MB-0275d7b76fb12f336927a089281b6b19edfdd5d6540f46b2b29e057a648549ad
high
📛 Threat Title
Mirai: iran.sparc
Description
File type: elf. Size: 43872 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-07-28 15:09:08.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
0275d7b76fb12f336927a089281b6b19edfdd5d6540f46b2b29e057a648549ad
IOC database
- Type
- hash_sha256
- Value
0275d7b76fb12f336927a089281b6b19edfdd5d6540f46b2b29e057a648549ad- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
0e5924c73f123635a4f6c722af43574998d5fc00
IOC database
- Type
- hash_sha1
- Value
0e5924c73f123635a4f6c722af43574998d5fc00- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
1896fdcd7fb94263dce24ed7c2c4bcbb
IOC database
- Type
- hash_md5
- Value
1896fdcd7fb94263dce24ed7c2c4bcbb- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 43872 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-07-28 15:09:08.
Remediations (10)
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:isis-online.org
The attack also damaged a multi-story office building at the site. Monitoring and Verification and Iran's Safeguards Violations A New Baseline: Suspension The IAEA asserted the baseline obligation that Iran is "required to suspend all enrichment-related activities" pursuant to restored UNSC resolutions.
-
web:mecouncil.org
On July 2, 2025, Iranian President Masoud Pezeshkian formally enacted a law suspending Iran's cooperation with the International Atomic Energy Agency (IAEA). The move, approved unanimously by Iran's parliament and endorsed by the Guardian Council, effectively halted inspections and reporting on Iran's nuclear program by the agency "until the security of the nuclear facilities is ...
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.cisa.gov
Cybersecurity Advisory: Provides detailed information on cyber threats, including threat actor tactics, techniques, and procedures and indicators of compromise, along with recommended actions for detection, mitigation , and response.
-
web:www.congress.gov
Iran also ceased implementing the Additional Protocol to its comprehensive safeguards agreement in February 2021. Such protocols increase the IAEA's ability to investigate undeclared nuclear facilities and activities in nonnuclear-weapon states by increasing the agency's authority to inspect certain nuclear-related facilities and demand information from member states. Pursuant to its JCPOA ...
-
web:www.fdd.org
The IAEA's report presents a picture of near-total, ongoing loss of monitoring of Iranian nuclear sites due to Iran's suspension of access nearly one year ago, an unaccounted-for enriched uranium stockpile, key activities that cannot be verified, and the persistence of long-standing compliance failures.
-
web:www.iaea.org
This report of the Director General to the Board of Governors and, in parallel, to the United Nations Security Council (Security Council), is on the Islamic Republic of Iran's (Iran's) implementation of its nuclear-related commitments under the Joint Comprehensive Plan of Action (JCPOA) and on matters related to verification and monitoring ...
-
web:www.joesandbox.com
Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file HTTP GET or POST without a user agent Sample has stripped symbol table Uses the "uname" system call to query kernel version information (possible evasion)
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.