s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-0b65862f541e107c401881d6c064b526bc7206915fdaa739e914101a771292e8 high

📛 Threat Title

Mirai: iran.mipsel

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 211648 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:44.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 0b65862f541e107c401881d6c064b526bc7206915fdaa739e914101a771292e8 VT 26 / 75

IOC database

Type
hash_sha256
Value
0b65862f541e107c401881d6c064b526bc7206915fdaa739e914101a771292e8
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
Antiy-AVL malicious GrayWare[AdWare]/Linux.Puwaders
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-10056448-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Gafgyt
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.ERM
Microsoft malicious Trojan:Script/Wacatac.C!ml
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!950FD7090B15
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!950FD7090B15
Varist malicious E32/Mirai.EN.gen!Camelot

Details From VirusTotal

Basic Properties
MD5950fd7090b15a29ef8a4c73c3d82a698
SHA-1f816ce9a12360841c2dfd2c988c5a84531b39a72
SHA-2560b65862f541e107c401881d6c064b526bc7206915fdaa739e914101a771292e8
VHashfd8d61116e2bf5a724a94e7a3be4ff8d
SSDEEP3072:PD/6gT7DbU28Mn0NawZ5aMBjv+7GYNRFS1:PDND1f08wZ5Fj6GY3FS
TLSHT17524C60AAF610FFBD8AFDD3746E90B0635CC650722A83B3A3674D924F54A54B49D3C68
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size206.7 KB
History
First seen on VirusTotal2026-10-21 18:20 UTC
Last submission2026-10-21 18:21 UTC
Last analysis2026-10-21 18:20 UTC
Last modified on VirusTotal2026-10-21 20:21 UTC
Known Names
  • mipsel
  • cqop4i.exe
  • iran.mipsel.elf
  • iran.mipsel
hash_sha1 f816ce9a12360841c2dfd2c988c5a84531b39a72 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/f816ce9a12360841c2dfd2c988c5a84531b39a72

IOC database

Type
hash_sha1
Value
f816ce9a12360841c2dfd2c988c5a84531b39a72
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/f816ce9a12360841c2dfd2c988c5a84531b39a72

hash_md5 950fd7090b15a29ef8a4c73c3d82a698 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/950fd7090b15a29ef8a4c73c3d82a698

IOC database

Type
hash_md5
Value
950fd7090b15a29ef8a4c73c3d82a698
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/950fd7090b15a29ef8a4c73c3d82a698

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 211648 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:44.

Remediations (10)

  • Mirai (malware) - Wikipedia
    web:en.wikipedia.org

    Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.

  • IoT Secure Gateway: Mirai Mitigation Lab - GitHub
    web:github.com

    IoT Secure Gateway: Mirai Mitigation Lab A network security project that simulates Mirai -style IoT attack behavior and validates a firewall-based defense using Docker, Linux networking, nftables, Bash, and PowerShell automation.

  • Mirai Source Code - GitHub
    web:github.com

    Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...

  • iran.mipsel - Malicious Sample - Maltiverse
    web:maltiverse.com

    Hashes Filename: iran.mipsel md5: 4a5a5b500a26471264171e76addc13b0 sha1: 6c79a0a60851e2edc7f3321e93d99f9b7ffdad93 sha256: a069d39c3027613df89acf77c57d19fc05b1ddb8fa1429f3b9ce6213260e3d75 sha512: In depth details Filetype: Architecture: Compiler: Size (Bytes): Classification: malicious Mutex mutex: Dates Indexed: 2026-03-06 15:41:39 (2026-03-06 ...

  • ThreatFox | http://103.83.87.122/iran.mipsel
    web:threatfox.abuse.ch

    Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers

  • URLhaus | http://45.32.215.222/iran.mipsel
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • PDF Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.jisem-journal.com

    Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices compromised by malware.

  • Automated Malware Analysis Report for iran.mipsel.elf - Generated by ...
    web:www.joesandbox.com

    Linux Analysis Report iran.mipsel.elf Overview General Information ... Detection Gafgyt, Mirai

  • Linux Analysis Report iran.mipsel.elf - Joe Sandbox
    web:www.joesandbox.com

    Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese.

  • Iranian-Linked Cyberattacks Target U.S. Municipal Water and Wastewater ...
    web:www.rescana.com

    Executive SummaryBetween April and August 2026, multiple U.S. municipal water and wastewater systems experienced coordinated cyberattacks attributed to Iranian-affiliated threat actors, according to j

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.