microsoft | malicious | Trojan:Script/Wacatac.B!ml |
| MicroWorld-eScan | malicious | Trojan.Linux.GenericKD.60058414 |
| Rising | malicious | Backdoor.Mirai/Linux!1.14841 (CLASSIC) |
| VIPRE | malicious | Trojan.Linux.GenericKD.60058414 |
Details From VirusTotal
Basic Properties
| MD5 | 379f802371cb10c56ee4df154c07b757 |
| SHA-1 | 79be54aee9341f0a2319f81c71a980e18ea8a587 |
| SHA-256 | b26ea764e9b01665ba3eec34e001b29bfe9f1c727e76d74cd44ddd2f6d15b88c |
| VHash | b468ddab6c3343c91277670130d15bb5 |
| SSDEEP | 12288:F2ctKrS0XUwn67ayLtLiXRU2zzi6aNjodD6pmkVf32cgpeSa9VWKiu:YCp7mXtni6aBh321eSiVWKv |
| TLSH | T140D44A55F8809F63C9C52A36F64E866833274778C7E7730689144B383BA7A6F0F3A645 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped |
| File size | 610.9 KB |
History
| First seen on VirusTotal | 2026-09-25 11:22 UTC |
| Last submission | 2026-09-25 11:22 UTC |
| Last analysis | 2026-09-25 11:22 UTC |
| Last modified on VirusTotal | 2026-09-25 18:08 UTC |
Known Names
copy
hash_sha1
79be54aee9341f0a2319f81c71a980e18ea8a587
VT 11 / 75
IOC database
- Type
- hash_sha1
- Value
79be54aee9341f0a2319f81c71a980e18ea8a587- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 11 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Arcabit | malicious | Trojan.Linux.Generic.D3946B2E |
| BitDefender | malicious | Trojan.Linux.GenericKD.60058414 |
| CTX | malicious | elf.trojan.generic |
| Emsisoft | malicious | Trojan.Linux.GenericKD.60058414 (B) |
| ESET-NOD32 | malicious | Linux/Agent.BMJ trojan |
| GData | malicious | Trojan.Linux.GenericKD.60058414 |
| huorong | malicious | Trojan/Linux.Agent.es |
| Microsoft | malicious | Trojan:Script/Wacatac.B!ml |
| MicroWorld-eScan | malicious | Trojan.Linux.GenericKD.60058414 |
| Rising | malicious | Backdoor.Mirai/Linux!1.14841 (CLASSIC) |
| VIPRE | malicious | Trojan.Linux.GenericKD.60058414 |
Details From VirusTotal
Basic Properties
| MD5 | 379f802371cb10c56ee4df154c07b757 |
| SHA-1 | 79be54aee9341f0a2319f81c71a980e18ea8a587 |
| SHA-256 | b26ea764e9b01665ba3eec34e001b29bfe9f1c727e76d74cd44ddd2f6d15b88c |
| VHash | b468ddab6c3343c91277670130d15bb5 |
| SSDEEP | 12288:F2ctKrS0XUwn67ayLtLiXRU2zzi6aNjodD6pmkVf32cgpeSa9VWKiu:YCp7mXtni6aBh321eSiVWKv |
| TLSH | T140D44A55F8809F63C9C52A36F64E866833274778C7E7730689144B383BA7A6F0F3A645 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped |
| File size | 610.9 KB |
History
| First seen on VirusTotal | 2026-09-25 11:22 UTC |
| Last submission | 2026-09-25 11:22 UTC |
| Last analysis | 2026-09-25 11:22 UTC |
| Last modified on VirusTotal | 2026-09-25 18:08 UTC |
Known Names
copy
hash_md5
379f802371cb10c56ee4df154c07b757
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/379f802371cb10c56ee4df154c07b757
IOC database
- Type
- hash_md5
- Value
379f802371cb10c56ee4df154c07b757- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/379f802371cb10c56ee4df154c07b757
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 625562 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:58:38.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:arxiv.org
Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...
-
web:dailysecurityreview.com
A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.
-
web:deepwiki.com
ARM Architecture Support Relevant source files Purpose and Scope This page documents Mirai's support for ARM processor architectures, including both generic ARM and ARMv7-specific variants. ARM processors dominate the IoT device market, making ARM support critical to Mirai's propagation capability. This page covers the architecture detection refinement process, the structure of ARM downloader ...
-
web:github.com
A simple Rust example with cross compilation for armv7l and armhf architectures - locnnil/rust_cross_compilation
-
web:github.com
This repository contains the leaked source code of the Mirai botnet, originally created to infect IoT devices and launch large-scale DDoS attacks. This code is provided strictly for cybersecurity research, reverse engineering, malware analysis, and detection development purposes only.
-
web:link.springer.com
Following the public release of its source code in 2016, numerous variants have proliferated, broadening its attack surface and complicating detection and mitigation efforts. Despite extensive research on Mirai , existing analyses remain fragmented and informal, lacking a structured representation of its attack patterns.
-
web:rruzi.github.io
The C2 port is randomly selected between 25596 and 25616. In terms of the communication mechanism, Mirai .CatDDoS basically follows the original design of Mirai , except that the fixed 4-byte \x00\x00\x00\x01 when Mirai goes online is modified to a fixed 8-byte: \x31\x73\x13\x93\x04\x83\x32\x04 In terms of the ATTACK_VECTOR, Mirai .CatDDoS implements a richer variety of DDoS attack types than ...
-
web:www.yazoul.net
Mirai threat intelligence: 2400 samples tracked, 24 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.
-
web:xdaforums.com
Components runbook.sh (method), scripts/helpers.sh (shared), scripts/gpt_verify.py (payload-vs-device GPT verification), scripts/fetch_mifirm.js (stock-ROM fetch helper, optional) config.sh (generic, parametrized; no device-specific identifiers) payloads/README.md (per-SoC payload files + the GPT-rename trick), docs/sources.md (documented method) tools/ (fastboot/adb) is gitignored — fetch ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.