s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-61dbaac6b14b59df10ab20e75950ea4d7b5d57c086b2718f17aea62258aa4ea1 high

📛 Threat Title

Mirai: stub.armv6

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 625469 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:51:22.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 61dbaac6b14b59df10ab20e75950ea4d7b5d57c086b2718f17aea62258aa4ea1 VT 12 / 75

IOC database

Type
hash_sha256
Value
61dbaac6b14b59df10ab20e75950ea4d7b5d57c086b2718f17aea62258aa4ea1
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 12 of 75 VirusTotal vendors

VendorVerdictDetection
Arcabit malicious Trojan.Linux.Generic.D3946B2E
BitDefender malicious Trojan.Linux.GenericKD.60058414
CTX malicious elf.trojan.generic
Emsisoft malicious Trojan.Linux.GenericKD.60058414 (B)
ESET-NOD32 malicious Linux/Agent.BMJ trojan
GData malicious Trojan.Linux.GenericKD.60058414
huorong malicious Trojan/Linux.Agent.es
Lionic malicious Trojan.ELF.Mirai.4!c
Microsoft malicious Trojan:Script/Wacatac.C!ml
MicroWorld-eScan malicious Trojan.Linux.GenericKD.60058414
Rising malicious Backdoor.Mirai/Linux!1.14841 (CLASSIC)
VIPRE malicious Trojan.Linux.GenericKD.60058414

Details From VirusTotal

Basic Properties
MD5fb3e812ddb6ae7632994480f9c59b66d
SHA-1cb4f363985a8c85fb11f1b84997c6ce401f3ccab
SHA-25661dbaac6b14b59df10ab20e75950ea4d7b5d57c086b2718f17aea62258aa4ea1
VHashb468ddab6c3343c91277670130d15bb5
SSDEEP12288:F2ctKrS0XUwn67ayLtLiXRU2zzi6aNjodD6pmkVf32cgpeSa9VWKia:YCp7mXtni6aBh321eSiVWKx
TLSHT14FD44A55F8809F63C9C52A36F64E826833274779C7E7730689144B383BA7A6F0F3A645
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size610.8 KB
History
First seen on VirusTotal2026-09-25 12:17 UTC
Last submission2026-09-25 12:17 UTC
Last analysis2026-09-25 12:17 UTC
Last modified on VirusTotal2026-09-25 18:11 UTC
Known Names
  • 1k5sexfzx.exe
  • fb3e812ddb6ae7632994480f9c59b66d
hash_md5 fb3e812ddb6ae7632994480f9c59b66d VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/fb3e812ddb6ae7632994480f9c59b66d

IOC database

Type
hash_md5
Value
fb3e812ddb6ae7632994480f9c59b66d
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/fb3e812ddb6ae7632994480f9c59b66d

hash_sha1 cb4f363985a8c85fb11f1b84997c6ce401f3ccab VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/cb4f363985a8c85fb11f1b84997c6ce401f3ccab

IOC database

Type
hash_sha1
Value
cb4f363985a8c85fb11f1b84997c6ce401f3ccab
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/cb4f363985a8c85fb11f1b84997c6ce401f3ccab

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 625469 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:51:22.

Remediations (10)

  • Mirai Malware Analysis, Overview by ANY.RUN
    web:any.run

    Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  • A_Survey_on_The_Mirai_IoT_Botnet_and_Its_Recent_Variants (2)
    web:arxiv.org

    Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...

  • Mirai Malware Spreads Via GeoVision Zero-Day Exploit
    web:dailysecurityreview.com

    A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.

  • New Mirai Botnet Leverages Zero-Day Exploits on Routers
    web:dailysecurityreview.com

    A new Mirai botnet is using zero-day exploits to target industrial routers and smart home devices, launching high-intensity DDoS attacks. Learn about the vulnerabilities and how to protect your systems.

  • Mirai Source Code - GitHub
    web:github.com

    This repository contains the leaked source code of the Mirai botnet, originally created to infect IoT devices and launch large-scale DDoS attacks. This code is provided strictly for cybersecurity research, reverse engineering, malware analysis, and detection development purposes only.

  • ruflo-kimi/v3/implementation/adrs/ADR-064-stub-remediation ... - GitHub
    web:github.com

    ADR-064: Stub Remediation & Full Implementation — v3.5.22 Date: 2026-03-17 Status: Implemented (22 stubs fully implemented in v3.5.43, PR #1438) Context: Deep capability audit (ADR-063) identified stub implementations and broken features. This ADR documents the remediation plan and tracks which items were already functional vs genuinely needing fixes.

  • In-depth Analysis of a New Mirai Variant - rruzi.github.io
    web:rruzi.github.io

    The C2 port is randomly selected between 25596 and 25616. In terms of the communication mechanism, Mirai .CatDDoS basically follows the original design of Mirai , except that the fixed 4-byte \x00\x00\x00\x01 when Mirai goes online is modified to a fixed 8-byte: \x31\x73\x13\x93\x04\x83\x32\x04 In terms of the ATTACK_VECTOR, Mirai .CatDDoS implements a richer variety of DDoS attack types than ...

  • Mirai Botnet | ARM Reverse Engineering Walkthrough
    web:trainsec.net

    Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...

  • IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging ...
    web:unit42.paloaltonetworks.com

    Mirai is a still-active botnet with new variants. We highlight observed exploitation of IoT vulnerabilities — due to low complexity and high impact.

  • New Mirai campaign exploits RCE flaw in EoL D-Link routers
    web:www.bleepingcomputer.com

    A new Mirai -based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.