s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-b762b08fedab645a9b1e6806241d288157d691b7cd4baab77d573825156cb458 high

📛 Threat Title

Mirai: bot.mips64el

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 1141207 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:57:33.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 b762b08fedab645a9b1e6806241d288157d691b7cd4baab77d573825156cb458 VT 16 / 75

IOC database

Type
hash_sha256
Value
b762b08fedab645a9b1e6806241d288157d691b7cd4baab77d573825156cb458
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 16 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Gen:Variant.Linux.Gafgyt.13
Antiy-AVL malicious Trojan[Exploit]/Linux.CVE-2018-10561
Avast-Mobile malicious ELF:Mirai-QL [Trj]
Avira malicious EXP/LINUX.CVE-2021-.A
ClamAV malicious Unix.Trojan.Mirai-10004218-0
Cynet malicious Malicious (score: 99)
ESET-NOD32 malicious Linux/Mirai.FLD trojan
F-Secure malicious Exploit.EXP/LINUX.CVE-2021-.A
GData malicious Gen:Variant.Linux.Gafgyt.13
huorong malicious Trojan/Linux.Mirai.f
Lionic malicious Trojan.ELF.Mirai.4!c
Microsoft malicious Backdoor:Linux/Gafgyt.BA!xp
MicroWorld-eScan malicious Gen:Variant.Linux.Gafgyt.13
Sangfor malicious Suspicious.Linux.Save.a
Tencent malicious Backdoor.Linux.Mirai.yar
VIPRE malicious Gen:Variant.Linux.Gafgyt.13

Details From VirusTotal

Basic Properties
MD54e5ea81cf57d842eafd6d18069c7091e
SHA-11f8af6567fdf5c16a3ca8663c3b2729882587965
SHA-256b762b08fedab645a9b1e6806241d288157d691b7cd4baab77d573825156cb458
VHash571c3e4bc2d0ca1bf150f8c3a7511a53
SSDEEP24576:7BVL2UCtekP9MiCWKu/LoZespTm4C+xTCnOKW83:qUCBVUnusklMxTCnz3
TLSHT1D1356C46EF406FEBC09FCD30492EC35721EDE8CA42C5A62971FC4A8C7A5D3594AD3698
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size1.1 MB
History
First seen on VirusTotal2026-09-25 12:00 UTC
Last submission2026-09-25 12:00 UTC
Last analysis2026-09-25 12:00 UTC
Last modified on VirusTotal2026-09-25 14:03 UTC
Known Names
  • bot.mips64el.elf
  • c1a9vxr4.exe
hash_md5 4e5ea81cf57d842eafd6d18069c7091e VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/4e5ea81cf57d842eafd6d18069c7091e

IOC database

Type
hash_md5
Value
4e5ea81cf57d842eafd6d18069c7091e
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/4e5ea81cf57d842eafd6d18069c7091e

hash_sha1 1f8af6567fdf5c16a3ca8663c3b2729882587965 VT 16 / 75

IOC database

Type
hash_sha1
Value
1f8af6567fdf5c16a3ca8663c3b2729882587965
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 16 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Gen:Variant.Linux.Gafgyt.13
Antiy-AVL malicious Trojan[Exploit]/Linux.CVE-2018-10561
Avast-Mobile malicious ELF:Mirai-QL [Trj]
Avira malicious EXP/LINUX.CVE-2021-.A
ClamAV malicious Unix.Trojan.Mirai-10004218-0
Cynet malicious Malicious (score: 99)
ESET-NOD32 malicious Linux/Mirai.FLD trojan
F-Secure malicious Exploit.EXP/LINUX.CVE-2021-.A
GData malicious Gen:Variant.Linux.Gafgyt.13
huorong malicious Trojan/Linux.Mirai.f
Lionic malicious Trojan.ELF.Mirai.4!c
Microsoft malicious Backdoor:Linux/Gafgyt.BA!xp
MicroWorld-eScan malicious Gen:Variant.Linux.Gafgyt.13
Sangfor malicious Suspicious.Linux.Save.a
Tencent malicious Backdoor.Linux.Mirai.yar
VIPRE malicious Gen:Variant.Linux.Gafgyt.13

Details From VirusTotal

Basic Properties
MD54e5ea81cf57d842eafd6d18069c7091e
SHA-11f8af6567fdf5c16a3ca8663c3b2729882587965
SHA-256b762b08fedab645a9b1e6806241d288157d691b7cd4baab77d573825156cb458
VHash571c3e4bc2d0ca1bf150f8c3a7511a53
SSDEEP24576:7BVL2UCtekP9MiCWKu/LoZespTm4C+xTCnOKW83:qUCBVUnusklMxTCnz3
TLSHT1D1356C46EF406FEBC09FCD30492EC35721EDE8CA42C5A62971FC4A8C7A5D3594AD3698
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, not stripped
File size1.1 MB
History
First seen on VirusTotal2026-09-25 12:00 UTC
Last submission2026-09-25 12:00 UTC
Last analysis2026-09-25 12:00 UTC
Last modified on VirusTotal2026-09-25 14:03 UTC
Known Names
  • bot.mips64el.elf
  • c1a9vxr4.exe

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 1141207 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 11:57:33.

Remediations (10)

  • A_Survey_on_The_Mirai_IoT_Botnet_and_Its_Recent_Variants (2)
    web:arxiv.org

    Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • bot_mips64el - Malicious Sample - Maltiverse
    web:maltiverse.com

    Hashes Filename: bot_mips64el md5: 0f991ad5788ef05392c7e3697f776012 sha1: 8c10046a2afd1e067f66a4f5ef7e42197ce997ca sha256: d12c43c359c82e4a6ca3da6690363bf9b3f3e1d699dcf00e804b833d5d956f46 sha512: In depth details Filetype: Architecture: Compiler: Size (Bytes): Classification: malicious Mutex mutex: Dates Indexed: 2026-04-22 18:24:55 (2026-04-22 ...

  • Mirai Botnet | ARM Reverse Engineering Walkthrough
    web:trainsec.net

    In this particular case, I found an ARM-compiled Mirai botnet sample. The anti-virus checks labeled it as " Mirai ," matching what I found in the documentation, sandbox analyses, and community threat intelligence sources. Mirai is known to compile variants for multiple architectures (ARM, MIPS, x86, x64, etc.), making it adaptable and widespread.

  • Mirai Botnet Forensic Analysis - Cyber - westoahu.hawaii.edu
    web:westoahu.hawaii.edu

    Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.

  • The Mirai Botnet - Threats and Mitigations - CIS
    web:www.cisecurity.org

    The Mirai botnet soon spread to infect thousands of internet of things (IoT) devices and evolved to conduct full, large-scale attacks. After noticing an increase in infections, Mirai caught the attention of the nonprofit organization MalwareMustDie in August 2016, who then started to research, analyze, and track the botnet [2].

  • Automated Malware Analysis Report for bot.mips64el.elf - Generated by ...
    web:www.joesandbox.com

    Malware Analysis System Evasion Uses the "uname" system call to query kernel version information (possible evasion) Source: /tmp/bot.mips64el.elf (PID: 6226) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

  • PDF Mirai Botnet - Quorum Cyber
    web:www.quorumcyber.com

    Mirai initially infected and weaponised devices such as smart cameras and Realtek routers2. The botnet variant was created in a racketeering attempt by the cofounders of Protraf Solutions, an organisation offering DDoS mitigation services.

  • The evolution of Mirai botnet scans over a six-year period
    web:www.sciencedirect.com

    In the specific context of Mirai botnet detection and mitigation , several approaches have been presented in the literature. Some works focus on studying the behavior of the Mirai botnet, examining and monitoring its propagation and impact within networked systems [85], [86], [87].

  • Akamai SIRT Identifies Zerobot Botnet Exploiting n8n and Tenda ...
    web:www.threatintelreport.com

    YARA rule Mirai_Malware_IOCs_1 detects strings including "bruh why again", "mamakmukekkontol" and the listed domains and hashes. Mitigation Recommendations Upgrade n8n immediately to version 1.122.0 or later. Update Tenda AC1206 firmware or isolate devices from the internet. Block all listed IOCs at network perimeter and endpoint layers.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.