s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-b76146d4423f0b09c29a2662a15fb2fe420a4dee5f4c3bf47e4285cba07eb76d high

📛 Threat Title

Mirai: iran.m68k

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 182244 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:44.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 b76146d4423f0b09c29a2662a15fb2fe420a4dee5f4c3bf47e4285cba07eb76d VT 35 / 75

IOC database

Type
hash_sha256
Value
b76146d4423f0b09c29a2662a15fb2fe420a4dee5f4c3bf47e4285cba07eb76d
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 35 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
alibabacloud malicious DDOS:Linux/Mirai
ALYac malicious Trojan.Generic.40607872
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Arcabit malicious Trojan.Generic.D26BA080
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious TR/LINUX.Mirai.CYM
BitDefender malicious Trojan.Generic.40607872
ClamAV malicious Unix.Trojan.Mirai-6981989-0
CTX malicious elf.trojan.generic
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Emsisoft malicious Trojan.Generic.40607872 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Trojan.TR/LINUX.Mirai.CYM
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.EQY
Microsoft malicious Backdoor:Linux/Mirai.HF!MTB
MicroWorld-eScan malicious Trojan.Generic.40607872
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!C7902C5BA693
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!C7902C5BA693
Varist malicious E32/Mirai.EN.gen!Camelot
VIPRE malicious Trojan.Generic.40607872

Details From VirusTotal

Basic Properties
MD5c7902c5ba6932f6a32bdd95c7459c414
SHA-15ecc09e9c47c805736b712df061d454b0f7ca9cb
SHA-256b76146d4423f0b09c29a2662a15fb2fe420a4dee5f4c3bf47e4285cba07eb76d
VHash9dc6c440aa0e7ddd1c9e1f9ca54bab9a
SSDEEP3072:T1ThGQVp/yJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cTXKB:z/gx4yvjd34F7GD8V4g2LLoXKB
TLSHT1A70429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
File size178.0 KB
History
First seen on VirusTotal2026-10-21 18:28 UTC
Last submission2026-10-21 18:28 UTC
Last analysis2026-10-21 18:28 UTC
Last modified on VirusTotal2026-10-21 20:28 UTC
Known Names
  • 7tg26e1i.exe
  • m68k
  • 8bd2ffc3bc56613a3911589562bfc21d6ccf8232d28f88fab3841a44fe9a2ddb
  • iran.m68k
hash_sha1 5ecc09e9c47c805736b712df061d454b0f7ca9cb VT 35 / 75

IOC database

Type
hash_sha1
Value
5ecc09e9c47c805736b712df061d454b0f7ca9cb
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 35 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
alibabacloud malicious DDOS:Linux/Mirai
ALYac malicious Trojan.Generic.40607872
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Arcabit malicious Trojan.Generic.D26BA080
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious TR/LINUX.Mirai.CYM
BitDefender malicious Trojan.Generic.40607872
ClamAV malicious Unix.Trojan.Mirai-6981989-0
CTX malicious elf.trojan.generic
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Emsisoft malicious Trojan.Generic.40607872 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Trojan.TR/LINUX.Mirai.CYM
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.EQY
Microsoft malicious Backdoor:Linux/Mirai.HF!MTB
MicroWorld-eScan malicious Trojan.Generic.40607872
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!C7902C5BA693
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!C7902C5BA693
Varist malicious E32/Mirai.EN.gen!Camelot
VIPRE malicious Trojan.Generic.40607872

Details From VirusTotal

Basic Properties
MD5c7902c5ba6932f6a32bdd95c7459c414
SHA-15ecc09e9c47c805736b712df061d454b0f7ca9cb
SHA-256b76146d4423f0b09c29a2662a15fb2fe420a4dee5f4c3bf47e4285cba07eb76d
VHash9dc6c440aa0e7ddd1c9e1f9ca54bab9a
SSDEEP3072:T1ThGQVp/yJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cTXKB:z/gx4yvjd34F7GD8V4g2LLoXKB
TLSHT1A70429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
File size178.0 KB
History
First seen on VirusTotal2026-10-21 18:28 UTC
Last submission2026-10-21 18:28 UTC
Last analysis2026-10-21 18:28 UTC
Last modified on VirusTotal2026-10-21 20:28 UTC
Known Names
  • 7tg26e1i.exe
  • m68k
  • 8bd2ffc3bc56613a3911589562bfc21d6ccf8232d28f88fab3841a44fe9a2ddb
  • iran.m68k
hash_md5 c7902c5ba6932f6a32bdd95c7459c414 VT 35 / 75

IOC database

Type
hash_md5
Value
c7902c5ba6932f6a32bdd95c7459c414
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 35 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
alibabacloud malicious DDOS:Linux/Mirai
ALYac malicious Trojan.Generic.40607872
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Arcabit malicious Trojan.Generic.D26BA080
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious TR/LINUX.Mirai.CYM
BitDefender malicious Trojan.Generic.40607872
ClamAV malicious Unix.Trojan.Mirai-6981989-0
CTX malicious elf.trojan.generic
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Emsisoft malicious Trojan.Generic.40607872 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Trojan.TR/LINUX.Mirai.CYM
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.EQY
Microsoft malicious Backdoor:Linux/Mirai.HF!MTB
MicroWorld-eScan malicious Trojan.Generic.40607872
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!C7902C5BA693
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!C7902C5BA693
Varist malicious E32/Mirai.EN.gen!Camelot
VIPRE malicious Trojan.Generic.40607872

Details From VirusTotal

Basic Properties
MD5c7902c5ba6932f6a32bdd95c7459c414
SHA-15ecc09e9c47c805736b712df061d454b0f7ca9cb
SHA-256b76146d4423f0b09c29a2662a15fb2fe420a4dee5f4c3bf47e4285cba07eb76d
VHash9dc6c440aa0e7ddd1c9e1f9ca54bab9a
SSDEEP3072:T1ThGQVp/yJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cTXKB:z/gx4yvjd34F7GD8V4g2LLoXKB
TLSHT1A70429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
File size178.0 KB
History
First seen on VirusTotal2026-10-21 18:28 UTC
Last submission2026-10-21 18:28 UTC
Last analysis2026-10-21 18:28 UTC
Last modified on VirusTotal2026-10-21 20:28 UTC
Known Names
  • 7tg26e1i.exe
  • m68k
  • 8bd2ffc3bc56613a3911589562bfc21d6ccf8232d28f88fab3841a44fe9a2ddb
  • iran.m68k

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 182244 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:44.

Remediations (10)

  • Iranian Hackers Manipulate SCADA Displays After Breaching U.S. Critical ...
    web:cyberpress.org

    The advisory notes that Iranian-linked targeting has likely escalated amid recent hostilities involving Iran, the United States, and Israel. Iranian SCADA Display Sabotage Since at least March 202620262026, the actors have accessed exposed PLCs through foreign-hosted infrastructure and vendor programming tools.

  • Mirai-Source-Code/dlr/release/dlr.m68k at master - GitHub
    web:github.com

    Leaked Mirai Source Code for Research/IoC Development Purposes - jgamblin/ Mirai -Source-Code

  • Dissecting Mirai: Spatio-Sequential Analysis and Restoration ... - Springer
    web:link.springer.com

    Following the public release of its source code in 2016, numerous variants have proliferated, broadening its attack surface and complicating detection and mitigation efforts. Despite extensive research on Mirai , existing analyses remain fragmented and informal, lacking a structured representation of its attack patterns.

  • ThreatFox | http://103.83.87.122/iran.m68k
    web:threatfox.abuse.ch

    Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers

  • mirai | m68k | Triage™
    web:tria.ge

    Check this mirai report m68k, with a score of 10 out of 10.

  • iran [.]m68k [.]elf | Triage™
    web:tria.ge

    Sharing Copy URL Twitter E-mail Static task static1 Behavioral task behavioral1 Sample iran.m68k.elf Resource ubuntu1804-amd64-20260127-en ubuntu-18.04-amd64 0 signatures 150 seconds Behavioral task behavioral2 Sample iran.m68k.elf Resource debian9-armhf-20260127-en debian-9-armhf 0 signatures 150 seconds Behavioral task behavioral3 Sample iran.m68k.elf Resource debian9-mipsbe-20260127-en ...

  • mirai.m68k.elf - Jotti's malware scan
    web:virusscan.jotti.org

    Report for scan job: ingeuc2hnr ... May 16, 2026 ELF:Mirai-A May 16, 2026 Trojan.Linux.Backdoor.C May 16, 2026

  • Automated Malware Analysis Management Report for iran.m68k.elf ...
    web:www.joesandbox.com

    Signatures Antivirus / Scanner detection for submitted sample Found malware configuration Multi AV Scanner detection for submitted file Yara detected Gafgyt Yara detected Mirai Drops files in suspicious directories Sample tries to set files in /etc globally writable Detected TCP or UDP traffic on non-standard ports Enumerates processes within the "proc" file system Executes the "rm" command ...

  • Automated Malware Analysis Report for iran.m68k.elf - Joe Sandbox
    web:www.joesandbox.com

    Linux Analysis Report iran.m68k.elf Overview General Information ... Detection Gafgyt, Mirai

  • Iranian Hackers Target US Energy & Water Providers in 2026
    web:www.thetechedvocate.org

    Why are Iranian hackers targeting energy providers? Iranian hackers are targeting energy providers due to geopolitical tensions and the desire to exploit vulnerabilities in critical infrastructure. This activity poses a significant threat to national security, as disruptions in energy and water services can lead to widespread outages and public safety risks.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.