MB-3dc384b44e2e6c37ba4529b86740771f9f942bc0b01a9830110cb4f86739c131
high
📛 Threat Title
Mirai: iran.armv7l
Description
File type: elf. Size: 146264 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-08-17 20:16:31.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
3dc384b44e2e6c37ba4529b86740771f9f942bc0b01a9830110cb4f86739c131
IOC database
- Type
- hash_sha256
- Value
3dc384b44e2e6c37ba4529b86740771f9f942bc0b01a9830110cb4f86739c131- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
9307de4d4b362d5e9bd3e1618b930c0c67be58cc
IOC database
- Type
- hash_sha1
- Value
9307de4d4b362d5e9bd3e1618b930c0c67be58cc- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
b9dc7b28f988998c9ab86567aff03d6f
IOC database
- Type
- hash_md5
- Value
b9dc7b28f988998c9ab86567aff03d6f- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 146264 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-08-17 20:16:31.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:any.run
Online sandbox report for armv7l, tagged as auto, mirai , botnet, verdict: Malicious activity
-
web:app.any.run
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:trainsec.net
Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:urlhaus.abuse.ch
The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.akamai.com
Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .
-
web:www.joesandbox.com
Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Yara detected Mirai Drops files in suspicious directories Sample tries to set files in /etc globally writable Detected TCP or UDP traffic on non-standard ports Enumerates processes within the "proc" file system Found strings indicative of a multi-platform dropper Sample contains strings ...
-
web:www.joesandbox.com
Automated Malware Analysis - Joe Sandbox Analysis Report Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.