s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-3a1265165f281628e3a21cf566ea97e9e87e7bbb098ea0f031c469f2538584fe high

📛 Threat Title

Mirai: iran.sh4

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 142140 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:44.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 3a1265165f281628e3a21cf566ea97e9e87e7bbb098ea0f031c469f2538584fe VT 34 / 75

IOC database

Type
hash_sha256
Value
3a1265165f281628e3a21cf566ea97e9e87e7bbb098ea0f031c469f2538584fe
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 34 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
ALYac malicious Trojan.Generic.40640789
Antiy-AVL malicious Trojan[Backdoor]/Linux.Gafgyt
Arcabit malicious Trojan.Generic.D26C2115
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
BitDefender malicious Trojan.Generic.40640789
ClamAV malicious Unix.Dropper.Mirai-7136288-0
CTX malicious elf.trojan.generic
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Emsisoft malicious Trojan.Generic.40640789 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Gafgyt.P!MTB
MicroWorld-eScan malicious Trojan.Generic.40640789
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!851E831922AC
Sophos malicious Mal/Generic-S
Tencent malicious Trojan.Linux.Mirai.zk
TrellixENS malicious LINUX/Mirai-FPL!851E831922AC
Varist malicious E32/Mirai.EN.gen!Camelot
VIPRE malicious Trojan.Generic.40640789

Details From VirusTotal

Basic Properties
MD5851e831922ace4c0071bce11dd94a926
SHA-1089e324cc38bf67e22e8256e82067354421c66ed
SHA-2563a1265165f281628e3a21cf566ea97e9e87e7bbb098ea0f031c469f2538584fe
VHash92533318fb6f0365eefd25090e7df146
SSDEEP3072:5WbCJEcdQ29RHrmP71xmbdspxYNWtrcVhQTlt:5WREQuRHrmjebmo4trkQRt
TLSHT1A2D35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
File size138.8 KB
History
First seen on VirusTotal2026-10-21 18:28 UTC
Last submission2026-10-21 18:28 UTC
Last analysis2026-10-21 18:28 UTC
Last modified on VirusTotal2026-10-21 20:30 UTC
Known Names
  • 8z936z5m.exe
  • sh4
  • iran.sh4
hash_sha1 089e324cc38bf67e22e8256e82067354421c66ed VT 34 / 75

IOC database

Type
hash_sha1
Value
089e324cc38bf67e22e8256e82067354421c66ed
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 34 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
ALYac malicious Trojan.Generic.40640789
Antiy-AVL malicious Trojan[Backdoor]/Linux.Gafgyt
Arcabit malicious Trojan.Generic.D26C2115
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
BitDefender malicious Trojan.Generic.40640789
ClamAV malicious Unix.Dropper.Mirai-7136288-0
CTX malicious elf.trojan.generic
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Emsisoft malicious Trojan.Generic.40640789 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Gafgyt.P!MTB
MicroWorld-eScan malicious Trojan.Generic.40640789
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!851E831922AC
Sophos malicious Mal/Generic-S
Tencent malicious Trojan.Linux.Mirai.zk
TrellixENS malicious LINUX/Mirai-FPL!851E831922AC
Varist malicious E32/Mirai.EN.gen!Camelot
VIPRE malicious Trojan.Generic.40640789

Details From VirusTotal

Basic Properties
MD5851e831922ace4c0071bce11dd94a926
SHA-1089e324cc38bf67e22e8256e82067354421c66ed
SHA-2563a1265165f281628e3a21cf566ea97e9e87e7bbb098ea0f031c469f2538584fe
VHash92533318fb6f0365eefd25090e7df146
SSDEEP3072:5WbCJEcdQ29RHrmP71xmbdspxYNWtrcVhQTlt:5WREQuRHrmjebmo4trkQRt
TLSHT1A2D35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
File size138.8 KB
History
First seen on VirusTotal2026-10-21 18:28 UTC
Last submission2026-10-21 18:28 UTC
Last analysis2026-10-21 18:28 UTC
Last modified on VirusTotal2026-10-21 20:30 UTC
Known Names
  • 8z936z5m.exe
  • sh4
  • iran.sh4
hash_md5 851e831922ace4c0071bce11dd94a926 VT 34 / 75

IOC database

Type
hash_md5
Value
851e831922ace4c0071bce11dd94a926
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 34 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
ALYac malicious Trojan.Generic.40640789
Antiy-AVL malicious Trojan[Backdoor]/Linux.Gafgyt
Arcabit malicious Trojan.Generic.D26C2115
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
BitDefender malicious Trojan.Generic.40640789
ClamAV malicious Unix.Dropper.Mirai-7136288-0
CTX malicious elf.trojan.generic
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Emsisoft malicious Trojan.Generic.40640789 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Gafgyt.P!MTB
MicroWorld-eScan malicious Trojan.Generic.40640789
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!851E831922AC
Sophos malicious Mal/Generic-S
Tencent malicious Trojan.Linux.Mirai.zk
TrellixENS malicious LINUX/Mirai-FPL!851E831922AC
Varist malicious E32/Mirai.EN.gen!Camelot
VIPRE malicious Trojan.Generic.40640789

Details From VirusTotal

Basic Properties
MD5851e831922ace4c0071bce11dd94a926
SHA-1089e324cc38bf67e22e8256e82067354421c66ed
SHA-2563a1265165f281628e3a21cf566ea97e9e87e7bbb098ea0f031c469f2538584fe
VHash92533318fb6f0365eefd25090e7df146
SSDEEP3072:5WbCJEcdQ29RHrmP71xmbdspxYNWtrcVhQTlt:5WREQuRHrmjebmo4trkQRt
TLSHT1A2D35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
File size138.8 KB
History
First seen on VirusTotal2026-10-21 18:28 UTC
Last submission2026-10-21 18:28 UTC
Last analysis2026-10-21 18:28 UTC
Last modified on VirusTotal2026-10-21 20:30 UTC
Known Names
  • 8z936z5m.exe
  • sh4
  • iran.sh4

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 142140 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:44.

Remediations (10)

  • Mirai (malware) - Wikipedia
    web:en.wikipedia.org

    Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.

  • IoT Secure Gateway: Mirai Mitigation Lab - GitHub
    web:github.com

    IoT Secure Gateway: Mirai Mitigation Lab A network security project that simulates Mirai -style IoT attack behavior and validates a firewall-based defense using Docker, Linux networking, nftables, Bash, and PowerShell automation.

  • iran.sh4 - Malicious file sample | Maltiverse
    web:maltiverse.com

    iran.sh4 is a malicious file sample. Reported by 2 threat sources, last seen 2026-09-05. IoC context and downloadable threat intel on Maltiverse.

  • iran.sh4 - Malicious Sample - Maltiverse
    web:maltiverse.com

    Score Hashes Filename: iran.sh4 md5: b40cf37119e55e765e1465fe4b1d2f92 sha1: 53ac3e090888bc4f990850f3d6cb8532f0f8feb2 sha256: a85e02c091fb2ae787c45b3cb9fe203a47b5292e582dd1c8c3191ae6865ca7bc sha512: In depth details Filetype: Architecture: Compiler: Size (Bytes): Classification: malicious Mutex mutex: Dates Indexed: 2026-04-01 22:20:06 (2026-04 ...

  • ThreatFox | http://103.83.87.122/iran.sh4
    web:threatfox.abuse.ch

    Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers

  • Iran-Linked Cyber Campaign Exploits PLCs Across US Water Systems ...
    web:undercodetesting.com

    Introduction: A coordinated cyberattack campaign, attributed to Iranian-affiliated threat actors, has targeted programmable logic controllers (PLCs) across U.S. water and wastewater systems in at least 12 states, impacting more than 30 communities in Minnesota alone. The attackers exploited internet-exposed operational technology (OT) devices—including Rockwell Automation, Schneider Electric ...

  • URLhaus | http://160.250.181.124/iran.sh4
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • Automated Malware Analysis Report for iran.sh4.elf - Joe Sandbox
    web:www.joesandbox.com

    Uses the "uname" system call to query kernel version information (possible evasion)

  • Linux Analysis Report iran.sh4.elf - Joe Sandbox
    web:www.joesandbox.com

    Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese.

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2700 samples tracked, 27 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.