MB-4166271006e249bbcd116d3e9e79d8c4267fde5fd78dc587d45c48909e0bdcfb
high
📛 Threat Title
Mirai: iran.m68k
Description
File type: elf. Size: 180388 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-07-28 15:08:54.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
4166271006e249bbcd116d3e9e79d8c4267fde5fd78dc587d45c48909e0bdcfb
IOC database
- Type
- hash_sha256
- Value
4166271006e249bbcd116d3e9e79d8c4267fde5fd78dc587d45c48909e0bdcfb- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
2b206c2e40b9c634b07d2d17c0518e5c00535b5e
IOC database
- Type
- hash_sha1
- Value
2b206c2e40b9c634b07d2d17c0518e5c00535b5e- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
7bee6ae8d8d6590531afbd77e236eda6
IOC database
- Type
- hash_md5
- Value
7bee6ae8d8d6590531afbd77e236eda6- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 180388 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-07-28 15:08:54.
Remediations (10)
-
web:blog.cloudflare.com
This post offers a retrospective on Mirai , the infamous IoT botnet that disrupted major websites with massive DDoS attacks, leveraging hundreds of thousands of compromised Internet-of-Things devices.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:westoahu.hawaii.edu
Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.
-
web:www.cisa.gov
Cybersecurity Advisory: Provides detailed information on cyber threats, including threat actor tactics, techniques, and procedures and indicators of compromise, along with recommended actions for detection, mitigation , and response.
-
web:www.joesandbox.com
Signatures Antivirus / Scanner detection for submitted sample Found malware configuration Multi AV Scanner detection for submitted file Yara detected Gafgyt Yara detected Mirai Drops files in suspicious directories Sample tries to set files in /etc globally writable Detected TCP or UDP traffic on non-standard ports Enumerates processes within the "proc" file system Executes the "rm" command ...
-
web:www.joesandbox.com
Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese.
-
web:www.quorumcyber.com
Mirai initially infected and weaponised devices such as smart cameras and Realtek routers2. The botnet variant was created in a racketeering attempt by the cofounders of Protraf Solutions, an organisation offering DDoS mitigation services.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.