s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-3b138633a5ceaf51fe137b4dfd83cc26d0762d83d0c63e351f47867ec0121072 high

📛 Threat Title

Mirai: stub.i586

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 890035 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:38:07.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 3b138633a5ceaf51fe137b4dfd83cc26d0762d83d0c63e351f47867ec0121072 VT 15 / 75

IOC database

Type
hash_sha256
Value
3b138633a5ceaf51fe137b4dfd83cc26d0762d83d0c63e351f47867ec0121072
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 15 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Trojan.Linux.GenericKD.60057791
Antiy-AVL malicious Trojan/Linux.Zapchast
Arcabit malicious Trojan.Linux.Generic.D3946A6E
BitDefender malicious Trojan.Linux.GenericKD.60058222
CTX malicious elf.trojan.generic
Emsisoft malicious Trojan.Linux.GenericKD.60058222 (B)
ESET-NOD32 malicious Linux/Agent.BMJ trojan
GData malicious Trojan.Linux.GenericKD.60058222
huorong malicious Trojan/Linux.Agent.es
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Script/Dirtydecrypt.EAA
Microsoft malicious Trojan:Script/Wacatac.C!ml
MicroWorld-eScan malicious Trojan.Linux.GenericKD.60058222
Tencent malicious Malware.Linux.Generic.1c0c123d
VIPRE malicious Trojan.Linux.GenericKD.60058222

Details From VirusTotal

Basic Properties
MD5db973a40ae668ca5b05ce9a94cb5b0e6
SHA-158fb60567818a0be9b9467c411f8ec40b1093bf3
SHA-2563b138633a5ceaf51fe137b4dfd83cc26d0762d83d0c63e351f47867ec0121072
VHasheec77128256b007eaf21ffa93e146bc4
SSDEEP12288:ZugNP46S4QVs7a+6xGv/7VZji59IH0j/APyYiztSIHmxAowYRsXPi/4:7NP46S4QVs7l6A5Zji59k0jZz06FYRs5
TLSHT1A4157C5BB2F374BDC157C134479BCA72A935F46502122E7FA1C8C6302E2AE641B1AF76
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=254243f4644a531f0b1396c2dd32b9080165d855, for GNU/Linux 3.2.0, not stripped
File size869.2 KB
History
First seen on VirusTotal2026-09-25 11:13 UTC
Last submission2026-09-25 11:13 UTC
Last analysis2026-09-25 11:13 UTC
Last modified on VirusTotal2026-09-25 18:18 UTC
Known Names
  • xy8gcnc.exe
  • copy
hash_sha1 58fb60567818a0be9b9467c411f8ec40b1093bf3 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/58fb60567818a0be9b9467c411f8ec40b1093bf3

IOC database

Type
hash_sha1
Value
58fb60567818a0be9b9467c411f8ec40b1093bf3
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/58fb60567818a0be9b9467c411f8ec40b1093bf3

hash_md5 db973a40ae668ca5b05ce9a94cb5b0e6 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/db973a40ae668ca5b05ce9a94cb5b0e6

IOC database

Type
hash_md5
Value
db973a40ae668ca5b05ce9a94cb5b0e6
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/db973a40ae668ca5b05ce9a94cb5b0e6

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 890035 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:38:07.

Remediations (10)

  • Mirai Malware Analysis, Overview by ANY.RUN
    web:any.run

    Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  • Installation Guide | lion001am/Condi-Mirai | DeepWiki
    web:deepwiki.com

    This guide provides comprehensive instructions for setting up the Condi- Mirai botnet environment, including system dependencies, cross-compiler installation, database configuration, and service execution.

  • Mirai Source Code - GitHub
    web:github.com

    This repository contains the leaked source code of the Mirai botnet, originally created to infect IoT devices and launch large-scale DDoS attacks. This code is provided strictly for cybersecurity research, reverse engineering, malware analysis, and detection development purposes only.

  • GitHub - malol01/cross-compiler-for-mirai-archive · GitHub
    web:github.com

    Contribute to malol01/cross-compiler-for- mirai -archive development by creating an account on GitHub.

  • mirailovers.io
    web:mirailovers.io

    okay this is fixed tutorial for setup any mirai botnet on centos7, just keep in mind in some sources you need encrypt and replace hash string in table.c for cnc and scan domain ( also the others ip address with your own in main.go , main.c and etc.. } root~#@: setup tut for centos7 website~#@: https://mirailovers/ telegram~#@: https://t.me ...

  • In-depth Analysis of a New Mirai Variant - rruzi.github.io
    web:rruzi.github.io

    The C2 port is randomly selected between 25596 and 25616. In terms of the communication mechanism, Mirai .CatDDoS basically follows the original design of Mirai , except that the fixed 4-byte \x00\x00\x00\x01 when Mirai goes online is modified to a fixed 8-byte: \x31\x73\x13\x93\x04\x83\x32\x04 In terms of the ATTACK_VECTOR, Mirai .CatDDoS implements a richer variety of DDoS attack types than ...

  • IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging ...
    web:unit42.paloaltonetworks.com

    Mirai is a still-active botnet with new variants. We highlight observed exploitation of IoT vulnerabilities — due to low complexity and high impact.

  • Automated Malware Analysis Report for i586.elf - Joe Sandbox
    web:www.joesandbox.com

    i586.elf Time: 03:25:54 Date: 25/06/2026 Version: 44.0.0 Smoke Quartz General Information Detection

  • Automated Malware Analysis Report for mirai.i586.elf - Joe Sandbox
    web:www.joesandbox.com

    Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese.

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2400 samples tracked, 24 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.