s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-aeec77163e05ae134a5dbf6a7f33823744c53efd338f12cf9113437d7e187d86 high

📛 Threat Title

Mirai: stub.x64

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 890372 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 08:40:28.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 aeec77163e05ae134a5dbf6a7f33823744c53efd338f12cf9113437d7e187d86 VT 16 / 75

IOC database

Type
hash_sha256
Value
aeec77163e05ae134a5dbf6a7f33823744c53efd338f12cf9113437d7e187d86
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 16 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Trojan.Linux.GenericKD.60057791
Antiy-AVL malicious Trojan/Linux.Zapchast
Arcabit malicious Trojan.Linux.Generic.D3946A6E
BitDefender malicious Trojan.Linux.GenericKD.60058222
CTX malicious elf.trojan.generic
Emsisoft malicious Trojan.Linux.GenericKD.60058222 (B)
ESET-NOD32 malicious Linux/Agent.BMJ trojan
GData malicious Trojan.Linux.GenericKD.60058222
huorong malicious Trojan/Linux.Agent.es
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Script/Dirtydecrypt.EAA
Microsoft malicious Trojan:Script/Wacatac.C!ml
MicroWorld-eScan malicious Trojan.Linux.GenericKD.60058222
Rising malicious Trojan.Agent/Linux!8.13268 (CLOUD)
Tencent malicious Malware.Linux.Generic.1c0c123d
VIPRE malicious Trojan.Linux.GenericKD.60058222

Details From VirusTotal

Basic Properties
MD5033eea17b371295f7fb21f00e19e7b00
SHA-1aab41ee21f6a72a346be83396ccf560db9b858e5
SHA-256aeec77163e05ae134a5dbf6a7f33823744c53efd338f12cf9113437d7e187d86
VHasheec77128256b007eaf21ffa93e146bc4
SSDEEP12288:ZugNP46S4QVs7a+6xGv/7VZji59IH0j/APyYiztSIHmxAowYRsXPi/N:7NP46S4QVs7l6A5Zji59k0jZz06FYRsO
TLSHT1F0157C5BB2F374BDC157C134479BCA72A935F46502122E7FA1C8C6302E2AE641B1AF76
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=254243f4644a531f0b1396c2dd32b9080165d855, for GNU/Linux 3.2.0, not stripped
File size869.5 KB
History
First seen on VirusTotal2026-09-25 10:49 UTC
Last submission2026-09-25 10:49 UTC
Last analysis2026-09-25 10:49 UTC
Last modified on VirusTotal2026-09-25 18:17 UTC
Known Names
  • copy
hash_sha1 aab41ee21f6a72a346be83396ccf560db9b858e5 VT 16 / 75

IOC database

Type
hash_sha1
Value
aab41ee21f6a72a346be83396ccf560db9b858e5
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 16 of 75 VirusTotal vendors

VendorVerdictDetection
ALYac malicious Trojan.Linux.GenericKD.60057791
Antiy-AVL malicious Trojan/Linux.Zapchast
Arcabit malicious Trojan.Linux.Generic.D3946A6E
BitDefender malicious Trojan.Linux.GenericKD.60058222
CTX malicious elf.trojan.generic
Emsisoft malicious Trojan.Linux.GenericKD.60058222 (B)
ESET-NOD32 malicious Linux/Agent.BMJ trojan
GData malicious Trojan.Linux.GenericKD.60058222
huorong malicious Trojan/Linux.Agent.es
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Script/Dirtydecrypt.EAA
Microsoft malicious Trojan:Script/Wacatac.C!ml
MicroWorld-eScan malicious Trojan.Linux.GenericKD.60058222
Rising malicious Trojan.Agent/Linux!8.13268 (CLOUD)
Tencent malicious Malware.Linux.Generic.1c0c123d
VIPRE malicious Trojan.Linux.GenericKD.60058222

Details From VirusTotal

Basic Properties
MD5033eea17b371295f7fb21f00e19e7b00
SHA-1aab41ee21f6a72a346be83396ccf560db9b858e5
SHA-256aeec77163e05ae134a5dbf6a7f33823744c53efd338f12cf9113437d7e187d86
VHasheec77128256b007eaf21ffa93e146bc4
SSDEEP12288:ZugNP46S4QVs7a+6xGv/7VZji59IH0j/APyYiztSIHmxAowYRsXPi/N:7NP46S4QVs7l6A5Zji59k0jZz06FYRsO
TLSHT1F0157C5BB2F374BDC157C134479BCA72A935F46502122E7FA1C8C6302E2AE641B1AF76
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=254243f4644a531f0b1396c2dd32b9080165d855, for GNU/Linux 3.2.0, not stripped
File size869.5 KB
History
First seen on VirusTotal2026-09-25 10:49 UTC
Last submission2026-09-25 10:49 UTC
Last analysis2026-09-25 10:49 UTC
Last modified on VirusTotal2026-09-25 18:17 UTC
Known Names
  • copy
hash_md5 033eea17b371295f7fb21f00e19e7b00 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/033eea17b371295f7fb21f00e19e7b00

IOC database

Type
hash_md5
Value
033eea17b371295f7fb21f00e19e7b00
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/033eea17b371295f7fb21f00e19e7b00

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 890372 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-25 08:40:28.

Remediations (10)

  • Mirai Malware Analysis, Overview by ANY.RUN
    web:any.run

    Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • yuanli-os-agent-team/v3/implementation/adrs/ADR-064-stub-remediation ...
    web:github.com

    ADR-064: Stub Remediation & Full Implementation — v3.5.22 Date: 2026-03-17 Status: Implemented (22 stubs fully implemented in v3.5.43, PR #1438) Context: Deep capability audit (ADR-063) identified stub implementations and broken features. This ADR documents the remediation plan and tracks which items were already functional vs genuinely needing fixes.

  • Quick Machine Recovery | Microsoft Learn
    web:learn.microsoft.com

    The system goes through auto remediation of a simulated crash and restarts back to Windows. During the recovery process, quick machine recovery test mode might require network connectivity to retrieve remediation content.

  • Dissecting Mirai: Spatio-Sequential Analysis and Restoration ... - Springer
    web:link.springer.com

    Following the public release of its source code in 2016, numerous variants have proliferated, broadening its attack surface and complicating detection and mitigation efforts. Despite extensive research on Mirai , existing analyses remain fragmented and informal, lacking a structured representation of its attack patterns.

  • In-depth Analysis of a New Mirai Variant - rruzi.github.io
    web:rruzi.github.io

    The C2 port is randomly selected between 25596 and 25616. In terms of the communication mechanism, Mirai .CatDDoS basically follows the original design of Mirai , except that the fixed 4-byte \x00\x00\x00\x01 when Mirai goes online is modified to a fixed 8-byte: \x31\x73\x13\x93\x04\x83\x32\x04 In terms of the ATTACK_VECTOR, Mirai .CatDDoS implements a richer variety of DDoS attack types than ...

  • Mirai Botnet Forensic Analysis - Cyber - westoahu.hawaii.edu
    web:westoahu.hawaii.edu

    Practicing proper mitigation techniques and being proactive can help reduce device vulnerabilities, and prevent the creation of more bots and limit the resources botnet operators have. References [1] Cloudflare. (2017, December 14). Inside the Infamous Mirai IoT Botnet: A Retrospective.

  • InfectedSlurs Botnet Spreads Mirai via Zero-Days - Akamai
    web:www.akamai.com

    Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2400 samples tracked, 24 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

  • [TOOL] Unofficial Bootloader Unlock (ROLLBACK METHOD)
    web:xdaforums.com

    Components runbook.sh (method), scripts/helpers.sh (shared), scripts/gpt_verify.py (payload-vs-device GPT verification), scripts/fetch_mifirm.js (stock-ROM fetch helper, optional) config.sh (generic, parametrized; no device-specific identifiers) payloads/README.md (per-SoC payload files + the GPT-rename trick), docs/sources.md (documented method) tools/ (fastboot/adb) is gitignored — fetch ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.