MB-e085bfe5a3d1e30a391d30b6601a735e8d0b8a155652ce382116213568d50109
high
📛 Threat Title
Mirai: stub.arm
Description
File type: elf. Size: 625125 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:57:31.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
e085bfe5a3d1e30a391d30b6601a735e8d0b8a155652ce382116213568d50109
VT: not in VT
IOC database
- Type
- hash_sha256
- Value
e085bfe5a3d1e30a391d30b6601a735e8d0b8a155652ce382116213568d50109- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: not in VT
hash_md5
3c4928659c13bdfbf974d1aae1327e37
VT: not in VT
IOC database
- Type
- hash_md5
- Value
3c4928659c13bdfbf974d1aae1327e37- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: not in VT
hash_sha1
fa36ae9531a4a32628ccaf0910d8051b9b42742f
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/fa36ae9531a4a32628ccaf0910d8051b9b42742f
IOC database
- Type
- hash_sha1
- Value
fa36ae9531a4a32628ccaf0910d8051b9b42742f- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/fa36ae9531a4a32628ccaf0910d8051b9b42742f
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 625125 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:57:31.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:arxiv.org
Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...
-
web:blog.darkgen.io
Diving into the Sample: First Impressions This time, I found a sample of the Mirai botnet compiled for ARM architecture. It was obviously labeled by antivirus engines as Mirai and fits perfectly with what was observed in dynamic analysis, threat intelligence feeds, and reverse engineering notes.
-
web:github.com
Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...
-
web:github.com
ADR-064: Stub Remediation & Full Implementation — v3.5.22 Date: 2026-03-17 Status: Implemented (22 stubs fully implemented in v3.5.43, PR #1438) Context: Deep capability audit (ADR-063) identified stub implementations and broken features. This ADR documents the remediation plan and tracks which items were already functional vs genuinely needing fixes.
-
web:link.springer.com
The Mirai botnet has emerged as one of the most persistent and evolving threats targeting Internet of Things devices. Originally designed to orchestrate large-scale Distributed Denial of Service attacks, Mirai compromises devices by exploiting weak credentials and...
-
web:link.springer.com
Mirai malware is the most famous malware in the field of IoT. It created much destruction around the end of the year 2016. With just a common password vulnerability of IoT devices, it created a large botnet of 600K–700K and was able to launch DDoS attacks that...
-
web:trainsec.net
Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...
-
web:westoahu.hawaii.edu
A botnet called Mirai infected hundreds of thousands of Internet of Things (IoT) devices, amassing a wide network of compromised devices. Mitigations against the Mirai botnet involve taking proactive security measures, properly hardening systems, and updating to the latest software to reduce the risk of compromise.
-
web:www.akamai.com
Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.