URLhaus-PL-24b1d4b18923351db58d1a92ccf121d673d00fdbbc3698dbd77bd849919f2e6a medium

Description

Malware family: Mirai. File type: elf. Size: 775,781 bytes. First seen: 2026-09-23 23:50:35.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Download sample (ZIP, password: infected) URLhaus
• URLhaus payload page URLhaus

• URLhaus: mirai Malicious URLs | SOC Hunt Feed
  web:davidgodwinpratt.com

  Hunt Hypothesis The detection identifies potential Mirai botnet command-and-control (C2) communication attempts through known malicious URLs, indicating possible compromise of endpoints. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate Mirai -related botnet activity before it leads to widespread network compromise.

  2026-09-24 04:14 UTC
• URLhaus: mirai Malicious URLs | SOC Hunt Feed
  web:davidgodwinpratt.com

  References URLhaus False Positive Guidance Scenario:A system administrator is manually testing a Mirai -based exploit detection tool by uploading a known benign payload for analysis. Filter/Exclusion:Exclude URLs containing the string test_payloador sandbox-analysis.

  2026-09-24 04:14 UTC
• felixrayyen-alt/Mirai-Botnet-Static-Analysis - GitHub
  web:github.com

  🦠 Mirai Botnet - Malware Static Analysis This repository contains a comprehensive Static Analysis and Reverse Engineering report of the notorious Mirai Malware ( ELF 32-bit binary). This project was conducted as part of the Reverse Engineering Midterm Exam at Universitas Amikom Yogyakarta.

  2026-09-24 04:14 UTC
• IoT.Mirai-malware-analysis-report- - GitHub
  web:github.com

  This repository contains a static malware analysis of the IoT Mirai malware (loader component) obtained from theZoo malware repository. The objective of this project is to understand Mirai's infection mechanism, network behavior, architecture-specific payload delivery, and execution flow using reverse engineering techniques.

  2026-09-24 04:14 UTC
• Mirai (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the ...

  2026-09-24 04:14 UTC
• URLhaus | Malware URL exchange
  web:urlhaus.abuse.ch

  URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  2026-09-24 04:14 UTC
• URLhaus | Browse
  web:urlhaus.abuse.ch

  Here you can propose new malware urls or just browse the URLhaus database. If you are looking for a parsable list of the dataset, you might want to check out the URLhaus API.

  2026-09-24 04:14 UTC
• CSIRT-IE: Active Malware Distribution Sites
  web:www.ncsc.gov.ie

  CSIRT-IE monitors the URLhaus dataset for reports of sites, within its jurisdiction, that are reported to be actively distributing malware. Active Malware Distribution Sites The URLhaus platform only report sites (URLs) that are directly being used to distribute malware.

  2026-09-24 04:14 UTC
• Mirai ELF Resurgence Meets whack.sh SSH Brute-Force: Deconstructing the ...
  web:www.threatclaw.ai

  Overview MalwareBazaar's last 24-hour window reveals a notable cluster: five Mirai ELF samples all tagged upx-dec (UPX-decoded), plus one additional unknown ELF binary tagged whack.sh. This isn't background noise — it's a coordinated botnet recruitment pipeline visible across multiple telemetry feeds. Combined with 10 active malware-distribution URLs on URLhaus and a confirmed active QakBot ...

  2026-09-24 04:14 UTC
• Mozi Is Dead in Name Only: The 24h IoT Dual-Rail Delivery (Mozi.m/.a ...
  web:www.threatclaw.ai

  In the last 24 hours the ThreatFox feed surfaced a rare and specific pattern: two distinct Mozi payload rails served alongside a mainstream Mirai ELF delivery rail, all from the same class of low-reputation hosting infrastructure.

  2026-09-24 04:14 UTC

Only Available for Registered Users. Sign in to view.