s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-e77f5a626b576647c5daefd2fa0002ab273b1173d9ad7cf39abd7f1144e6ec86 high

📛 Threat Title

Mirai: qzxuuppn.arm7n

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 944356 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-24 00:02:24.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 e77f5a626b576647c5daefd2fa0002ab273b1173d9ad7cf39abd7f1144e6ec86

IOC database

Type
hash_sha256
Value
e77f5a626b576647c5daefd2fa0002ab273b1173d9ad7cf39abd7f1144e6ec86
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha1 f54146e1f9e58aa70d170ca5e741ff427a1024f1

IOC database

Type
hash_sha1
Value
f54146e1f9e58aa70d170ca5e741ff427a1024f1
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_md5 3426e05c0551d2622dd77e346a62da86

IOC database

Type
hash_md5
Value
3426e05c0551d2622dd77e346a62da86
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 944356 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-24 00:02:24.

Remediations (10)

  • Mirai Malware Analysis, Overview by ANY.RUN
    web:any.run

    Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  • Mirai Malware Spreads Via GeoVision Zero-Day Exploit
    web:dailysecurityreview.com

    A Mirai malware botnet is leveraging a zero-day vulnerability (CVE-2024-11120) in outdated GeoVision devices to deploy malware, potentially for DDoS attacks or cryptomining. Thousands of vulnerable devices are exposed online.

  • New Mirai Botnet Leverages Zero-Day Exploits on Routers
    web:dailysecurityreview.com

    A new Mirai botnet is using zero-day exploits to target industrial routers and smart home devices, launching high-intensity DDoS attacks. Learn about the vulnerabilities and how to protect your systems.

  • Mirai Source Code - GitHub
    web:github.com

    This repository contains the leaked source code of the Mirai botnet, originally created to infect IoT devices and launch large-scale DDoS attacks. This code is provided strictly for cybersecurity research, reverse engineering, malware analysis, and detection development purposes only.

  • Dissecting Mirai: Spatio-Sequential Analysis and Restoration ... - Springer
    web:link.springer.com

    Following the public release of its source code in 2016, numerous variants have proliferated, broadening its attack surface and complicating detection and mitigation efforts. Despite extensive research on Mirai , existing analyses remain fragmented and informal, lacking a structured representation of its attack patterns.

  • Remediation vs. Mitigation: What's the Difference? - Panorays
    web:panorays.com

    Discover the difference between remediation and mitigation in risk management and how each strategy impacts security and resilience.

  • The Difference Between Mitigation and Remediation: A Cyber Practitioner ...
    web:securityboulevard.com

    These mitigation tactics, when thoughtfully integrated into a remediation strategy, ensure that security measures are both practical and resilient. They acknowledge the limitations and challenges of the operational environment, providing flexible solutions that maintain security without compromising business functions.

  • Mirai Botnet | ARM Reverse Engineering Walkthrough
    web:trainsec.net

    Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...

  • Mirai Botnet Forensic Analysis - Cyber - westoahu.hawaii.edu
    web:westoahu.hawaii.edu

    A botnet called Mirai infected hundreds of thousands of Internet of Things (IoT) devices, amassing a wide network of compromised devices. Mitigations against the Mirai botnet involve taking proactive security measures, properly hardening systems, and updating to the latest software to reduce the risk of compromise.

  • Here Comes Mirai: IoT Devices RSVP to Active Exploitation
    web:www.akamai.com

    The Akamai Security Intelligence and Response Team (SIRT) has identified active exploitation of command injection vulnerabilities CVE-2024-6047 and CVE-2024-11120 against discontinued GeoVision Internet of Things (IoT) devices. The SIRT first identified activity in our honeypots in April 2025. This is the first reported active exploitation of these vulnerabilities since the initial disclosure ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.