MB-a668e688b25f73352ff6eeb5bd98f96bed602d674d34f42dadda1f61d394002d
high
📛 Threat Title
Mirai: stub.armv5l
Description
File type: elf. Size: 625554 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:58:47.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
a668e688b25f73352ff6eeb5bd98f96bed602d674d34f42dadda1f61d394002d
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/a668e688b25f73352ff6eeb5bd98f96bed602d674d34f42dadda1f61d394002d
IOC database
- Type
- hash_sha256
- Value
a668e688b25f73352ff6eeb5bd98f96bed602d674d34f42dadda1f61d394002d- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/a668e688b25f73352ff6eeb5bd98f96bed602d674d34f42dadda1f61d394002d
hash_sha1
48b536dd3add00e21aafa017b8f1677db6ffbe95
VT 12 / 75
IOC database
- Type
- hash_sha1
- Value
48b536dd3add00e21aafa017b8f1677db6ffbe95- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 12 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Arcabit | malicious | Trojan.Linux.Generic.D3946B2E |
| BitDefender | malicious | Trojan.Linux.GenericKD.60058414 |
| CTX | malicious | elf.trojan.generic |
| Emsisoft | malicious | Trojan.Linux.GenericKD.60058414 (B) |
| ESET-NOD32 | malicious | Linux/Agent.BMJ trojan |
| GData | malicious | Trojan.Linux.GenericKD.60058414 |
| huorong | malicious | Trojan/Linux.Agent.es |
| Lionic | malicious | Trojan.ELF.Mirai.4!c |
| Microsoft | malicious | Trojan:Script/Wacatac.B!ml |
| MicroWorld-eScan | malicious | Trojan.Linux.GenericKD.60058414 |
| Rising | malicious | Backdoor.Mirai/Linux!1.14841 (CLASSIC) |
| VIPRE | malicious | Trojan.Linux.GenericKD.60058414 |
Details From VirusTotal
Basic Properties
| MD5 | 1af4fad71ec2b35b5fa2b596899e761e |
| SHA-1 | 48b536dd3add00e21aafa017b8f1677db6ffbe95 |
| SHA-256 | a668e688b25f73352ff6eeb5bd98f96bed602d674d34f42dadda1f61d394002d |
| VHash | b468ddab6c3343c91277670130d15bb5 |
| SSDEEP | 12288:F2ctKrS0XUwn67ayLtLiXRU2zzi6aNjodD6pmkVf32cgpeSa9VWKi2:YCp7mXtni6aBh321eSiVWKP |
| TLSH | T1E8D44A55F8809F63C9C52A36F64E826833274779C7E7730689144B383BA7A6F0F3A645 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped |
| File size | 610.9 KB |
History
| First seen on VirusTotal | 2026-09-25 11:40 UTC |
| Last submission | 2026-09-25 11:40 UTC |
| Last analysis | 2026-09-25 11:40 UTC |
| Last modified on VirusTotal | 2026-09-25 18:09 UTC |
Known Names
copy
hash_md5
1af4fad71ec2b35b5fa2b596899e761e
VT 12 / 75
IOC database
- Type
- hash_md5
- Value
1af4fad71ec2b35b5fa2b596899e761e- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 12 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Arcabit | malicious | Trojan.Linux.Generic.D3946B2E |
| BitDefender | malicious | Trojan.Linux.GenericKD.60058414 |
| CTX | malicious | elf.trojan.generic |
| Emsisoft | malicious | Trojan.Linux.GenericKD.60058414 (B) |
| ESET-NOD32 | malicious | Linux/Agent.BMJ trojan |
| GData | malicious | Trojan.Linux.GenericKD.60058414 |
| huorong | malicious | Trojan/Linux.Agent.es |
| Lionic | malicious | Trojan.ELF.Mirai.4!c |
| Microsoft | malicious | Trojan:Script/Wacatac.B!ml |
| MicroWorld-eScan | malicious | Trojan.Linux.GenericKD.60058414 |
| Rising | malicious | Backdoor.Mirai/Linux!1.14841 (CLASSIC) |
| VIPRE | malicious | Trojan.Linux.GenericKD.60058414 |
Details From VirusTotal
Basic Properties
| MD5 | 1af4fad71ec2b35b5fa2b596899e761e |
| SHA-1 | 48b536dd3add00e21aafa017b8f1677db6ffbe95 |
| SHA-256 | a668e688b25f73352ff6eeb5bd98f96bed602d674d34f42dadda1f61d394002d |
| VHash | b468ddab6c3343c91277670130d15bb5 |
| SSDEEP | 12288:F2ctKrS0XUwn67ayLtLiXRU2zzi6aNjodD6pmkVf32cgpeSa9VWKi2:YCp7mXtni6aBh321eSiVWKP |
| TLSH | T1E8D44A55F8809F63C9C52A36F64E826833274779C7E7730689144B383BA7A6F0F3A645 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped |
| File size | 610.9 KB |
History
| First seen on VirusTotal | 2026-09-25 11:40 UTC |
| Last submission | 2026-09-25 11:40 UTC |
| Last analysis | 2026-09-25 11:40 UTC |
| Last modified on VirusTotal | 2026-09-25 18:09 UTC |
Known Names
copy
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 625554 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 10:58:47.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:any.run
Online sandbox report for armv5l, tagged as auto, mirai , botnet, verdict: Malicious activity
-
web:arxiv.org
Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...
-
web:dailysecurityreview.com
A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.
-
web:github.com
Leaked Mirai Source Code for Research/IoC Development Purposes - jgamblin/ Mirai -Source-Code
-
web:github.com
Contribute to malol01/cross-compiler-for- mirai -archive development by creating an account on GitHub.
-
web:git.osmarks.net
Watch 1 Star 0 Files Mirai -Source-Code / scripts /cross-compile.sh Jerry Gamblin 9779d43964 Trying to Shrink Size 10 years ago 103 lines
-
web:trainsec.net
Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...
-
web:www.joesandbox.com
Automated Malware Analysis - Joe Sandbox Analysis Report Your search query must be longer than 3characters
-
web:www.joesandbox.com
Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Yara detected Mirai Deletes system log files Found strings related to Crypto-Mining Sample deletes itself Sample is packed with UPX Sample tries to kill multiple processes (SIGKILL) Creates hidden files and/or directories Creates hidden files without content (potentially used as a mutex ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.