s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-ae15f86b545f844b49be7b684e48c72acaddad20b94a2dac2d2e709a5d9d6836 high

📛 Threat Title

Mirai: iran.armv5l

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 154360 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:38.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 ae15f86b545f844b49be7b684e48c72acaddad20b94a2dac2d2e709a5d9d6836 VT 33 / 75

IOC database

Type
hash_sha256
Value
ae15f86b545f844b49be7b684e48c72acaddad20b94a2dac2d2e709a5d9d6836
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 33 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
ALYac malicious Trojan.Generic.40596893
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Arcabit malicious Trojan.Generic.D26B759D
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
BitDefender malicious Trojan.Generic.40596893
ClamAV malicious Unix.Trojan.Mirai-10056448-0
CTX malicious elf.trojan.generic
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Elastic malicious Linux.Generic.Threat
Emsisoft malicious Trojan.Generic.40596893 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Linux.Bot
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Mirai.FO!MTB
MicroWorld-eScan malicious Trojan.Generic.40596893
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!705E90D98B23
Varist malicious E32/Mirai.EN.gen!Camelot
VIPRE malicious Trojan.Generic.40596893

Details From VirusTotal

Basic Properties
MD5705e90d98b23003b0e7ed811262412a7
SHA-13e606604a579ef0bb711c9b3c4eeb75ea2ed8956
SHA-256ae15f86b545f844b49be7b684e48c72acaddad20b94a2dac2d2e709a5d9d6836
VHash426177b03c790aee4e600a6d3ca1675e
SSDEEP3072:3OtstuCDxzd9TOBDZf9Qq94cZwiSXUtgKh8J7/8ZMEhoI:3+stuCDxzd9qFfDCcZwiAUtgKqJIZHhd
TLSHT100E30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
File size150.7 KB
History
First seen on VirusTotal2026-10-21 18:18 UTC
Last submission2026-10-21 18:18 UTC
Last analysis2026-10-21 19:07 UTC
Last modified on VirusTotal2026-10-21 21:09 UTC
Known Names
  • iran.armv5l
  • yjxlgs6ip.exe
  • armv5l
hash_sha1 3e606604a579ef0bb711c9b3c4eeb75ea2ed8956 VT 33 / 75

IOC database

Type
hash_sha1
Value
3e606604a579ef0bb711c9b3c4eeb75ea2ed8956
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 33 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
ALYac malicious Trojan.Generic.40596893
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Arcabit malicious Trojan.Generic.D26B759D
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
BitDefender malicious Trojan.Generic.40596893
ClamAV malicious Unix.Trojan.Mirai-10056448-0
CTX malicious elf.trojan.generic
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Elastic malicious Linux.Generic.Threat
Emsisoft malicious Trojan.Generic.40596893 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Linux.Bot
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Mirai.FO!MTB
MicroWorld-eScan malicious Trojan.Generic.40596893
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!705E90D98B23
Varist malicious E32/Mirai.EN.gen!Camelot
VIPRE malicious Trojan.Generic.40596893

Details From VirusTotal

Basic Properties
MD5705e90d98b23003b0e7ed811262412a7
SHA-13e606604a579ef0bb711c9b3c4eeb75ea2ed8956
SHA-256ae15f86b545f844b49be7b684e48c72acaddad20b94a2dac2d2e709a5d9d6836
VHash426177b03c790aee4e600a6d3ca1675e
SSDEEP3072:3OtstuCDxzd9TOBDZf9Qq94cZwiSXUtgKh8J7/8ZMEhoI:3+stuCDxzd9qFfDCcZwiAUtgKqJIZHhd
TLSHT100E30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
File size150.7 KB
History
First seen on VirusTotal2026-10-21 18:18 UTC
Last submission2026-10-21 18:18 UTC
Last analysis2026-10-21 19:07 UTC
Last modified on VirusTotal2026-10-21 21:09 UTC
Known Names
  • iran.armv5l
  • yjxlgs6ip.exe
  • armv5l
hash_md5 705e90d98b23003b0e7ed811262412a7 VT 33 / 75

IOC database

Type
hash_md5
Value
705e90d98b23003b0e7ed811262412a7
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 33 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Linux.iran.SE356
ALYac malicious Trojan.Generic.40596893
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Arcabit malicious Trojan.Generic.D26B759D
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
BitDefender malicious Trojan.Generic.40596893
ClamAV malicious Unix.Trojan.Mirai-10056448-0
CTX malicious elf.trojan.generic
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
Elastic malicious Linux.Generic.Threat
Emsisoft malicious Trojan.Generic.40596893 (B)
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Linux.Bot
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Mirai.FO!MTB
MicroWorld-eScan malicious Trojan.Generic.40596893
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Sophos malicious Mal/Generic-S
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!705E90D98B23
Varist malicious E32/Mirai.EN.gen!Camelot
VIPRE malicious Trojan.Generic.40596893

Details From VirusTotal

Basic Properties
MD5705e90d98b23003b0e7ed811262412a7
SHA-13e606604a579ef0bb711c9b3c4eeb75ea2ed8956
SHA-256ae15f86b545f844b49be7b684e48c72acaddad20b94a2dac2d2e709a5d9d6836
VHash426177b03c790aee4e600a6d3ca1675e
SSDEEP3072:3OtstuCDxzd9TOBDZf9Qq94cZwiSXUtgKh8J7/8ZMEhoI:3+stuCDxzd9qFfDCcZwiAUtgKqJIZHhd
TLSHT100E30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
File size150.7 KB
History
First seen on VirusTotal2026-10-21 18:18 UTC
Last submission2026-10-21 18:18 UTC
Last analysis2026-10-21 19:07 UTC
Last modified on VirusTotal2026-10-21 21:09 UTC
Known Names
  • iran.armv5l
  • yjxlgs6ip.exe
  • armv5l

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 154360 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:38.

Remediations (10)

  • Malware analysis armv5l Malicious activity - any.run
    web:any.run

    Online sandbox report for armv5l, tagged as auto, mirai , botnet, verdict: Malicious activity

  • Mirai-Botnet-Static-Analysis - GitHub
    web:github.com

    Mirai is a self-propagating botnet malware designed to infect Linux-based Internet of Things (IoT) devices. It targets vulnerable smart devices to recruit them into a botnet network for launching massive Distributed Denial of Service (DDoS) attacks. This analysis focuses on uncovering the binary structure, embedded strings, network dependencies, and internal tactical functions without ...

  • Mirai Source Code - GitHub
    web:github.com

    Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. This repo is a fork of the original leaked source code and includes components such as: The bot (runs on IoT devices) The CnC server The loader (infects devices ...

  • iran.armv5l - Malicious Sample - Maltiverse
    web:maltiverse.com

    Hashes Filename: iran.armv5l md5: bc162ed909c21c628fd395c2e13480e2 sha1: a2514bb7c729e9b3e8d2387b8ffbb7887cac7384 sha256: d49640c8ff3ab2bc8654447d6b7dd0bc8af450e4b36cb1d7fc1ef5eb0fe77c68 sha512: In depth details Filetype: Architecture: Compiler: Size (Bytes): Classification: malicious Mutex mutex: Dates Indexed: 2026-03-06 15:16:41 (2026-03-06 ...

  • ThreatFox | http://103.83.87.122/iran.armv5l
    web:threatfox.abuse.ch

    Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers

  • mirai | armv5l | Triage™
    web:tria.ge

    Check this mirai report armv5l, with a score of 10 out of 10.

  • URLhaus | http://31.59.104.25/iran.armv5l
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • URLhaus | http://74.81.40.155/iran.armv5l
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • Linux Analysis Report iran.armv5l.elf
    web:www.joesandbox.com

    Signatures Found malware configuration Multi AV Scanner detection for submitted file Yara detected Gafgyt Yara detected Mirai Sample deletes itself Detected TCP or UDP traffic on non-standard ports Enumerates processes within the "proc" file system Found strings indicative of a multi-platform dropper Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single ...

  • Linux Analysis Report iran.armv5l.elf
    web:www.joesandbox.com

    Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.