s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-08fac66927bec5cfc2d40d5040e5acf127d341565e484f98d4e6c4528d2937b1 high

📛 Threat Title

Mirai: stub.amd64

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 889984 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:44:50.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 08fac66927bec5cfc2d40d5040e5acf127d341565e484f98d4e6c4528d2937b1 VT 15 / 75

IOC database

Type
hash_sha256
Value
08fac66927bec5cfc2d40d5040e5acf127d341565e484f98d4e6c4528d2937b1
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 15 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Trojan.Linux.GenericKD.60057791
Antiy-AVL malicious Trojan/Linux.Zapchast
Arcabit malicious Trojan.Linux.Generic.D3946A6E
BitDefender malicious Trojan.Linux.GenericKD.60058222
CTX malicious elf.trojan.generic
Emsisoft malicious Trojan.Linux.GenericKD.60058222 (B)
ESET-NOD32 malicious Linux/Agent.BMJ trojan
GData malicious Trojan.Linux.GenericKD.60058222
huorong malicious Trojan/Linux.Agent.es
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Script/Dirtydecrypt.EAA
Microsoft malicious Trojan:Script/Wacatac.B!ml
MicroWorld-eScan malicious Trojan.Linux.GenericKD.60058222
Tencent malicious Malware.Linux.Generic.1c0c123d
VIPRE malicious Trojan.Linux.GenericKD.60058222

Details From VirusTotal

Basic Properties
MD552a6f6df53d0413f6eb6186b7c8a24df
SHA-171854bdbb639fd39794a2cca2e999b70204b442a
SHA-25608fac66927bec5cfc2d40d5040e5acf127d341565e484f98d4e6c4528d2937b1
VHasheec77128256b007eaf21ffa93e146bc4
SSDEEP12288:ZugNP46S4QVs7a+6xGv/7VZji59IH0j/APyYiztSIHmxAowYRsXPi/c:7NP46S4QVs7l6A5Zji59k0jZz06FYRsf
TLSHT11D157C5BB2F374BDC157C134479BCA72A935F46502122E7FA1C8C6302E2AE641B1AF76
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=254243f4644a531f0b1396c2dd32b9080165d855, for GNU/Linux 3.2.0, not stripped
File size869.1 KB
History
First seen on VirusTotal2026-09-25 11:28 UTC
Last submission2026-09-25 11:28 UTC
Last analysis2026-09-25 11:28 UTC
Last modified on VirusTotal2026-09-25 13:28 UTC
Known Names
  • copy
hash_sha1 71854bdbb639fd39794a2cca2e999b70204b442a VT 15 / 75

IOC database

Type
hash_sha1
Value
71854bdbb639fd39794a2cca2e999b70204b442a
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 15 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Trojan.Linux.GenericKD.60057791
Antiy-AVL malicious Trojan/Linux.Zapchast
Arcabit malicious Trojan.Linux.Generic.D3946A6E
BitDefender malicious Trojan.Linux.GenericKD.60058222
CTX malicious elf.trojan.generic
Emsisoft malicious Trojan.Linux.GenericKD.60058222 (B)
ESET-NOD32 malicious Linux/Agent.BMJ trojan
GData malicious Trojan.Linux.GenericKD.60058222
huorong malicious Trojan/Linux.Agent.es
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Script/Dirtydecrypt.EAA
Microsoft malicious Trojan:Script/Wacatac.B!ml
MicroWorld-eScan malicious Trojan.Linux.GenericKD.60058222
Tencent malicious Malware.Linux.Generic.1c0c123d
VIPRE malicious Trojan.Linux.GenericKD.60058222

Details From VirusTotal

Basic Properties
MD552a6f6df53d0413f6eb6186b7c8a24df
SHA-171854bdbb639fd39794a2cca2e999b70204b442a
SHA-25608fac66927bec5cfc2d40d5040e5acf127d341565e484f98d4e6c4528d2937b1
VHasheec77128256b007eaf21ffa93e146bc4
SSDEEP12288:ZugNP46S4QVs7a+6xGv/7VZji59IH0j/APyYiztSIHmxAowYRsXPi/c:7NP46S4QVs7l6A5Zji59k0jZz06FYRsf
TLSHT11D157C5BB2F374BDC157C134479BCA72A935F46502122E7FA1C8C6302E2AE641B1AF76
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=254243f4644a531f0b1396c2dd32b9080165d855, for GNU/Linux 3.2.0, not stripped
File size869.1 KB
History
First seen on VirusTotal2026-09-25 11:28 UTC
Last submission2026-09-25 11:28 UTC
Last analysis2026-09-25 11:28 UTC
Last modified on VirusTotal2026-09-25 13:28 UTC
Known Names
  • copy
hash_md5 52a6f6df53d0413f6eb6186b7c8a24df VT 15 / 75

IOC database

Type
hash_md5
Value
52a6f6df53d0413f6eb6186b7c8a24df
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 15 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Trojan.Linux.GenericKD.60057791
Antiy-AVL malicious Trojan/Linux.Zapchast
Arcabit malicious Trojan.Linux.Generic.D3946A6E
BitDefender malicious Trojan.Linux.GenericKD.60058222
CTX malicious elf.trojan.generic
Emsisoft malicious Trojan.Linux.GenericKD.60058222 (B)
ESET-NOD32 malicious Linux/Agent.BMJ trojan
GData malicious Trojan.Linux.GenericKD.60058222
huorong malicious Trojan/Linux.Agent.es
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Script/Dirtydecrypt.EAA
Microsoft malicious Trojan:Script/Wacatac.B!ml
MicroWorld-eScan malicious Trojan.Linux.GenericKD.60058222
Tencent malicious Malware.Linux.Generic.1c0c123d
VIPRE malicious Trojan.Linux.GenericKD.60058222

Details From VirusTotal

Basic Properties
MD552a6f6df53d0413f6eb6186b7c8a24df
SHA-171854bdbb639fd39794a2cca2e999b70204b442a
SHA-25608fac66927bec5cfc2d40d5040e5acf127d341565e484f98d4e6c4528d2937b1
VHasheec77128256b007eaf21ffa93e146bc4
SSDEEP12288:ZugNP46S4QVs7a+6xGv/7VZji59IH0j/APyYiztSIHmxAowYRsXPi/c:7NP46S4QVs7l6A5Zji59k0jZz06FYRsf
TLSHT11D157C5BB2F374BDC157C134479BCA72A935F46502122E7FA1C8C6302E2AE641B1AF76
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=254243f4644a531f0b1396c2dd32b9080165d855, for GNU/Linux 3.2.0, not stripped
File size869.1 KB
History
First seen on VirusTotal2026-09-25 11:28 UTC
Last submission2026-09-25 11:28 UTC
Last analysis2026-09-25 11:28 UTC
Last modified on VirusTotal2026-09-25 13:28 UTC
Known Names
  • copy

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 889984 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:44:50.

Remediations (10)

  • Mirai Malware Analysis, Overview by ANY.RUN
    web:any.run

    Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  • A_Survey_on_The_Mirai_IoT_Botnet_and_Its_Recent_Variants (2)
    web:arxiv.org

    Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • Mirai Malware Spreads Via GeoVision Zero-Day Exploit
    web:dailysecurityreview.com

    A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.

  • remediation-project/samples/mirai at main · Adelyn224 ... - GitHub
    web:github.com

    remediation project. Contribute to Adelyn224/ remediation -project development by creating an account on GitHub.

  • GitHub - endorlabs/MIRAI
    web:github.com

    MIRAI is an abstract interpreter for the Rust compiler's mid-level intermediate representation (MIR). It is intended to become a widely used static analysis tool for Rust.

  • Dissecting Mirai: Spatio-Sequential Analysis and Restoration ... - Springer
    web:link.springer.com

    Following the public release of its source code in 2016, numerous variants have proliferated, broadening its attack surface and complicating detection and mitigation efforts. Despite extensive research on Mirai , existing analyses remain fragmented and informal, lacking a structured representation of its attack patterns.

  • Mirai Botnet | ARM Reverse Engineering Walkthrough
    web:trainsec.net

    Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...

  • Mirai Botnet Forensic Analysis - Cyber - westoahu.hawaii.edu
    web:westoahu.hawaii.edu

    Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2400 samples tracked, 24 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.