s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-45d984cbf5d105df00c45042a0fb00aae45b491e3af9bf09fd1b0cc7b7b3a25a high

📛 Threat Title

Mirai: iran.mipsrouter

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 246219 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:42.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 45d984cbf5d105df00c45042a0fb00aae45b491e3af9bf09fd1b0cc7b7b3a25a VT 25 / 75

IOC database

Type
hash_sha256
Value
45d984cbf5d105df00c45042a0fb00aae45b491e3af9bf09fd1b0cc7b7b3a25a
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 25 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
alibabacloud malicious DDOS:Linux/Mirai
Antiy-AVL malicious Trojan[Backdoor]/Linux.Gafgyt
Avast malicious ELF:Gafgyt-DZ [Trj]
AVG malicious ELF:Gafgyt-DZ [Trj]
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-8041698-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Mirai.B!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.MiraiTR
Kaspersky malicious HEUR:Backdoor.Linux.Gafgyt.bj
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Script/Mirai.EET
Microsoft malicious Backdoor:Linux/Mirai.GL!MTB
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
Varist malicious E32/Mirai.EN.gen!Camelot

Details From VirusTotal

Basic Properties
MD5bc1a501ad66358c34e0cdb9429193642
SHA-19e82cbc9b202d7105dbc29adbf644e775c1d2b70
SHA-25645d984cbf5d105df00c45042a0fb00aae45b491e3af9bf09fd1b0cc7b7b3a25a
VHasha9c056ce78f4e43f4d59dc3386cf9650
SSDEEP6144:p5n4F842iQbY1dplvtKSP1p1J8JG8WYkQsxNenndQ:gF84s+dP1p1J8JG8WYkQsxNenndQ
TLSHT1F834B91A3E228FBEF268C77047F34A31976976D627E2D684E26CD5101F1438D681FB68
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, with debug_info, not stripped
File size240.4 KB
History
First seen on VirusTotal2026-10-21 18:21 UTC
Last submission2026-10-21 18:21 UTC
Last analysis2026-10-21 18:21 UTC
Last modified on VirusTotal2026-10-21 20:24 UTC
Known Names
  • ruaeg3u.exe
  • iran.mipsrouter.elf
  • iran.mipsrouter
hash_sha1 9e82cbc9b202d7105dbc29adbf644e775c1d2b70 VT 25 / 75

IOC database

Type
hash_sha1
Value
9e82cbc9b202d7105dbc29adbf644e775c1d2b70
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 25 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
alibabacloud malicious DDOS:Linux/Mirai
Antiy-AVL malicious Trojan[Backdoor]/Linux.Gafgyt
Avast malicious ELF:Gafgyt-DZ [Trj]
AVG malicious ELF:Gafgyt-DZ [Trj]
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-8041698-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Mirai.B!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.MiraiTR
Kaspersky malicious HEUR:Backdoor.Linux.Gafgyt.bj
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Script/Mirai.EET
Microsoft malicious Backdoor:Linux/Mirai.GL!MTB
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
Varist malicious E32/Mirai.EN.gen!Camelot

Details From VirusTotal

Basic Properties
MD5bc1a501ad66358c34e0cdb9429193642
SHA-19e82cbc9b202d7105dbc29adbf644e775c1d2b70
SHA-25645d984cbf5d105df00c45042a0fb00aae45b491e3af9bf09fd1b0cc7b7b3a25a
VHasha9c056ce78f4e43f4d59dc3386cf9650
SSDEEP6144:p5n4F842iQbY1dplvtKSP1p1J8JG8WYkQsxNenndQ:gF84s+dP1p1J8JG8WYkQsxNenndQ
TLSHT1F834B91A3E228FBEF268C77047F34A31976976D627E2D684E26CD5101F1438D681FB68
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, with debug_info, not stripped
File size240.4 KB
History
First seen on VirusTotal2026-10-21 18:21 UTC
Last submission2026-10-21 18:21 UTC
Last analysis2026-10-21 18:21 UTC
Last modified on VirusTotal2026-10-21 20:24 UTC
Known Names
  • ruaeg3u.exe
  • iran.mipsrouter.elf
  • iran.mipsrouter
hash_md5 bc1a501ad66358c34e0cdb9429193642 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/bc1a501ad66358c34e0cdb9429193642

IOC database

Type
hash_md5
Value
bc1a501ad66358c34e0cdb9429193642
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/bc1a501ad66358c34e0cdb9429193642

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 246219 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:42.

Remediations (10)

  • InfectedSlurs Botnet Spreads Mirai via Zero-Days in Routers and NVRs
    web:advisory.eventussecurity.com

    The active exploitation of undisclosed vulnerabilities in the wild prompted Akamai to caution the cybersecurity community. The blog refrains from divulging vendor names to allow for responsible disclosure, patching, and remediation . The Mirai -based botnet, named InfectedSlurs, spawned from this exploit campaign.

  • A_Survey_on_The_Mirai_IoT_Botnet_and_Its_Recent_Variants (2)
    web:arxiv.org

    Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...

  • New Mirai Botnet Leverages Zero-Day Exploits on Routers
    web:dailysecurityreview.com

    A new Mirai botnet is using zero-day exploits to target industrial routers and smart home devices, launching high-intensity DDoS attacks. Learn about the vulnerabilities and how to protect your systems.

  • Mirai (malware) - Wikipedia
    web:en.wikipedia.org

    Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers. [1] The Mirai botnet was first found in August 2016 [2] by MalwareMustDie, [3] a white hat malware research ...

  • IoT Secure Gateway: Mirai Mitigation Lab - GitHub
    web:github.com

    Containerized IoT security lab simulating Mirai -style botnet behavior and validating an nftables default-deny gateway defense, with automated evidence capture and reporting. - Jehosua97/iot-secure-...

  • Dissecting Mirai: Spatio-Sequential Analysis and Restoration ... - Springer
    web:link.springer.com

    The Mirai botnet has emerged as one of the most persistent and evolving threats targeting Internet of Things devices. Originally designed to orchestrate large-scale Distributed Denial of Service attacks, Mirai compromises devices by exploiting weak credentials and...

  • URLhaus | http://94.154.43.221/iran.mipsrouter
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • How to Defend Against Iran's Cyber Retaliation Playbook
    web:www.cisecurity.org

    Security leaders must give equal weight to the cyber dimension following U.S.-Israeli kinetic activity against Iran. Here's our recommendations.

  • Advisory: Iranian Cyber Risks & Mitigation | Deepwatch
    web:www.deepwatch.com

    Expert analysis on elevated Iranian cyber threats following 2026 events. Learn TTPs and proactive strategies to protect your environment.

  • Decoding Router Vulnerabilities Exploited by Mirai ... - SonicWall
    web:www.sonicwall.com

    As seen in Cybersecurity Insiders, June 2024. SonicWall has already successfully defended against 5.8 million Mirai -related attacks in 2024, and we've seen a spike in honeypot activity related to Mirai , all aimed at exploiting vulnerabilities in aging router systems. These attacks exhibit striking similarities, a theme we will explore further in subsequent sections of this blog. By ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.