MB-bc1c89c2718f93ee6b67cead554821d5f43e7a71c41af42b01ca0a179a28f7c7
high
📛 Threat Title
Mirai: iran.sparc
Description
File type: elf. Size: 43832 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-08-31 16:14:38.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
bc1c89c2718f93ee6b67cead554821d5f43e7a71c41af42b01ca0a179a28f7c7
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/bc1c89c2718f93ee6b67cead554821d5f43e7a71c41af42b01ca0a179a28f7c7
IOC database
- Type
- hash_sha256
- Value
bc1c89c2718f93ee6b67cead554821d5f43e7a71c41af42b01ca0a179a28f7c7- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/bc1c89c2718f93ee6b67cead554821d5f43e7a71c41af42b01ca0a179a28f7c7
hash_sha1
159eaf8713f4b73016525d0501d50058a52fad84
VT 29 / 75
IOC database
- Type
- hash_sha1
- Value
159eaf8713f4b73016525d0501d50058a52fad84- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 29 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alibabacloud | malicious | Backdoor:Linux/Gafgyt_AGen.DR |
| Antiy-AVL | malicious | Trojan/Linux.Multiverze |
| Avast | malicious | ELF:Mirai-CYM [Trj] |
| AVG | malicious | ELF:Mirai-CYM [Trj] |
| Avira | malicious | TR/LINUX.Mirai.CYM |
| ClamAV | malicious | Unix.Trojan.Mirai-10056448-0 |
| CTX | malicious | elf.trojan.mirai |
| Cynet | malicious | Malicious (score: 99) |
| DrWeb | malicious | Linux.Mirai.9874 |
| ESET-NOD32 | malicious | Linux/Gafgyt_AGen.DQ trojan |
| F-Secure | malicious | Trojan.TR/LINUX.Mirai.CYM |
| Fortinet | malicious | ELF/Mirai.L!tr |
| GData | malicious | Linux.Trojan.Agent.4AO30N |
| malicious | Detected |
|
| huorong | malicious | Backdoor/Linux.Mirai.jx |
| Ikarus | malicious | Trojan.Linux.Gafgyt |
| Kaspersky | malicious | HEUR:Backdoor.Linux.Agent.ei |
| Kingsoft | malicious | Script.Troj.Shell.2052936 |
| Lionic | malicious | Trojan.Linux.Mirai.K!c |
| McAfeeD | malicious | ti!BC1C89C2718F |
| Microsoft | malicious | Trojan:Linux/Multiverze!rfn |
| Rising | malicious | Backdoor.Mirai/Linux!1.13313 (CLASSIC) |
| Sangfor | malicious | Suspicious.Linux.Save.a |
| SentinelOne | malicious | Static AI - Malicious ELF |
| Skyhigh | malicious | LINUX/Mirai-FPL!0C6ABC831513 |
| Symantec | malicious | Linux.Mirai |
| Tencent | malicious | Backdoor.Linux.Gafgyt.mbxra |
| TrellixENS | malicious | LINUX/Mirai-FPL!0C6ABC831513 |
| Varist | malicious | E32/Gafgyt.C.gen!Camelot |
Details From VirusTotal
Basic Properties
| MD5 | 0c6abc831513034d474f3afb20de6523 |
| SHA-1 | 159eaf8713f4b73016525d0501d50058a52fad84 |
| SHA-256 | bc1c89c2718f93ee6b67cead554821d5f43e7a71c41af42b01ca0a179a28f7c7 |
| VHash | 28c5fc1bb2a674a580a6d8bd3da74e0a |
| SSDEEP | 768:t6jQLYeiLEKRBTMjONrElzbFjUDK1JvMVIoX4M+DoIwS3ZhP3XRcQPbM+svy:BEbMjOU1hIIoDI9JhPnmQL |
| TLSH | T107134D328679491BC2C0E77B11A79372E0F62B845190974F7E5A0D8EFE5A340677B3E2 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 32-bit MSB executable, SPARC, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped |
| File size | 42.8 KB |
History
| First seen on VirusTotal | 2026-08-31 16:24 UTC |
| Last submission | 2026-08-31 23:27 UTC |
| Last analysis | 2026-08-31 23:27 UTC |
| Last modified on VirusTotal | 2026-08-31 23:42 UTC |
Known Names
sparciran.sparcz3lgqt1m.exe
hash_md5
0c6abc831513034d474f3afb20de6523
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/0c6abc831513034d474f3afb20de6523
IOC database
- Type
- hash_md5
- Value
0c6abc831513034d474f3afb20de6523- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/0c6abc831513034d474f3afb20de6523
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 43832 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-08-31 16:14:38.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:github.com
IoT Secure Gateway: Mirai Mitigation Lab A network security project that simulates Mirai -style IoT attack behavior and validates a firewall-based defense using Docker, Linux networking, nftables, Bash, and PowerShell automation.
-
web:github.com
Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...
-
web:research.tudelft.nl
With the rise of IoT botnets, the remediation of infected devices has become a critical task. As over 87% of these devices reside in broadband networks, this task will fall primarily to consumers and the Internet Service Providers. We present the first empirical study of IoT malware cleanup in the wild -- more specifically, of removing Mirai infections in the network of a medium-sized ISP. To ...
-
web:rruzi.github.io
The C2 port is randomly selected between 25596 and 25616. In terms of the communication mechanism, Mirai .CatDDoS basically follows the original design of Mirai , except that the fixed 4-byte \x00\x00\x00\x01 when Mirai goes online is modified to a fixed 8-byte: \x31\x73\x13\x93\x04\x83\x32\x04 In terms of the ATTACK_VECTOR, Mirai .CatDDoS implements a richer variety of DDoS attack types than ...
-
web:www.akamai.com
Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .
-
web:www.joesandbox.com
Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file HTTP GET or POST without a user agent Sample has stripped symbol table Uses the "uname" system call to query kernel version information (possible evasion)
-
web:www.joesandbox.com
General Information Joe Sandbox version: 44.0.0 Smoke Quartz Analysis ID: 1937823 Start date and time: 2026-07-06 13:16:48 +02:00 Joe Sandbox product: CloudBasic Overall analysis duration: 0h 10m 56s Hypervisor based Inspection enabled: false Report type: full Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0 ...
-
web:www.ndss-symposium.org
We show that over 87% of all Mirai -infected IoT de-vices reside in broadband access networks, underlining the critical role of ISPs in IoT botnet mitigation . We provide the first real-world measurement of re-mediation rates for Mirai -infected devices and find that quarantining and notifying affected customers remediates 92% of the infections.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.