URLhaus-PL-0b4f0b0746b852176d3b6da56fc278a3101ca9a89eff09a2e7433fc82560e1e0
medium
📛 Threat Title
URLhaus payload: Mirai (elf) 0b4f0b0746b85217…
Description
Malware family: Mirai. File type: elf. Size: 944,611 bytes. First seen: 2026-09-24 08:23:18.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
0b4f0b0746b852176d3b6da56fc278a3101ca9a89eff09a2e7433fc82560e1e0
IOC database
- Type
- hash_sha256
- Value
0b4f0b0746b852176d3b6da56fc278a3101ca9a89eff09a2e7433fc82560e1e0- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
d802a82cd1f228ab3fa4163a6e2ef595
IOC database
- Type
- hash_md5
- Value
d802a82cd1f228ab3fa4163a6e2ef595- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_ssdeep
24576:mvyp1r7vmu2cwfcr0tab+tc6k2hknuq6j5:fbzqoyc6k2hkoj5
IOC database
- Type
- hash_ssdeep
- Value
24576:mvyp1r7vmu2cwfcr0tab+tc6k2hknuq6j5:fbzqoyc6k2hkoj5- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- ssdeep of URLhaus payload 0b4f0b0746b85217…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_tlsh
t1d7154b55f890df63c5d4677af65e82a833234778c3e7720699148b383b97a2f0b3a6
IOC database
- Type
- hash_tlsh
- Value
t1d7154b55f890df63c5d4677af65e82a833234778c3e7720699148b383b97a2f0b3a6- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- TLSH of URLhaus payload 0b4f0b0746b85217…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Download sample (ZIP, password: infected) URLhaus
- URLhaus payload page URLhaus
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:bazaar.abuse.ch
Information on Mirai malware sample (SHA256 2a28b7e37fed807e966762b43e82f86685ad180a0ffbc71ea1dfce16b4809351) MalwareBazaar Database You are currently viewing the ...
-
web:github.com
🦠 Mirai Botnet - Malware Static Analysis This repository contains a comprehensive Static Analysis and Reverse Engineering report of the notorious Mirai Malware ( ELF 32-bit binary). This project was conducted as part of the Reverse Engineering Midterm Exam at Universitas Amikom Yogyakarta.
-
web:github.com
This repository contains a static malware analysis of the IoT Mirai malware (loader component) obtained from theZoo malware repository. The objective of this project is to understand Mirai's infection mechanism, network behavior, architecture-specific payload delivery, and execution flow using reverse engineering techniques.
-
web:malpedia.caad.fkie.fraunhofer.de
Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the ...
-
web:threat-modeling.com
Arch Linux AUR Supply Chain Compromise — A massive supply chain attack has compromised over 400 packages in the Arch User Repository (AUR), distributing a Linux rootkit combined with infostealer malware. The malware targets sensitive credentials, access tokens, and SSH keys from compromised systems. All organizations and individuals using Arch-based systems with AUR packages should audit ...
-
web:urlhaus.abuse.ch
URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...
-
web:urlhaus.abuse.ch
Here you can propose new malware urls or just browse the URLhaus database. If you are looking for a parsable list of the dataset, you might want to check out the URLhaus API.
-
web:www.threatclaw.ai
Mirai Build-Tooling Signal Divergence: UPX-Dec Wrapping and the Evolving IoT Botnet Supply Chain The last 24 hours of MalwareBazaar submissions reveal a subtle but meaningful shift in the Mirai build pipeline. All six fresh samples are ELF binaries tagged with either upx or upx-dec packing, alongside three active malware-download URLs correlated across URLhaus . This is not random noise — the ...
-
web:www.threatclaw.ai
In the last 24 hours the ThreatFox feed surfaced a rare and specific pattern: two distinct Mozi payload rails served alongside a mainstream Mirai ELF delivery rail, all from the same class of low-reputation hosting infrastructure.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.