s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

URLhaus-PL-61dbaac6b14b59df10ab20e75950ea4d7b5d57c086b2718f17aea62258aa4ea1 medium

📛 Threat Title

URLhaus payload: Mirai (elf) 61dbaac6b14b59df…

Category: Mirai Published: Source updated: First seen: Last updated: Source: URLhaus

Description

Malware family: Mirai. File type: elf. Size: 625,469 bytes. First seen: 2026-09-25 11:38:47.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 61dbaac6b14b59df10ab20e75950ea4d7b5d57c086b2718f17aea62258aa4ea1 VT 12 / 75

IOC database

Type
hash_sha256
Value
61dbaac6b14b59df10ab20e75950ea4d7b5d57c086b2718f17aea62258aa4ea1
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 12 of 75 VirusTotal vendors

VendorVerdictDetection
Arcabit malicious Trojan.Linux.Generic.D3946B2E
BitDefender malicious Trojan.Linux.GenericKD.60058414
CTX malicious elf.trojan.generic
Emsisoft malicious Trojan.Linux.GenericKD.60058414 (B)
ESET-NOD32 malicious Linux/Agent.BMJ trojan
GData malicious Trojan.Linux.GenericKD.60058414
huorong malicious Trojan/Linux.Agent.es
Lionic malicious Trojan.ELF.Mirai.4!c
Microsoft malicious Trojan:Script/Wacatac.C!ml
MicroWorld-eScan malicious Trojan.Linux.GenericKD.60058414
Rising malicious Backdoor.Mirai/Linux!1.14841 (CLASSIC)
VIPRE malicious Trojan.Linux.GenericKD.60058414

Details From VirusTotal

Basic Properties
MD5fb3e812ddb6ae7632994480f9c59b66d
SHA-1cb4f363985a8c85fb11f1b84997c6ce401f3ccab
SHA-25661dbaac6b14b59df10ab20e75950ea4d7b5d57c086b2718f17aea62258aa4ea1
VHashb468ddab6c3343c91277670130d15bb5
SSDEEP12288:F2ctKrS0XUwn67ayLtLiXRU2zzi6aNjodD6pmkVf32cgpeSa9VWKia:YCp7mXtni6aBh321eSiVWKx
TLSHT14FD44A55F8809F63C9C52A36F64E826833274779C7E7730689144B383BA7A6F0F3A645
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size610.8 KB
History
First seen on VirusTotal2026-09-25 12:17 UTC
Last submission2026-09-25 12:17 UTC
Last analysis2026-09-25 12:17 UTC
Last modified on VirusTotal2026-09-25 18:11 UTC
Known Names
  • 1k5sexfzx.exe
  • fb3e812ddb6ae7632994480f9c59b66d
hash_md5 fb3e812ddb6ae7632994480f9c59b66d VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/fb3e812ddb6ae7632994480f9c59b66d

IOC database

Type
hash_md5
Value
fb3e812ddb6ae7632994480f9c59b66d
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/fb3e812ddb6ae7632994480f9c59b66d

hash_ssdeep 12288:f2ctkrs0xuwn67ayltlixru2zzi6anjodd6pmkvf32cgpesa9vwkia:ycp7mxtni6abh321esivwkx

IOC database

Type
hash_ssdeep
Value
12288:f2ctkrs0xuwn67ayltlixru2zzi6anjodd6pmkvf32cgpesa9vwkia:ycp7mxtni6abh321esivwkx
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
ssdeep of URLhaus payload 61dbaac6b14b59df…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_tlsh t14fd44a55f8809f63c9c52a36f64e826833274779c7e7730689144b383ba7a6f0f3a6

IOC database

Type
hash_tlsh
Value
t14fd44a55f8809f63c9c52a36f64e826833274779c7e7730689144b383ba7a6f0f3a6
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
TLSH of URLhaus payload 61dbaac6b14b59df…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

Remediations (10)

  • URLhaus: elf Malicious URLs | SOC Hunt Feed
    web:davidgodwinpratt.com

    Hunt Hypothesis Adversaries may be using malicious URLs tagged as elf to deliver payloads or exfiltrate data, leveraging compromised or phishing-based attack vectors. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential command and control or data exfiltration activities early.

  • URLhaus: mirai Malicious URLs | SOC Hunt Feed
    web:davidgodwinpratt.com

    References URLhaus False Positive Guidance Scenario:A system administrator is manually testing a Mirai -based exploit detection tool by uploading a known benign payload for analysis. Filter/Exclusion:Exclude URLs containing the string test_payloador sandbox-analysis.

  • felixrayyen-alt/Mirai-Botnet-Static-Analysis - GitHub
    web:github.com

    🦠 Mirai Botnet - Malware Static Analysis This repository contains a comprehensive Static Analysis and Reverse Engineering report of the notorious Mirai Malware ( ELF 32-bit binary). This project was conducted as part of the Reverse Engineering Midterm Exam at Universitas Amikom Yogyakarta.

  • Mirai Source Code - GitHub
    web:github.com

    This repository contains the leaked source code of the Mirai botnet, originally created to infect IoT devices and launch large-scale DDoS attacks. This code is provided strictly for cybersecurity research, reverse engineering, malware analysis, and detection development purposes only.

  • Mirai (Malware Family) - Fraunhofer
    web:malpedia.caad.fkie.fraunhofer.de

    Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the ...

  • 5.182.210.61 Review: URLhaus and urlscan Signals Before Opening Mirai ...
    web:trustverification.org

    Evidence-safe review of 5.182.210.61 based on exact URLhaus rows and a urlscan lookup for suspicious download-path signals.

  • URLhaus | Malware URL exchange
    web:urlhaus.abuse.ch

    URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  • URLhaus | http://60.162.46.87:44499/i
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • Mirai's Shifting Build Pipeline: UPX Decoy Packing + URLhaus ...
    web:www.threatclaw.ai

    Mirai Build-Tooling Signal Divergence: UPX-Dec Wrapping and the Evolving IoT Botnet Supply Chain The last 24 hours of MalwareBazaar submissions reveal a subtle but meaningful shift in the Mirai build pipeline. All six fresh samples are ELF binaries tagged with either upx or upx-dec packing, alongside three active malware-download URLs correlated across URLhaus . This is not random noise — the ...

  • Mozi Is Dead in Name Only: The 24h IoT Dual-Rail Delivery (Mozi.m/.a ...
    web:www.threatclaw.ai

    In the last 24 hours the ThreatFox feed surfaced a rare and specific pattern: two distinct Mozi payload rails served alongside a mainstream Mirai ELF delivery rail, all from the same class of low-reputation hosting infrastructure.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.