MB-441001f00c258a69d19accf005444e25f03a5923cda288d70d0e3b0779aa9de2
high
📛 Threat Title
Mirai: sh4
Description
File type: elf. Size: 51156 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-11-08 08:11:03.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
441001f00c258a69d19accf005444e25f03a5923cda288d70d0e3b0779aa9de2
IOC database
- Type
- hash_sha256
- Value
441001f00c258a69d19accf005444e25f03a5923cda288d70d0e3b0779aa9de2- First seen
- Last seen
- Attached to this threat
- Appears in
- 3 threats
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
c94271148e0be8b6618dc6ca7c26c75d0353d99c
IOC database
- Type
- hash_sha1
- Value
c94271148e0be8b6618dc6ca7c26c75d0353d99c- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
d6fa8bce94074186ec6c6a8586ca5ba6
IOC database
- Type
- hash_md5
- Value
d6fa8bce94074186ec6c6a8586ca5ba6- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 51156 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-11-08 08:11:03.
Remediations (10)
-
web:arxiv.org
Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...
-
web:cromwell-intl.com
The botnet was made up largely of IoT or "Internet of Things" devices — IP cameras, home routers, baby monitors, digital video recorders, and printers. Mirai's creators originally used their malware to overwhelm Minecraft servers and companies offering DDoS mitigation services. They were using Mirai to run a protection racket.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:socprime.com
Explore the Mirai Botnet Digest: in-depth threat overview, analytics, and actionable remediation insights to detect and defend against Mirai -based IoT attacks.
-
web:unit42.paloaltonetworks.com
Mirai is a still-active botnet with new variants. We highlight observed exploitation of IoT vulnerabilities — due to low complexity and high impact.
-
web:www.jisem-journal.com
Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices compromised by malware. The methods presented are generic and can be used to mitigate any malware of the same nature.
-
web:www.joesandbox.com
Automated Malware Analysis - Joe Sandbox Analysis Report Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source ...
-
web:www.joesandbox.com
Behavior Graph ID: 1822408 Sample: mirai . sh4 .elf Startdate: 28/11/2025 Architecture: LINUX Score: 76 185.125.190.26, 443 CANONICAL-ASGB United Kingdom Malicious sample detected (through community Yara rule) Antivirus / Scanner detection for submitted sample
-
web:www.quorumcyber.com
Mirai initially infected and weaponised devices such as smart cameras and Realtek routers2. The botnet variant was created in a racketeering attempt by the cofounders of Protraf Solutions, an organisation offering DDoS mitigation services.
-
web:www.sciencedirect.com
Mirai , which means 'future' in Japanese, foreshadowing a more than a one time event, modeled the future of significant attacks to come. Mitigation efforts include patching the vulnerabilities that are leveraged by the Mirai malware family and detecting/preventing Mirai from entering IoT networks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.