MB-5470816a8e3c4a2832db06fec71a066c33ca0222a540f592ca8a1f8bc874c574
high
📛 Threat Title
Mirai: tpijtvcr.arm
Description
File type: elf. Size: 942990 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-23 23:42:54.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
5470816a8e3c4a2832db06fec71a066c33ca0222a540f592ca8a1f8bc874c574
IOC database
- Type
- hash_sha256
- Value
5470816a8e3c4a2832db06fec71a066c33ca0222a540f592ca8a1f8bc874c574- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
bed701ef0419eeabe1edab18c8fc7c005f5427e2
IOC database
- Type
- hash_sha1
- Value
bed701ef0419eeabe1edab18c8fc7c005f5427e2- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
4356c6146ce1db0d076f0d4be9d1156c
IOC database
- Type
- hash_md5
- Value
4356c6146ce1db0d076f0d4be9d1156c- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 942990 bytes. Tags: elf, Gafgyt, Mirai. Reporter: abuse_ch. First seen: 2026-09-23 23:42:54.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:arxiv.org
Abstract—Mirai is undoubtedly one of the most significant Internet of Things (IoT) botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several variants that combined the old code with newer vulnerabilities found on popular IoT devices ...
-
web:blog.darkgen.io
Supplement persistence layers: Mirai has nothing; only the re-infection scripts operate on the restart. On the whole, the disassembly clears up the case that Mirai is an efficient, straight, and goal-oriented ARM malware engaged in large botnet activity. I might drop a full breakdown video of the disassembly and analysis soon, so keep an eye out.
-
web:github.com
Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...
-
web:neuro.wiki
Bottom Line Targeted ipsilesional arm training with virtual reality and manipulation significantly improved ipsilesional hand function (12% faster on JTHFT, p=0.003) in chronic stroke patients with severe hemiparesis, with benefits sustained at 6 months. This identifies the ipsilesional arm as an important and modifiable rehabilitation target.
-
web:securelist.com
Kaspersky GReAT experts describe the new features of a Mirai variant: the latest botnet infections target TBK DVR devices with CVE-2024-3721.
-
web:trainsec.net
In this particular case, I found an ARM-compiled Mirai botnet sample. The anti-virus checks labeled it as " Mirai ," matching what I found in the documentation, sandbox analyses, and community threat intelligence sources. Mirai is known to compile variants for multiple architectures (ARM, MIPS, x86, x64, etc.), making it adaptable and widespread.
-
web:www.akamai.com
Akamai has uncovered two zero-day vulnerabilities that are being actively exploited to spread a Mirai variant in the wild. Read on for details and mitigation .
-
web:www.joesandbox.com
Automated Malware Analysis - Joe Sandbox Analysis Report Matched rule: Mirai_Botnet_Malwaredate = 2016-10-04, hash5 ...
-
web:www.netscout.com
Arbor Networks - DDoS Experts ASERT Threat Summary: Aisuru and Related TurboMirai Botnet DDoS Attack Mitigation and Suppression—October 2025—v1.0
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.