MB-86023fcc1bbc5aab9975ee2e2ed8ea061fdc3ac876ce59420a40b733cdf47146
high
📛 Threat Title
Mirai: bot.armv6l
Description
File type: elf. Size: 1013561 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 22:34:24.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
86023fcc1bbc5aab9975ee2e2ed8ea061fdc3ac876ce59420a40b733cdf47146
IOC database
- Type
- hash_sha256
- Value
86023fcc1bbc5aab9975ee2e2ed8ea061fdc3ac876ce59420a40b733cdf47146- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
30d6ce56429cbeff1b1feae9b5fbdd0f078bbf77
IOC database
- Type
- hash_sha1
- Value
30d6ce56429cbeff1b1feae9b5fbdd0f078bbf77- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
ce2c1a554e4ca6784c91cb814d3b8c2a
IOC database
- Type
- hash_md5
- Value
ce2c1a554e4ca6784c91cb814d3b8c2a- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 1013561 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 22:34:24.
Remediations (10)
-
web:any.run
Online sandbox report for bot.armv6l , tagged as botnet, mirai , verdict: Malicious activity
-
web:arxiv.org
Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices. The ...
-
web:arxiv.org
Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...
-
web:github.com
Containerized IoT security lab simulating Mirai -style botnet behavior and validating an nftables default-deny gateway defense, with automated evidence capture and reporting. - Jehosua97/iot-secure-gateway- mirai - mitigation
-
web:trainsec.net
Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...
-
web:westoahu.hawaii.edu
Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.
-
web:www.cisecurity.org
The Mirai botnet soon spread to infect thousands of internet of things (IoT) devices and evolved to conduct full, large-scale attacks. After noticing an increase in infections, Mirai caught the attention of the nonprofit organization MalwareMustDie in August 2016, who then started to research, analyze, and track the botnet [2].
-
web:www.radware.com
What is the Mirai Botnet? Mirai is a pervasive Internet-of-Things (IoT) botnet that first surfaced in 2016 and rapidly evolved into a foundational DDoS framework. By scanning for devices with default or weak credentials and installing a lightweight in-memory agent, Mirai and its descendants have mounted some of the largest and most disruptive volumetric and application-layer DDoS campaigns in ...
-
web:www.sciencedirect.com
In the specific context of Mirai botnet detection and mitigation , several approaches have been presented in the literature. Some works focus on studying the behavior of the Mirai botnet, examining and monitoring its propagation and impact within networked systems [85], [86], [87].
-
web:www.threatintelreport.com
YARA rule Mirai_Malware_IOCs_1 detects strings including "bruh why again", "mamakmukekkontol" and the listed domains and hashes. Mitigation Recommendations Upgrade n8n immediately to version 1.122.0 or later. Update Tenda AC1206 firmware or isolate devices from the internet. Block all listed IOCs at network perimeter and endpoint layers.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.