MB-3a7bf6f11d972b034f44222b21fad10de8ac30d197ee406f027e4fe38951f245 high

Description

File type: elf. Size: 1142308 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 04:42:12.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• MalwareBazaar sample page Abuse.ch

  File type: elf. Size: 1142308 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 04:42:12.

• Mirai Malware Analysis, Overview by ANY.RUN
  web:any.run

  Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  2026-09-25 09:58 UTC
• A_Survey_on_The_Mirai_IoT_Botnet_and_Its_Recent_Variants (2)
  web:arxiv.org

  Paras Jha and Josiah White created Mirai , co-founders of Protraf Solutions, which offered mitigation services for DDoS attacks [28]. Mirai has created the basis for many botnets that exist today.

  2026-09-25 09:58 UTC
• Mirai (malware) - Wikipedia
  web:en.wikipedia.org

  Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers. [1] The Mirai botnet was first found in August 2016 [2] by MalwareMustDie, [3] a white hat malware research ...

  2026-09-25 09:58 UTC
• Mirai Source Code - GitHub
  web:github.com

  Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...

  2026-09-25 09:58 UTC
• New Mirai Variant Targeting Network Security Devices
  web:unit42.paloaltonetworks.com

  We discovered ongoing attacks leveraging IoT vulnerabilities, including in network security devices, to serve a Mirai variant.

  2026-09-25 09:58 UTC
• Mirai Botnet Forensic Analysis - Cyber - westoahu.hawaii.edu
  web:westoahu.hawaii.edu

  A botnet called Mirai infected hundreds of thousands of Internet of Things (IoT) devices, amassing a wide network of compromised devices. Mitigations against the Mirai botnet involve taking proactive security measures, properly hardening systems, and updating to the latest software to reduce the risk of compromise.

  2026-09-25 09:58 UTC
• InfectedSlurs Botnet Spreads Mirai via Zero-Days - Akamai
  web:www.akamai.com

  Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .

  2026-09-25 09:58 UTC
• Linux Analysis Report bot.mpsl.elf - Joe Sandbox
  web:www.joesandbox.com

  Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Yara detected Mirai Attempts to enable/disable Ctrl-Alt-Delete system rebooting Detected TCP or UDP traffic on non-standard ports Found Tor onion address Found strings indicative of a multi-platform dropper Sample contains strings indicative of BusyBox which embeds multiple Unix commands ...

  2026-09-25 09:58 UTC
• The evolution of Mirai botnet scans over a six-year period
  web:www.sciencedirect.com

  The proliferation of Internet of Things devices has resulted in an increase in security vulnerabilities and network attacks. The Mirai botnet is a well-known example of a network used for malicious activities, detected for the first time by the white-hat research group in August 2016. Since then, Mirai initiated massive DDoS attacks by scanning for and exploiting vulnerabilities in network ...

  2026-09-25 09:58 UTC
• Akamai SIRT Identifies Zerobot Botnet Exploiting n8n and Tenda ...
  web:www.threatintelreport.com

  Akamai SIRT identifies Mirai variant campaign actively targeting critical RCE flaws in automation platforms and routers Mirai #Zerobot #Botnet #n8n #Tenda #CVE-2025-68613 #CVE-2025-7544 Affected products n8n workflow automation platform (versions 0.211.0 prior to 1.120.4, 1.121.1 and 1.122.0) and Tenda AC1206 routers (firmware 15.03.06.23) Campaign type Mirai -based botnet propagation via ...

  2026-09-25 09:58 UTC

Only Available for Registered Users. Sign in to view.