s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1932567 high

📛 Threat Title

Mirai: SHA256 hash of a malware sample (payload) 5f3152e5bdafababf1312ba047cfb4bbf91438d85404fccb4f4349cf54024257

Category: Mirai Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Mirai (aliases: Katana). Confidence: 100. First seen: 2026-09-25 01:44:52 UTC. Reporter: whack_sh. Tags: elf, Mirai.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 5f3152e5bdafababf1312ba047cfb4bbf91438d85404fccb4f4349cf54024257 VT 42 / 75

IOC database

Type
hash_sha256
Value
5f3152e5bdafababf1312ba047cfb4bbf91438d85404fccb4f4349cf54024257
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 42 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Linux/Mirai.Gen8
alibabacloud malicious Backdoor:Linux/Mirai.cc9f3a04
ALYac malicious Gen:Variant.Trojan.Linux.Mirai.3
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Arcabit malicious Trojan.Trojan.Linux.Mirai.3
Avast malicious ELF:Agent-AGS [Trj]
Avast-Mobile malicious ELF:Agent-AGS [Trj]
AVG malicious ELF:Agent-AGS [Trj]
Avira malicious EXP/ELF.Mirai.Bootnet.oc
BitDefender malicious Gen:Variant.Trojan.Linux.Mirai.3
ClamAV malicious Unix.Dropper.Mirai-7135939-0
CTX malicious elf.trojan.mirai
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.10621
Elastic malicious Linux.Generic.Threat
Emsisoft malicious Gen:Variant.Trojan.Linux.Mirai.3 (B)
ESET-NOD32 malicious Linux/Mirai.AX trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.Bootnet.oc
Fortinet malicious Linux/Mirai.A!tr
GData malicious Gen:Variant.Trojan.Linux.Mirai.3
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.q
Jiangmin malicious Backdoor.Linux.gbgy
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.ba
Kingsoft malicious Linux.Backdoor.elf.2023796
Lionic malicious Trojan.Linux.Mirai.K!c
MaxSecure malicious Trojan.Malware.121218.susgen
McAfeeD malicious ti!5F3152E5BDAF
Microsoft malicious Backdoor:Linux/Bushido.A!xp
MicroWorld-eScan malicious Gen:Variant.Trojan.Linux.Mirai.3
Rising malicious Backdoor.Gafgyt/Linux!1.12AC3 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
Skyhigh malicious Lnx/Mirai-FECL!9364F595C4A2
Sophos malicious Linux/DDoS-CI
Symantec malicious Linux.Mirai
Tencent malicious Trojan.Linux.Mirai.zf
TrellixENS malicious Lnx/Mirai-FECL!9364F595C4A2
TrendMicro malicious Backdoor.Linux.MIRAI.SMLBO20
TrendMicro-HouseCall malicious Backdoor.Linux.MIRAI.SMLBO20
Varist malicious E32/ABApplication.ZA
VIPRE malicious Gen:Variant.Trojan.Linux.Mirai.3
ZoneAlarm malicious Linux/DDoS-CI

Details From VirusTotal

Basic Properties
MD59364f595c4a264678998e70e0b990915
SHA-1d980522f8bfb644131bcc175da60ffdcc36af80b
SHA-2565f3152e5bdafababf1312ba047cfb4bbf91438d85404fccb4f4349cf54024257
VHash2c625e7bca76bc3b4451f96db14edb31
SSDEEP768:Ca1eKVgXL+2PqRoMG5RV+iUDroT43LShHKK65hfY9hDuhNPDQ9fqbSiNkZ71dU:eKN2P4G5RVlUDQ43WhKhIhbhl1d
TLSHT117034CA5B8D1492BC5C11276BA6E998E3730A3E8D2DF3303CD245B5079EA42F1E97F41
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, version 1 (ARM), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
File size39.8 KB
History
First seen on VirusTotal2026-08-13 23:03 UTC
Last submission2026-08-14 09:18 UTC
Last analysis2026-08-14 09:18 UTC
Last modified on VirusTotal2026-08-14 21:46 UTC
Known Names
  • David.arm5
  • 1c3teud2y.exe

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Mirai (aliases: Katana). Confidence: 100. First seen: 2026-09-25 01:44:52 UTC. Reporter: whack_sh. Tags: elf, Mirai.

Remediations (10)

  • MalwareBazaar | Mirai - abuse.ch
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Mirai .

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    Information on Mirai malware sample ( SHA256 7237ce139be1d569db17ae0937c9391caf941313768f0f68f0053080abd10086) MalwareBazaar uses YARA rules from several public and ...

  • Hash Reputation Checker — MD5/SHA-256 Malware Lookup
    web:cipherssecurity.com

    Check MD5, SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.

  • GitHub - BlessRareGem/Mirai-Malware-Analysis
    web:github.com

    This project contains a full analysis of a Mirai botnet variant, including hash identification, malware behavior, IoCs, detection methods, impact assessment, and recommendations.

  • GitHub - hitesh70200/Malware_Analysis_Mirai: Static and dynamic ...
    web:github.com

    This repository contains a comprehensive malware analysis report focusing on the Mirai IoT botnet. The project details the setup of a secure malware analysis laboratory and presents a research-based analysis of the Mirai malware . It covers the critical aspects of establishing an isolated analysis environment, the selection of appropriate tools, and a thorough investigation of Mirai's ...

  • Hash Checker - File & Malware Hash Lookup | InventiveHQ
    web:inventivehq.com

    Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.

  • Malware Hashes - File Hash Intelligence | isMalicious
    web:ismalicious.com

    Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.

  • ThreatFox ...
    web:threatfox.abuse.ch

    Mirai IOC: 3d219efe6dd1214c4b087b501ec98c2f476c51c07f93a1ebc430f497c9885c16 ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  • ThreatFox ...
    web:threatfox.abuse.ch

    Mirai IOC: 5eee1f6a29b6c1c13130ae1c2e7020dd83fc755d6b995c04e4db457e5c5a92af ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  • InfectedSlurs Botnet Spreads Mirai via Zero-Days - Akamai
    web:www.akamai.com

    Fig. 1: Unique JenX Mirai -related console string from a malware sample with the SHA256 hash of ac43c52b42b123e2530538273dfb12e3b70178aa1dee6d4fd5198c08bfeb4dc1

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.