MB-1f54151c99a8a2c8abf0f8271bfebbb5faf60e477f431c8a668fc9f2640045d6
high
📛 Threat Title
Mirai: iran.powerpc
Description
File type: elf. Size: 158636 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-07-28 15:08:56.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
1f54151c99a8a2c8abf0f8271bfebbb5faf60e477f431c8a668fc9f2640045d6
IOC database
- Type
- hash_sha256
- Value
1f54151c99a8a2c8abf0f8271bfebbb5faf60e477f431c8a668fc9f2640045d6- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
33a45482e2d6d8ea0411ddba49529e304a6fb5d7
IOC database
- Type
- hash_sha1
- Value
33a45482e2d6d8ea0411ddba49529e304a6fb5d7- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
1a2f7711c016e09157e9594f5a7066ee
IOC database
- Type
- hash_md5
- Value
1a2f7711c016e09157e9594f5a7066ee- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 158636 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-07-28 15:08:56.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:any.run
Online sandbox report for iran.powerpc , tagged as auto, mirai , botnet, verdict: Malicious activity
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:threatfox.abuse.ch
Mirai IOC: f38d748d9ea29424c28744c52bcd1d14328d49fcb604ca08fab3547ec500d6f0 (sha256_hash) You are viewing the ThreatFox database entry for sha256_hash ...
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.cisa.gov
Cybersecurity Advisory: Provides detailed information on cyber threats, including threat actor tactics, techniques, and procedures and indicators of compromise, along with recommended actions for detection, mitigation , and response.
-
web:www.ic3.gov
Iranian-affiliated APT targeting campaigns against U.S. critical infrastructure have recently escalated, likely in response to hostilities between Iran, and the United States and Israel. (New, July 22, 2026) At one U.S. victim, the FBI observed the APT actors download a malicious project file to a targeted PLC using configuration software.
-
web:www.joesandbox.com
Uses the "uname" system call to query kernel version information (possible evasion)
-
web:www.joesandbox.com
Linux Analysis Report iran.powerpc.elf Overview General Information ... Detection Gafgyt, Mirai
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.