MB-09a44d593c4310d1f14c32bd15842f4eeacee7977ed3d1295a5ba6d58e24407e
high
📛 Threat Title
Mirai: iran.arc
Description
File type: elf. Size: 157332 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-19 05:58:35.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
09a44d593c4310d1f14c32bd15842f4eeacee7977ed3d1295a5ba6d58e24407e
IOC database
- Type
- hash_sha256
- Value
09a44d593c4310d1f14c32bd15842f4eeacee7977ed3d1295a5ba6d58e24407e- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
1517ef013150c6d6213071917116f3df
IOC database
- Type
- hash_md5
- Value
1517ef013150c6d6213071917116f3df- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
609ddaea210d34ba50044ffc22c53e985a90c0d7
IOC database
- Type
- hash_sha1
- Value
609ddaea210d34ba50044ffc22c53e985a90c0d7- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 157332 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-19 05:58:35.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers. [1] The Mirai botnet was first found in August 2016 [2] by MalwareMustDie, [3] a white hat malware research ...
-
web:github.com
IoT Secure Gateway: Mirai Mitigation Lab A network security project that simulates Mirai -style IoT attack behavior and validates a firewall-based defense using Docker, Linux networking, nftables, Bash, and PowerShell automation.
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:thrivenextgen.com
2.1 The Iran Conflict: Strategic Cyber Implications The current military conflict involving Iran has fundamentally altered the cyber threat landscape across the Middle East and globally. Historically, Iranian military pressure has been directly coupled with escalated cyber operations — Iran's APT ecosystem functions as an instrument of state power, enabling asymmetric retaliation ...
-
web:westoahu.hawaii.edu
Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.
-
web:www.fbi.gov
The FBI further assesses these Iran-based cyber actors are associated with the Government of Iran (GOI) and—separate from the ransomware activity—conduct computer network exploitation activity ...
-
web:www.joesandbox.com
Automated Malware Analysis - Joe Sandbox Analysis Report Ransomware Spreading Phishing Banker Trojan / Bot Adware Spyware Exploiter Evader Miner clean suspicious malicious
-
web:www.joesandbox.com
Behavior Graph ID: 1937812 Sample: iran.arc.elf Startdate: 06/07/2026 Architecture: LINUX Score: 80 Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Yara detected Mirai
-
web:www.quorumcyber.com
Mirai initially infected and weaponised devices such as smart cameras and Realtek routers2. The botnet variant was created in a racketeering attempt by the cofounders of Protraf Solutions, an organisation offering DDoS mitigation services.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.