MB-7aaf8b24397530ac4de370a961d0ebfa5b9e03a1fc80510eebf5e0a2588a40c2
high
📛 Threat Title
Mirai: iran.mipsel
Description
File type: elf. Size: 210748 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-07-28 15:10:38.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
7aaf8b24397530ac4de370a961d0ebfa5b9e03a1fc80510eebf5e0a2588a40c2
IOC database
- Type
- hash_sha256
- Value
7aaf8b24397530ac4de370a961d0ebfa5b9e03a1fc80510eebf5e0a2588a40c2- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
a979851eb3c9af9cffb39b45bb2627414e7f399d
IOC database
- Type
- hash_sha1
- Value
a979851eb3c9af9cffb39b45bb2627414e7f399d- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
fe526caf2ae90ed63f822f88446f0dfa
IOC database
- Type
- hash_md5
- Value
fe526caf2ae90ed63f822f88446f0dfa- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 210748 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-07-28 15:10:38.
Remediations (10)
-
web:cybersecuritynews.com
Mirai botnet variants target IoT devices via weak creds, driving rising DDoS threats and infecting millions worldwide.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:radar.offseq.com
Detailed information about ThreatFox IOCs for 2026-07-19. Get real-time updates, technical details, and mitigation strategies.
-
web:threatfox.abuse.ch
I'm a security researcher and I've been tracking an active non- Mirai -variant botnet Called Iranbot operated by an Egyptian threat actor (Telegram: @FuckIsra3l). I'm reaching out because I believe this is actionable enough for a takedown and I want to share everything I have.
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.cisa.gov
Cybersecurity Advisory: Provides detailed information on cyber threats, including threat actor tactics, techniques, and procedures and indicators of compromise, along with recommended actions for detection, mitigation , and response.
-
web:www.joesandbox.com
File: /tmp/iran.mipsel.elf Jump to behavior Malware Analysis System Evasion Uses the "uname" system call to query kernel version information (possible evasion) Source: /tmp/iran.mipsel.elf (PID: 6235) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in ...
-
web:www.joesandbox.com
Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.