MB-681430f4b1bc6707005f6dc72f30cca63ccbdf5a71852945dc600383cdbaf8b8 high

Description

File type: elf. Size: 944587 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-23 23:43:04.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• MalwareBazaar sample page Abuse.ch

  File type: elf. Size: 944587 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-23 23:43:04.

• Mirai Malware Analysis, Overview by ANY.RUN
  web:any.run

  Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  2026-09-24 04:02 UTC
• Analyzing the Mirai ARM-Based IoT Malware - blog.darkgen.io
  web:blog.darkgen.io

  Supplement persistence layers: Mirai has nothing; only the re-infection scripts operate on the restart. On the whole, the disassembly clears up the case that Mirai is an efficient, straight, and goal-oriented ARM malware engaged in large botnet activity. I might drop a full breakdown video of the disassembly and analysis soon, so keep an eye out.

  2026-09-24 04:02 UTC
• Mirai Malware Spreads Via GeoVision Zero-Day Exploit
  web:dailysecurityreview.com

  A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.

  2026-09-24 04:02 UTC
• Mirai Source Code - GitHub
  web:github.com

  Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...

  2026-09-24 04:02 UTC
• Remediate vulnerabilities with Microsoft Defender Vulnerability ...
  web:learn.microsoft.com

  Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.

  2026-09-24 04:02 UTC
• In-depth Analysis of a New Mirai Variant - rruzi.github.io
  web:rruzi.github.io

  In-depth Analysis of a New Mirai Variant 7 minute read Published: December 28, 2024 I. Background Recently, NSFOCUS [1], National Cyber Security Center (NCSC) [2], and 360 Security Brain [3] detected a batch of botnet samples that integrate the TEA algorithm for encryption based on the leaked source code of Mirai , targeting IoT/Linux devices of various architectures such as ARM, MIPS, and x86 ...

  2026-09-24 04:02 UTC
• Mirai Botnet | ARM Reverse Engineering Walkthrough
  web:trainsec.net

  In this particular case, I found an ARM-compiled Mirai botnet sample. The anti-virus checks labeled it as " Mirai ," matching what I found in the documentation, sandbox analyses, and community threat intelligence sources. Mirai is known to compile variants for multiple architectures (ARM, MIPS, x86, x64, etc.), making it adaptable and widespread.

  2026-09-24 04:02 UTC
• Here Comes Mirai: IoT Devices RSVP to Active Exploitation
  web:www.akamai.com

  Active exploitation The earliest exploit attempt targeting this URI that the Akamai SIRT observed was in early April 2025. Once we decoded the payload, we found that the botnet is injecting commands into the szSrvIpAddr option to download and execute an ARM-based Mirai malware file named "boatnet", which is a common Mirai nomenclature ...

  2026-09-24 04:02 UTC
• InfectedSlurs Botnet Spreads Mirai via Zero-Days - Akamai
  web:www.akamai.com

  Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .

  2026-09-24 04:02 UTC
• New Mirai campaign exploits RCE flaw in EoL D-Link routers
  web:www.bleepingcomputer.com

  A new Mirai -based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet.

  2026-09-24 04:02 UTC

Only Available for Registered Users. Sign in to view.