s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2020272 high

📛 Threat Title

Mirai: SHA256 hash of a malware sample (payload) 0da55ae832323f8ee69b49f6e0579e0e190aa53ad050f5f9773292e69b3a2f6e

Category: Mirai Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Mirai (aliases: Katana). Confidence: 90. First seen: 2026-11-08 06:57:51 UTC. Reporter: Tuxxin. Tags: elf, Mirai.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 0da55ae832323f8ee69b49f6e0579e0e190aa53ad050f5f9773292e69b3a2f6e VT 26 / 75

IOC database

Type
hash_sha256
Value
0da55ae832323f8ee69b49f6e0579e0e190aa53ad050f5f9773292e69b3a2f6e
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Agent-AYQ [Trj]
Avast-Mobile malicious ELF:Gafgyt-KS [Trj]
AVG malicious ELF:Agent-AYQ [Trj]
Avira malicious EXP/ELF.Gafgyt.Z.F
ClamAV malicious Unix.Trojan.Mirai-7100807-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.10808
Elastic malicious Linux.Trojan.Gafgyt
ESET-NOD32 malicious Linux/Mirai.L trojan
F-Secure malicious Exploit.EXP/ELF.Gafgyt.Z.F
Fortinet malicious ELF/Mirai.B!tr
Gridinsoft malicious Susp.U.XOREncoded.sd!yf
huorong malicious Trojan/Linux.Mirai.i
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Gafgyt.a
MaxSecure malicious Trojan.Malware.121218.susgen
McAfeeD malicious Trojan:Linux/Mirai.EBJ
Microsoft malicious Backdoor:Linux/Mirai.AY!MTB
Rising malicious Backdoor.Mirai/Linux!1.14387 (CLASSIC)
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious Lnx/Mirai-FEBO!BC4912C941E5
Symantec malicious Linux.Mirai
Tencent malicious Backdoor.Linux.Mirai.wz
TrellixENS malicious Lnx/Mirai-FEBO!BC4912C941E5
Varist malicious E32/Mirai.G.gen!Camelot

Details From VirusTotal

Basic Properties
MD5bc4912c941e554ee63fd2fb816e466a8
SHA-142af30ead1f0b7c354b0d70d1aff131af34a6c0a
SHA-2560da55ae832323f8ee69b49f6e0579e0e190aa53ad050f5f9773292e69b3a2f6e
VHashfc7e3765fca30728af4e7f15eb3a548f
SSDEEP1536:1Uk7f3lCxFcl5CqFQRDvILIzkeBGJNuqk:1UiG+ZFggbpa
TLSHT1BF83C50A5E218FACFB9A833187F74E25965C33A627E1C285D25CD9041EB434E641FFAD
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size83.6 KB
History
First seen on VirusTotal2026-10-12 13:04 UTC
Last submission2026-10-12 13:04 UTC
Last analysis2026-10-12 13:04 UTC
Last modified on VirusTotal2026-10-12 17:36 UTC
Known Names
  • mips.elf
  • 7yycqh1.exe

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Mirai (aliases: Katana). Confidence: 90. First seen: 2026-11-08 06:57:51 UTC. Reporter: Tuxxin. Tags: elf, Mirai.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.