s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-6b138dd673640dc611a8b5883301e5b77e6564d43a8462264f50260f674a8ef4 high

📛 Threat Title

Mirai: 6b138dd673640dc611a8b5883301e5b77e6564d43a8462264f50260f674a8ef4.elf

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 138600 bytes. Tags: elf, Mirai. Reporter: Tuxxin. First seen: 2026-09-25 11:54:18.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 6b138dd673640dc611a8b5883301e5b77e6564d43a8462264f50260f674a8ef4 VT 8 / 75

IOC database

Type
hash_sha256
Value
6b138dd673640dc611a8b5883301e5b77e6564d43a8462264f50260f674a8ef4
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 8 of 75 VirusTotal vendors

VendorVerdictDetection
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
ESET-NOD32 malicious Linux/Mirai.FLE trojan
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.ao!crit
Ikarus malicious Trojan.Linux.Mirai
Microsoft malicious Trojan:Script/Wacatac.B!ml
SentinelOne malicious Static AI - Suspicious ELF
Tencent malicious Backdoor.Linux.Mirai.wumra

Details From VirusTotal

Basic Properties
MD5788c6c3194ad8e4b65e6de72a69032f3
SHA-1d17aed479f4edcb9763f0d99ababe57dc4818083
SHA-2566b138dd673640dc611a8b5883301e5b77e6564d43a8462264f50260f674a8ef4
VHashfceb67c518b037a662590f4dec017f62
SSDEEP3072:KAZAGI+T66gB1qcehN99rSmTI6VVVknAOnwucz6:xZC9BihX93c6vVkAk4z6
TLSHT139D3290275D198FDD0C7C1709B6FD12ADA72F88D62307E5F3B906F612E6AE215B0A781
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
File size135.4 KB
History
First seen on VirusTotal2026-09-25 09:04 UTC
Last submission2026-09-25 09:07 UTC
Last analysis2026-09-25 09:07 UTC
Last modified on VirusTotal2026-09-25 13:46 UTC
Known Names
  • rp18alvd.exe
  • x86_64
  • 676196227c59e23d947620199aaedc81b993980421a123f2b9fca0a01a3f036c
  • j68sb.exe
hash_md5 788c6c3194ad8e4b65e6de72a69032f3 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/788c6c3194ad8e4b65e6de72a69032f3

IOC database

Type
hash_md5
Value
788c6c3194ad8e4b65e6de72a69032f3
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/788c6c3194ad8e4b65e6de72a69032f3

hash_sha1 d17aed479f4edcb9763f0d99ababe57dc4818083 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/d17aed479f4edcb9763f0d99ababe57dc4818083

IOC database

Type
hash_sha1
Value
d17aed479f4edcb9763f0d99ababe57dc4818083
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/d17aed479f4edcb9763f0d99ababe57dc4818083

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 138600 bytes. Tags: elf, Mirai. Reporter: Tuxxin. First seen: 2026-09-25 11:54:18.

Remediations (10)

  • Mirai Malware Analysis, Overview by ANY.RUN
    web:any.run

    Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    Information on Mirai malware sample (SHA256 48f273a4369a4f004accdd71b26526f8c0d30e0cbf02a1b15b8e86d32fb8adc2) MalwareBazaar Database You are currently viewing the ...

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • Mirai Malware Spreads Via GeoVision Zero-Day Exploit
    web:dailysecurityreview.com

    A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.

  • Mirai (malware) - Wikipedia
    web:en.wikipedia.org

    Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.

  • GitHub - hitesh70200/Malware_Analysis_Mirai: Static and dynamic ...
    web:github.com

    The analysis methodology adheres to a non-execution-based approach for the Mirai sample, primarily relying on static analysis and open-source intelligence. For practical tool demonstration, harmless ELF binaries (poweriso.elf and zipjail.elf) from the REMnux apparatus were used to test various forensic tools without risking system security.

  • Mirai Source Code - GitHub
    web:github.com

    Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...

  • Mirai (Malware Family) - Fraunhofer
    web:malpedia.caad.fkie.fraunhofer.de

    Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the ...

  • InfectedSlurs Botnet Spreads Mirai via Zero-Days - Akamai
    web:www.akamai.com

    Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2400 samples tracked, 24 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.