MB-0b363625c8bcc65552bde9e9c721b16f0f67b126ec92bdd2680d6b3791c841c2
high
📛 Threat Title
Mirai: iran.arc
Description
File type: elf. Size: 157332 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:39.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
0b363625c8bcc65552bde9e9c721b16f0f67b126ec92bdd2680d6b3791c841c2
VT 35 / 75
IOC database
- Type
- hash_sha256
- Value
0b363625c8bcc65552bde9e9c721b16f0f67b126ec92bdd2680d6b3791c841c2- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 35 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| AhnLab-V3 | malicious | Backdoor/Linux.iran.SE356 |
| alibabacloud | malicious | DDoS:Linux/Mirai |
| ALYac | malicious | Trojan.Generic.40424268 |
| Antiy-AVL | malicious | Trojan[Backdoor]/Linux.Mirai |
| Arcabit | malicious | Trojan.Generic.D268D34C |
| Avast | malicious | ELF:Mirai-CSC [Trj] |
| AVG | malicious | ELF:Mirai-CSC [Trj] |
| Avira | malicious | EXP/ELF.Mirai.W |
| BitDefender | malicious | Trojan.Generic.40424268 |
| ClamAV | malicious | Unix.Trojan.Mirai-10056448-0 |
| CTX | malicious | elf.trojan.generic |
| Cynet | malicious | Malicious (score: 99) |
| DrWeb | malicious | Linux.Mirai.9874 |
| Emsisoft | malicious | Trojan.Generic.40424268 (B) |
| ESET-NOD32 | malicious | Linux/Mirai.EQT trojan |
| F-Secure | malicious | Exploit.EXP/ELF.Mirai.W |
| Fortinet | malicious | ELF/Gafgyt.LT!tr |
| GData | malicious | Linux.Trojan.Gafgyt.B |
| malicious | Detected |
|
| huorong | malicious | Backdoor/Linux.Mirai.jx |
| Ikarus | malicious | Backdoor.Linux.Mirai |
| Kaspersky | malicious | HEUR:Backdoor.Linux.Agent.ei |
| Kingsoft | malicious | Script.Troj.Shell.2052936 |
| McAfeeD | malicious | Trojan:Linux/Mirai.EKD |
| Microsoft | malicious | Backdoor:Linux/Mirai.GS!MTB |
| MicroWorld-eScan | malicious | Trojan.Generic.40424268 |
| Rising | malicious | Backdoor.Mirai/Linux!1.13313 (CLASSIC) |
| Sangfor | malicious | Suspicious.Linux.Save.a |
| SentinelOne | malicious | Static AI - Malicious ELF |
| Skyhigh | malicious | LINUX/Mirai-FPL!186E5061E240 |
| Sophos | malicious | Mal/Generic-S |
| Tencent | malicious | Backdoor.Linux.Gafgyt.mbxra |
| TrellixENS | malicious | LINUX/Mirai-FPL!186E5061E240 |
| Varist | malicious | E32/Gafgyt.C.gen!Camelot |
| VIPRE | malicious | Trojan.Generic.40424268 |
Details From VirusTotal
Basic Properties
| MD5 | 186e5061e2403450b72ffde54bf48f76 |
| SHA-1 | fd0cc2ccbed0110f8990cd895cd5af6210699d4e |
| SHA-256 | 0b363625c8bcc65552bde9e9c721b16f0f67b126ec92bdd2680d6b3791c841c2 |
| VHash | 869444bd87201b6e689a30d0d504c423 |
| SSDEEP | 3072:Xxv5yfUhfN8RtoZnGhTNLhs7LTT+RCQX3XqbpygZCBrWOG4u53Vq:XpEfUhfW3oMJLi7L+B3a9FCBrY4qVq |
| TLSH | T130F3AF67B34B5050C4E44AF41BCF5BAD292721008E7B99E77C6E723A6A775CB28073E1 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 32-bit LSB executable, Synopsys ARCompact ARC700 cores, version 1 (SYSV), statically linked, stripped |
| File size | 153.6 KB |
History
| First seen on VirusTotal | 2026-10-21 18:28 UTC |
| Last submission | 2026-10-21 18:28 UTC |
| Last analysis | 2026-10-21 18:28 UTC |
| Last modified on VirusTotal | 2026-10-21 20:28 UTC |
Known Names
r0a1am.exearciran.arc
hash_sha1
fd0cc2ccbed0110f8990cd895cd5af6210699d4e
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/fd0cc2ccbed0110f8990cd895cd5af6210699d4e
IOC database
- Type
- hash_sha1
- Value
fd0cc2ccbed0110f8990cd895cd5af6210699d4e- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/fd0cc2ccbed0110f8990cd895cd5af6210699d4e
hash_md5
186e5061e2403450b72ffde54bf48f76
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/186e5061e2403450b72ffde54bf48f76
IOC database
- Type
- hash_md5
- Value
186e5061e2403450b72ffde54bf48f76- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/186e5061e2403450b72ffde54bf48f76
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 157332 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:39.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:dailysecurityreview.com
The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:www.cisecurity.org
Security leaders must give equal weight to the cyber dimension following U.S.-Israeli kinetic activity against Iran. Here's our recommendations.
-
web:www.globalsecurity.org
A cautious inventory of the nuclear-adjacent rhetoric attributed to President Trump during the 2026 Iran war, from the 7 April 'civilization will die' ultimatum to the 21 April Vietnam remark.
-
web:www.jisem-journal.com
Table 1 from Imperva's DDoS attacks report, shows the top countries of origin of Mirai DDoS attacks. At this time Mirai malware is having a low antivirus detection ratio, even in the architecture of x86. With the free software avsubmit.py create by Michael Ligh is possible to analyses a file using the VirusTotal engine from the command line.
-
web:www.joesandbox.com
Automated Malware Analysis - Joe Sandbox Analysis Report Ransomware Spreading Phishing Banker Trojan / Bot Adware Spyware Exploiter Evader Miner clean suspicious malicious
-
web:www.joesandbox.com
Executes the "rm" command used to delete files or directories
-
web:www.joesandbox.com
Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.