s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-b09deaaffa1f540c5a1a4ff7eb33c4897ea1b0f699c20db73b0034b0fadaf1b5 high

📛 Threat Title

Mirai: iranbot-ultimate.mips

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 214964 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-11-02 17:02:03.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 b09deaaffa1f540c5a1a4ff7eb33c4897ea1b0f699c20db73b0034b0fadaf1b5 VT 20 / 75

IOC database

Type
hash_sha256
Value
b09deaaffa1f540c5a1a4ff7eb33c4897ea1b0f699c20db73b0034b0fadaf1b5
First seen
Last seen
Attached to this threat
Appears in
3 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 20 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Mirai-AJJ [PUP]
AVG malicious ELF:Mirai-AJJ [PUP]
Avira malicious EXP/ELF.Agent.J.8
ClamAV malicious Unix.Trojan.Mirai-8041698-0
Cynet malicious Malicious (score: 99)
ESET-NOD32 malicious Linux/Mirai.FNP trojan
F-Secure malicious Exploit.EXP/ELF.Agent.J.8
Google malicious Detected
Ikarus malicious Trojan.Linux.MiraiTR
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious Trojan:Script/Mirai.EHA
Microsoft malicious Backdoor:Linux/Mirai.GL!MTB
Sangfor malicious Backdoor.Linux.Mirai.Vg8h
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD5818b249ee6c5f58cfca2e1fe55b688a6
SHA-150212c2078ce013b3196d86d12af5d87ceb04ef9
SHA-256b09deaaffa1f540c5a1a4ff7eb33c4897ea1b0f699c20db73b0034b0fadaf1b5
VHashd6d22abe7b0e8ad79f0cd5a35406ec8a
SSDEEP3072:F9KJdHkxQqweWXN2UrpgiH1DdYmUPoZS1iEnsMB5Y8E7VrkrzVW:F9WdhrpNHNUwZtMBm7iVW
TLSHT17424D85E6E328F6DF278C73147F74A25A76963DA23E1D644E1ACC1105F2038E641FBA8
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size209.9 KB
History
First seen on VirusTotal2026-11-02 16:51 UTC
Last submission2026-11-02 16:51 UTC
Last analysis2026-11-02 18:03 UTC
Last modified on VirusTotal2026-11-02 20:05 UTC
Known Names
  • qzxvky.exe
  • 437454366
hash_sha1 50212c2078ce013b3196d86d12af5d87ceb04ef9 VT 20 / 75

IOC database

Type
hash_sha1
Value
50212c2078ce013b3196d86d12af5d87ceb04ef9
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 20 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Mirai-AJJ [PUP]
AVG malicious ELF:Mirai-AJJ [PUP]
Avira malicious EXP/ELF.Agent.J.8
ClamAV malicious Unix.Trojan.Mirai-8041698-0
Cynet malicious Malicious (score: 99)
ESET-NOD32 malicious Linux/Mirai.FNP trojan
F-Secure malicious Exploit.EXP/ELF.Agent.J.8
Google malicious Detected
Ikarus malicious Trojan.Linux.MiraiTR
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious Trojan:Script/Mirai.EHA
Microsoft malicious Backdoor:Linux/Mirai.GL!MTB
Sangfor malicious Backdoor.Linux.Mirai.Vg8h
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD5818b249ee6c5f58cfca2e1fe55b688a6
SHA-150212c2078ce013b3196d86d12af5d87ceb04ef9
SHA-256b09deaaffa1f540c5a1a4ff7eb33c4897ea1b0f699c20db73b0034b0fadaf1b5
VHashd6d22abe7b0e8ad79f0cd5a35406ec8a
SSDEEP3072:F9KJdHkxQqweWXN2UrpgiH1DdYmUPoZS1iEnsMB5Y8E7VrkrzVW:F9WdhrpNHNUwZtMBm7iVW
TLSHT17424D85E6E328F6DF278C73147F74A25A76963DA23E1D644E1ACC1105F2038E641FBA8
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size209.9 KB
History
First seen on VirusTotal2026-11-02 16:51 UTC
Last submission2026-11-02 16:51 UTC
Last analysis2026-11-02 18:03 UTC
Last modified on VirusTotal2026-11-02 20:05 UTC
Known Names
  • qzxvky.exe
  • 437454366
hash_md5 818b249ee6c5f58cfca2e1fe55b688a6 VT 20 / 75

IOC database

Type
hash_md5
Value
818b249ee6c5f58cfca2e1fe55b688a6
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 20 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Mirai-AJJ [PUP]
AVG malicious ELF:Mirai-AJJ [PUP]
Avira malicious EXP/ELF.Agent.J.8
ClamAV malicious Unix.Trojan.Mirai-8041698-0
Cynet malicious Malicious (score: 99)
ESET-NOD32 malicious Linux/Mirai.FNP trojan
F-Secure malicious Exploit.EXP/ELF.Agent.J.8
Google malicious Detected
Ikarus malicious Trojan.Linux.MiraiTR
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious Trojan:Script/Mirai.EHA
Microsoft malicious Backdoor:Linux/Mirai.GL!MTB
Sangfor malicious Backdoor.Linux.Mirai.Vg8h
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD5818b249ee6c5f58cfca2e1fe55b688a6
SHA-150212c2078ce013b3196d86d12af5d87ceb04ef9
SHA-256b09deaaffa1f540c5a1a4ff7eb33c4897ea1b0f699c20db73b0034b0fadaf1b5
VHashd6d22abe7b0e8ad79f0cd5a35406ec8a
SSDEEP3072:F9KJdHkxQqweWXN2UrpgiH1DdYmUPoZS1iEnsMB5Y8E7VrkrzVW:F9WdhrpNHNUwZtMBm7iVW
TLSHT17424D85E6E328F6DF278C73147F74A25A76963DA23E1D644E1ACC1105F2038E641FBA8
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size209.9 KB
History
First seen on VirusTotal2026-11-02 16:51 UTC
Last submission2026-11-02 16:51 UTC
Last analysis2026-11-02 18:03 UTC
Last modified on VirusTotal2026-11-02 20:05 UTC
Known Names
  • qzxvky.exe
  • 437454366

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 214964 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-11-02 17:02:03.

Remediations (10)

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    You are currently viewing the MalwareBazaar entry for SHA256 37e916a94348781f75e03035716479f2a0ab59b7d9eda03b5dcd4621ff1768bc. While MalwareBazaar tries to identify ...

  • Mirai (malware) - Wikipedia
    web:en.wikipedia.org

    Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.

  • An In-Depth Analysis of the Mirai Botnet - IEEE Xplore
    web:ieeexplore.ieee.org

    This paper will focus on a particularly widespread piece of IoT malware known as the Mirai botnet by examining what its capabilities are, how it spreads to new devices, the impact that it has already had, and propose mitigation solutions to help prevent future attacks.

  • New Mirai Variant Adds 8 New Exploits, Targets Additional IoT Devices
    web:unit42.paloaltonetworks.com

    Our researchers have discovered a new Mirai variant that uses 8 new vulnerabilities and targets new IoT devices.

  • PDF Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.jisem-journal.com

    Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices compromised by malware. The methods presented are generic and can be used to mitigate any malware of the same nature.

  • Linux Analysis Report iranbot-ultimate.mipsel.elf
    web:www.joesandbox.com

    Source: /tmp/ iranbot -ultimate.mipsel.elf (PID: 4114) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Source: iranbot -ultimate.mipsel.elf, 4114.1.000055791f6df000.000055791f766000.rw-.sdmp Binary or memory string: yU!/etc/qemu-binfmt/mipsel

  • Linux Analysis Report iranbot-ultimate.mips.elf
    web:www.joesandbox.com

    Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Executes the "systemctl" command used for controlling the systemd system and service manager Reads system version information Sample has stripped symbol table Sample tries to kill a process (SIGKILL) Uses the "uname" system call to query kernel version information (possible evasion)

  • Backdoor:Linux/Mirai.A threat description - microsoft.com
    web:www.microsoft.com

    Microsoft Defender for Endpoint detects and removes this threat. This threat is a highly functional multi-component Internet of Things (IoT) malware primarily designed to allow remote attacker to take over and control affected device/s. The threat is also known as " MIRAI ". Find out ways that malware can get on your PC.

  • Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and ...
    web:www.ndss-symposium.org

    As over 87% of these devices reside in broadband networks, this task will fall primarily to consumers and the Internet Service Providers. We present the first empirical study of IoT malware cleanup in the wild -- more specifically, of removing Mirai infections in the network of a medium-sized ISP.

  • PDF Understanding the Mirai Botnet - USENIX
    web:www.usenix.org

    We confirm that Mirai targeted a variety of IoT and embedded devices ranging from DVRs, IP cameras, routers, and printers, but find Mirai's ultimate device composition was strongly influenced by the market shares and design decisions of a handful of consumer electronics manufacturers.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.