s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-3a093048798c3ceb7f168ce101c03a6e92fdffe46a6007e4645d751d91808a6d high

📛 Threat Title

Mirai: bot.mpsl

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 1141675 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:51:51.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 3a093048798c3ceb7f168ce101c03a6e92fdffe46a6007e4645d751d91808a6d VT 25 / 75

IOC database

Type
hash_sha256
Value
3a093048798c3ceb7f168ce101c03a6e92fdffe46a6007e4645d751d91808a6d
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 25 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Gen:Variant.Linux.Gafgyt.13
Antiy-AVL malicious Trojan[Exploit]/Linux.CVE-2018-10561
Arcabit malicious Trojan.Linux.Gafgyt.13
Avast malicious ELF:CVE-2021-36260-A [Expl]
Avast-Mobile malicious ELF:Mirai-QL [Trj]
AVG malicious ELF:CVE-2021-36260-A [Expl]
Avira malicious EXP/LINUX.CVE-2021-.A
BitDefender malicious Gen:Variant.Linux.Gafgyt.13
ClamAV malicious Unix.Trojan.Mirai-10004218-0
CTX malicious elf.unknown.gafgyt
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Rootkit.420
Emsisoft malicious Gen:Variant.Linux.Gafgyt.13 (B)
ESET-NOD32 malicious Linux/Mirai.FLD trojan
F-Secure malicious Exploit.EXP/LINUX.CVE-2021-.A
Fortinet malicious Linux/Mirai.REAL!tr
GData malicious Gen:Variant.Linux.Gafgyt.13
huorong malicious Trojan/Linux.Mirai.f
Kaspersky malicious HEUR:Exploit.Linux.CVE-2018-10561.a
Microsoft malicious Backdoor:Linux/Gafgyt.BA!xp
MicroWorld-eScan malicious Gen:Variant.Linux.Gafgyt.13
Rising malicious Backdoor.Mirai/Linux!1.BAFE (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
Tencent malicious Backdoor.Linux.Mirai.yar
VIPRE malicious Gen:Variant.Linux.Gafgyt.13

Details From VirusTotal

Basic Properties
MD54b9a355cba8a271c1ee53d6af01da64d
SHA-1dc58d0f4cf5c56e3c47b224aa3518c5c55fd9e5c
SHA-2563a093048798c3ceb7f168ce101c03a6e92fdffe46a6007e4645d751d91808a6d
VHash571c3e4bc2d0ca1bf150f8c3a7511a53
SSDEEP24576:7BVL2UCtekP9MiCWKu/LoZespTm4C+xTCnOKW8n:qUCBVUnusklMxTCnzn
TLSHT1A7356C46EF406FEBC09FCD30492EC35721EDE8CA42C5A62971FC4A8C7A5D3194AD3698
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size1.1 MB
History
First seen on VirusTotal2026-09-25 10:54 UTC
Last submission2026-09-25 10:54 UTC
Last analysis2026-09-25 10:54 UTC
Last modified on VirusTotal2026-09-25 12:55 UTC
Known Names
  • i4u861na.exe
  • bot.mpsl.elf
hash_sha1 dc58d0f4cf5c56e3c47b224aa3518c5c55fd9e5c VT 25 / 75

IOC database

Type
hash_sha1
Value
dc58d0f4cf5c56e3c47b224aa3518c5c55fd9e5c
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 25 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Gen:Variant.Linux.Gafgyt.13
Antiy-AVL malicious Trojan[Exploit]/Linux.CVE-2018-10561
Arcabit malicious Trojan.Linux.Gafgyt.13
Avast malicious ELF:CVE-2021-36260-A [Expl]
Avast-Mobile malicious ELF:Mirai-QL [Trj]
AVG malicious ELF:CVE-2021-36260-A [Expl]
Avira malicious EXP/LINUX.CVE-2021-.A
BitDefender malicious Gen:Variant.Linux.Gafgyt.13
ClamAV malicious Unix.Trojan.Mirai-10004218-0
CTX malicious elf.unknown.gafgyt
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Rootkit.420
Emsisoft malicious Gen:Variant.Linux.Gafgyt.13 (B)
ESET-NOD32 malicious Linux/Mirai.FLD trojan
F-Secure malicious Exploit.EXP/LINUX.CVE-2021-.A
Fortinet malicious Linux/Mirai.REAL!tr
GData malicious Gen:Variant.Linux.Gafgyt.13
huorong malicious Trojan/Linux.Mirai.f
Kaspersky malicious HEUR:Exploit.Linux.CVE-2018-10561.a
Microsoft malicious Backdoor:Linux/Gafgyt.BA!xp
MicroWorld-eScan malicious Gen:Variant.Linux.Gafgyt.13
Rising malicious Backdoor.Mirai/Linux!1.BAFE (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
Tencent malicious Backdoor.Linux.Mirai.yar
VIPRE malicious Gen:Variant.Linux.Gafgyt.13

Details From VirusTotal

Basic Properties
MD54b9a355cba8a271c1ee53d6af01da64d
SHA-1dc58d0f4cf5c56e3c47b224aa3518c5c55fd9e5c
SHA-2563a093048798c3ceb7f168ce101c03a6e92fdffe46a6007e4645d751d91808a6d
VHash571c3e4bc2d0ca1bf150f8c3a7511a53
SSDEEP24576:7BVL2UCtekP9MiCWKu/LoZespTm4C+xTCnOKW8n:qUCBVUnusklMxTCnzn
TLSHT1A7356C46EF406FEBC09FCD30492EC35721EDE8CA42C5A62971FC4A8C7A5D3194AD3698
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size1.1 MB
History
First seen on VirusTotal2026-09-25 10:54 UTC
Last submission2026-09-25 10:54 UTC
Last analysis2026-09-25 10:54 UTC
Last modified on VirusTotal2026-09-25 12:55 UTC
Known Names
  • i4u861na.exe
  • bot.mpsl.elf
hash_md5 4b9a355cba8a271c1ee53d6af01da64d VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/4b9a355cba8a271c1ee53d6af01da64d

IOC database

Type
hash_md5
Value
4b9a355cba8a271c1ee53d6af01da64d
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/4b9a355cba8a271c1ee53d6af01da64d

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 1141675 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:51:51.

Remediations (10)

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • IoT Secure Gateway: Mirai Mitigation Lab - GitHub
    web:github.com

    Containerized IoT security lab simulating Mirai -style botnet behavior and validating an nftables default-deny gateway defense, with automated evidence capture and reporting. - Jehosua97/iot-secure-gateway- mirai - mitigation

  • Mirai Source Code - GitHub
    web:github.com

    Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...

  • mirai | bot [.]mpsl [.]elf | Triage™
    web:tria.ge

    Check this mirai report bot [.]mpsl [.]elf, with a score of 10 out of 10.

  • mirai | bot [.]mpsl | Triage™
    web:tria.ge

    Check this mirai report bot[.]mpsl , with a score of 10 out of 10.

  • InfectedSlurs Botnet Spreads Mirai via Zero-Days - Akamai
    web:www.akamai.com

    Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .

  • The Mirai Botnet - Threats and Mitigations - CIS
    web:www.cisecurity.org

    The Mirai botnet soon spread to infect thousands of internet of things (IoT) devices and evolved to conduct full, large-scale attacks. After noticing an increase in infections, Mirai caught the attention of the nonprofit organization MalwareMustDie in August 2016, who then started to research, analyze, and track the botnet [2].

  • Linux Analysis Report bot.mpsl.elf
    web:www.joesandbox.com

    Signatures Antivirus / Scanner detection for submitted sample Detected Mirai Malicious sample detected (through community Yara rule) Multi AV Scanner detection for submitted file Suricata IDS alerts for network traffic Yara detected Gafgyt Yara detected Mirai Yara detected Okiru Connects to many ports of the same IP (likely port scanning) Detected TCP or UDP traffic on non-standard ports ...

  • Linux Analysis Report bot.mpsl.elf - Joe Sandbox
    web:www.joesandbox.com

    Signatures Antivirus / Scanner detection for submitted sample Detected Mirai Malicious sample detected (through community Yara rule) Multi AV Scanner detection for submitted file Suricata IDS alerts for network traffic Yara detected Gafgyt Yara detected Mirai Yara detected Okiru Connects to many ports of the same IP (likely port scanning) Detected TCP or UDP traffic on non-standard ports ...

  • Akamai SIRT Identifies Zerobot Botnet Exploiting n8n and Tenda ...
    web:www.threatintelreport.com

    Akamai SIRT identifies Mirai variant campaign actively targeting critical RCE flaws in automation platforms and routers Mirai #Zerobot #Botnet #n8n #Tenda #CVE-2025-68613 #CVE-2025-7544 Affected products n8n workflow automation platform (versions 0.211.0 prior to 1.120.4, 1.121.1 and 1.122.0) and Tenda AC1206 routers (firmware 15.03.06.23) Campaign type Mirai -based botnet propagation via ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.