TF-1932652 high

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Mirai (aliases: Katana). Confidence: 95. First seen: 2026-09-25 03:37:41 UTC. Reporter: whack_sh. Tags: elf, exe, Mirai.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Mirai (aliases: Katana). Confidence: 95. First seen: 2026-09-25 03:37:41 UTC. Reporter: whack_sh. Tags: elf, exe, Mirai.

• Mirai Malware Analysis, Overview by ANY.RUN
  web:any.run

  Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial- of -service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  2026-09-25 15:08 UTC
• MalwareBazaar | Mirai - abuse.ch
  web:bazaar.abuse.ch

  A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Mirai .

  2026-09-25 15:08 UTC
• MalwareBazaar | SHA256 ...
  web:bazaar.abuse.ch

  You are currently viewing the MalwareBazaar entry for SHA256 3a87f9a9f0ac2407e7b413926cc23d47c5e17d4ab554bcbb221661dbc0feab9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

  2026-09-25 15:08 UTC
• GitHub - hitesh70200/Malware_Analysis_Mirai: Static and dynamic ...
  web:github.com

  This repository contains a comprehensive malware analysis report focusing on the Mirai IoT botnet. The project details the setup of a secure malware analysis laboratory and presents a research-based analysis of the Mirai malware . It covers the critical aspects of establishing an isolated analysis environment, the selection of appropriate tools, and a thorough investigation of Mirai's ...

  2026-09-25 15:08 UTC
• IoT.Mirai-malware-analysis-report- - GitHub
  web:github.com

  This repository contains a static malware analysis of the IoT Mirai malware (loader component) obtained from theZoo malware repository. The objective of this project is to understand Mirai's infection mechanism, network behavior, architecture-specific payload delivery, and execution flow using reverse engineering techniques.

  2026-09-25 15:08 UTC
• Malware Hashes - File Hash Intelligence | isMalicious
  web:ismalicious.com

  Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.

  2026-09-25 15:08 UTC
• In-depth Analysis of a New Mirai Variant - RrUZi / Malware Protocol ...
  web:rruzi.github.io

  The sample sends attack packets to the target victim machine via the send function at the end of the attack_udp_openvpn function. The sent data payload is the fixed memory content pointed to by unk_211040: ... We then captured the traffic generated by the sample in a controlled environment, and the generated data was consistent with our memory ...

  2026-09-25 15:08 UTC
• ThreatFox ...
  web:threatfox.abuse.ch

  Mirai IOC: 699fa283e313c4ac5a5f366923201c20c75380c6f4dff1e87598e858f090d95c ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  2026-09-25 15:08 UTC
• InfectedSlurs Botnet Spreads Mirai via Zero-Days - Akamai
  web:www.akamai.com

  Fig. 1: Unique JenX Mirai -related console string from a malware sample with the SHA256 hash of ac43c52b42b123e2530538273dfb12e3b70178aa1dee6d4fd5198c08bfeb4dc1

  2026-09-25 15:08 UTC
• Mirai Malware - IOCs, Reports & Analysis (2026)
  web:www.yazoul.net

  Mirai threat intelligence: 2400 samples tracked, 24 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

  2026-09-25 15:08 UTC

Only Available for Registered Users. Sign in to view.