MB-efb69317428044a237f945e60c7383e6969db82a94144213b38f734d611a3e6e
high
📛 Threat Title
Mirai: qzxuuppn.i686
Description
File type: elf. Size: 1096312 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-23 23:43:11.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
efb69317428044a237f945e60c7383e6969db82a94144213b38f734d611a3e6e
IOC database
- Type
- hash_sha256
- Value
efb69317428044a237f945e60c7383e6969db82a94144213b38f734d611a3e6e- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
6678aa1d8a880228e1a627da757659c7fa0a80b2
IOC database
- Type
- hash_sha1
- Value
6678aa1d8a880228e1a627da757659c7fa0a80b2- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
7cf28bec5cec87d7125d3fefc8468106
IOC database
- Type
- hash_md5
- Value
7cf28bec5cec87d7125d3fefc8468106- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 1096312 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-23 23:43:11.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:arxiv.org
Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...
-
web:dailysecurityreview.com
A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.
-
web:dailysecurityreview.com
A new Mirai botnet is using zero-day exploits to target industrial routers and smart home devices, launching high-intensity DDoS attacks. Learn about the vulnerabilities and how to protect your systems.
-
web:github.com
This repository contains the leaked source code of the Mirai botnet, originally created to infect IoT devices and launch large-scale DDoS attacks. This code is provided strictly for cybersecurity research, reverse engineering, malware analysis, and detection development purposes only.
-
web:github.com
The duration between the public weaponization of an in-the-wild zero-day and the availability of tested, signed binary kernel packages from enterprise distributions (Ubuntu HWE, Debian, RHEL) typically spans 7 to 21 days. In production Kubernetes clusters, passively awaiting vendor packages exposes ...
-
web:rruzi.github.io
The C2 port is randomly selected between 25596 and 25616. In terms of the communication mechanism, Mirai .CatDDoS basically follows the original design of Mirai , except that the fixed 4-byte \x00\x00\x00\x01 when Mirai goes online is modified to a fixed 8-byte: \x31\x73\x13\x93\x04\x83\x32\x04 In terms of the ATTACK_VECTOR, Mirai .CatDDoS implements a richer variety of DDoS attack types than ...
-
web:westoahu.hawaii.edu
Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.
-
web:www.bleepingcomputer.com
A new Mirai -based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet.
-
web:www.helpnetsecurity.com
Security researchers have documented new Mirai variants leveraged in campaigns exploiting command injection flaws in consumer IoT devices.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.