MB-5a9589968d81f208848a2bbf9d701f99b27ae151876be0fa79fa1809cf5a538b
high
📛 Threat Title
Mirai: boatnet.arm7
Description
File type: elf. Size: 65036 bytes. Tags: elf, Mirai, upx. Reporter: abuse_ch. First seen: 2026-08-04 21:15:57.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
5a9589968d81f208848a2bbf9d701f99b27ae151876be0fa79fa1809cf5a538b
IOC database
- Type
- hash_sha256
- Value
5a9589968d81f208848a2bbf9d701f99b27ae151876be0fa79fa1809cf5a538b- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
a46d3b467c60c86ad901fb56e44cae63
IOC database
- Type
- hash_md5
- Value
a46d3b467c60c86ad901fb56e44cae63- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
e6f177e152789f55aacc421863132dca8180cfac
IOC database
- Type
- hash_sha1
- Value
e6f177e152789f55aacc421863132dca8180cfac- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 65036 bytes. Tags: elf, Mirai, upx. Reporter: abuse_ch. First seen: 2026-08-04 21:15:57.
Remediations (10)
-
web:any.run
Online sandbox report for boatnet.arm7 , tagged as auto, mirai , botnet, verdict: Malicious activity
-
web:cyberpress.org
Remote, unauthenticated attackers are able to inject arbitrary system commands, enabling full device compromise without user interaction. Investigation revealed that threat actors are leveraging the compromised endpoint to download and execute Mirai -based ARM malware, notably a variant referred to as "LZRD" (typically named boatnet.arm7 ). Upon execution, this Mirai variant displays a ...
-
web:cybersecuritynews.com
The Mirai botnet has resurfaced, exploiting command injection flaws in discontinued GeoVision IoT devices, disrupting cybersecurity again.
-
web:gbhackers.com
This effectively turns a defensive system feature into an anti- remediation tool. Tengu Mirai Botnet Uses Watchdog Further complicating incident response, Tengu implements "binary bricking" by overwriting critical system binaries associated with reboot and shutdown operations using malformed ELF headers.
-
web:tria.ge
Check this mirai report boatnet[.]arm7 , with a score of 10 out of 10.
-
web:www.akamai.com
Conclusion Mirai -based botnets continue to be a call for divorce for many organizations, and the prevalence of outdated IoT devices help propagate this threat. Like security researchers, some threat actors keep up to date on the latest vulnerability disclosures relevant to their illicit activities.
-
web:www.cybermaterial.com
The resurgence of the Mirai botnet has once again shaken the cybersecurity landscape, with a campaign targeting vulnerabilities in discontinued GeoVision IoT devices.
-
web:www.imda.gov.sg
Executive Summary FortiGuard Labs observed a resurgence of a Mirai -derived IoT botnet family dubbed "Gayfemboy" in July 2025, which has been exploiting network routers and devices vulnerabilities from vendors such as DrayTek, TP-Link, Raisecom, and Cisco. The botnet has been observed across multiple countries and sectors including the media and communications sector. The malware employs ...
-
web:www.joesandbox.com
Source: boatnet.arm7.elf Submission file: segment LOAD with 7.9534 entropy (max. 8.0) Malware Analysis System Evasion Uses the "uname" system call to query kernel version information (possible evasion) ... May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)
-
web:www.joesandbox.com
Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.