s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-6e97bcc4e00a402a5b0fae8fc979e4589e040b19a10ca089b8e41721bf265be9 high

📛 Threat Title

Mirai: iran.aarch64

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 210936 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:39.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 6e97bcc4e00a402a5b0fae8fc979e4589e040b19a10ca089b8e41721bf265be9 VT 36 / 75

IOC database

Type
hash_sha256
Value
6e97bcc4e00a402a5b0fae8fc979e4589e040b19a10ca089b8e41721bf265be9
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 36 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
alibabacloud malicious DDoS:Linux/Gafgyt.BBB
Antiy-AVL malicious Trojan/Linux.Multiverze
Arcabit malicious Trojan.Generic.D26CC2C7
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
BitDefender malicious Trojan.Generic.40682183
ClamAV malicious Unix.Trojan.Mirai-10056448-0
CTX malicious elf.trojan.mirai
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Emsisoft malicious Trojan.Generic.40682183 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious PossibleThreat
GData malicious Linux.Trojan.Agent.QNLSXO
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious ti!6E97BCC4E00A
Microsoft malicious Trojan:Linux/Multiverze!rfn
MicroWorld-eScan malicious Trojan.Generic.40682183
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!0B0B1D31933F
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrendMicro malicious Backdoor.Linux.GAFGYT.SMMR1
TrendMicro-HouseCall malicious Backdoor.Linux.GAFGYT.SMMR1
Varist malicious E64/Mirai.EN.gen!Camelot

Details From VirusTotal

Basic Properties
MD50b0b1d31933f48cbe3f6181897d76f4e
SHA-14c7465f75f7eff9f422834c40fbf6dbed27c2b83
SHA-2566e97bcc4e00a402a5b0fae8fc979e4589e040b19a10ca089b8e41721bf265be9
VHash57ab496a9e653e5d2692714a2d1c38ac
SSDEEP3072:CwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMhwnboqN3y:ZuOScKRz0mayvhPIyu7HWwnKNnboq
TLSHT13A246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
File size206.0 KB
History
First seen on VirusTotal2026-10-21 18:28 UTC
Last submission2026-10-21 18:28 UTC
Last analysis2026-10-22 02:18 UTC
Last modified on VirusTotal2026-10-23 03:52 UTC
Known Names
  • aarch64
  • a3r5i2.exe
  • 5443e1762ef1fc5b257bc173b74d9ff22ba0d520b4b6e91afb918f9b293bde62
  • iran.aarch64
hash_sha1 4c7465f75f7eff9f422834c40fbf6dbed27c2b83 VT 25 / 75

IOC database

Type
hash_sha1
Value
4c7465f75f7eff9f422834c40fbf6dbed27c2b83
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 25 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
Antiy-AVL malicious Trojan/Linux.Multiverze
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-10056448-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
Microsoft malicious Trojan:Script/Wacatac.C!ml
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!0B0B1D31933F
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrendMicro malicious Backdoor.Linux.GAFGYT.SMMR1
TrendMicro-HouseCall malicious Backdoor.Linux.GAFGYT.SMMR1
Varist malicious E64/Mirai.EN.gen!Camelot

Details From VirusTotal

Basic Properties
MD50b0b1d31933f48cbe3f6181897d76f4e
SHA-14c7465f75f7eff9f422834c40fbf6dbed27c2b83
SHA-2566e97bcc4e00a402a5b0fae8fc979e4589e040b19a10ca089b8e41721bf265be9
VHash57ab496a9e653e5d2692714a2d1c38ac
SSDEEP3072:CwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMhwnboqN3y:ZuOScKRz0mayvhPIyu7HWwnKNnboq
TLSHT13A246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
File size206.0 KB
History
First seen on VirusTotal2026-10-21 18:28 UTC
Last submission2026-10-21 18:28 UTC
Last analysis2026-10-21 18:28 UTC
Last modified on VirusTotal2026-10-21 20:39 UTC
Known Names
  • aarch64
  • a3r5i2.exe
  • 5443e1762ef1fc5b257bc173b74d9ff22ba0d520b4b6e91afb918f9b293bde62
  • iran.aarch64
hash_md5 0b0b1d31933f48cbe3f6181897d76f4e VT 25 / 75

IOC database

Type
hash_md5
Value
0b0b1d31933f48cbe3f6181897d76f4e
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 25 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
Antiy-AVL malicious Trojan/Linux.Multiverze
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-10056448-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
Microsoft malicious Trojan:Script/Wacatac.C!ml
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!0B0B1D31933F
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrendMicro malicious Backdoor.Linux.GAFGYT.SMMR1
TrendMicro-HouseCall malicious Backdoor.Linux.GAFGYT.SMMR1
Varist malicious E64/Mirai.EN.gen!Camelot

Details From VirusTotal

Basic Properties
MD50b0b1d31933f48cbe3f6181897d76f4e
SHA-14c7465f75f7eff9f422834c40fbf6dbed27c2b83
SHA-2566e97bcc4e00a402a5b0fae8fc979e4589e040b19a10ca089b8e41721bf265be9
VHash57ab496a9e653e5d2692714a2d1c38ac
SSDEEP3072:CwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMhwnboqN3y:ZuOScKRz0mayvhPIyu7HWwnKNnboq
TLSHT13A246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
File size206.0 KB
History
First seen on VirusTotal2026-10-21 18:28 UTC
Last submission2026-10-21 18:28 UTC
Last analysis2026-10-21 18:28 UTC
Last modified on VirusTotal2026-10-21 20:39 UTC
Known Names
  • aarch64
  • a3r5i2.exe
  • 5443e1762ef1fc5b257bc173b74d9ff22ba0d520b4b6e91afb918f9b293bde62
  • iran.aarch64

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 210936 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:39.

Remediations (10)

  • Malware analysis iran.aarch64 Malicious activity - any.run
    web:any.run

    Online sandbox report for iran.aarch64 , tagged as auto, mirai , botnet, verdict: Malicious activity

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • Mirai (malware) - Wikipedia
    web:en.wikipedia.org

    Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.

  • IoT Secure Gateway: Mirai Mitigation Lab - GitHub
    web:github.com

    IoT Secure Gateway: Mirai Mitigation Lab A network security project that simulates Mirai -style IoT attack behavior and validates a firewall-based defense using Docker, Linux networking, nftables, Bash, and PowerShell automation.

  • felixrayyen-alt/Mirai-Botnet-Static-Analysis - GitHub
    web:github.com

    🦠 Mirai Botnet - Malware Static Analysis This repository contains a comprehensive Static Analysis and Reverse Engineering report of the notorious Mirai Malware (ELF 32-bit binary). This project was conducted as part of the Reverse Engineering Midterm Exam at Universitas Amikom Yogyakarta.

  • ThreatFox | http://103.83.87.122/iran.aarch64
    web:threatfox.abuse.ch

    Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers

  • PDF Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.jisem-journal.com

    Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices compromised by malware.

  • Automated Malware Analysis Report for iran.aarch64.elf - Generated by ...
    web:www.joesandbox.com

    Source: iran.aarch64.elf ReversingLabs: Detection: 13% Spreading Found strings indicative of a multi-platform dropper Source: iran.aarch64.elf

  • Automated Malware Analysis Report for iran.aarch64.elf - Generated by ...
    web:www.joesandbox.com

    Uses the "uname" system call to query kernel version information (possible evasion)

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2700 samples tracked, 27 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.