s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-cb0ec371a599291187e64f2e5f35c61f8423a30efe7af9e7831d612612ee3cd0 high

📛 Threat Title

Mirai: iran.armv7l

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 146264 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:41.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 cb0ec371a599291187e64f2e5f35c61f8423a30efe7af9e7831d612612ee3cd0 VT 26 / 75

IOC database

Type
hash_sha256
Value
cb0ec371a599291187e64f2e5f35c61f8423a30efe7af9e7831d612612ee3cd0
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Linux.Mirai.146264
Antiy-AVL malicious Trojan/Linux.Gafgyt
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-10056448-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.ERC
Microsoft malicious Trojan:Script/Wacatac.B!ml
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!EB43EC8BDB2F
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!EB43EC8BDB2F
Varist malicious E32/Gafgyt.C.gen!Camelot

Details From VirusTotal

Basic Properties
MD5eb43ec8bdb2fae0852344995451bed7b
SHA-10520ead3473e7ebc08faa4c11b54e94457eb9dd4
SHA-256cb0ec371a599291187e64f2e5f35c61f8423a30efe7af9e7831d612612ee3cd0
VHash16cfa1e0a33155f598010c1a754b7efd
SSDEEP3072:6nZpD+/4jw0P4GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWc7S0:6nZpD+/4jw0PpfvCazzQvCalfnIQc0r7
TLSHT1D5E30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
File size142.8 KB
History
First seen on VirusTotal2026-10-21 18:20 UTC
Last submission2026-10-21 18:20 UTC
Last analysis2026-10-21 18:20 UTC
Last modified on VirusTotal2026-10-21 20:31 UTC
Known Names
  • armv7l
  • iran.armv7l.elf
  • z8zdn.exe
  • iran.armv7l
hash_sha1 0520ead3473e7ebc08faa4c11b54e94457eb9dd4 VT 26 / 75

IOC database

Type
hash_sha1
Value
0520ead3473e7ebc08faa4c11b54e94457eb9dd4
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Linux.Mirai.146264
Antiy-AVL malicious Trojan/Linux.Gafgyt
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-10056448-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.ERC
Microsoft malicious Trojan:Script/Wacatac.B!ml
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!EB43EC8BDB2F
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!EB43EC8BDB2F
Varist malicious E32/Gafgyt.C.gen!Camelot

Details From VirusTotal

Basic Properties
MD5eb43ec8bdb2fae0852344995451bed7b
SHA-10520ead3473e7ebc08faa4c11b54e94457eb9dd4
SHA-256cb0ec371a599291187e64f2e5f35c61f8423a30efe7af9e7831d612612ee3cd0
VHash16cfa1e0a33155f598010c1a754b7efd
SSDEEP3072:6nZpD+/4jw0P4GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWc7S0:6nZpD+/4jw0PpfvCazzQvCalfnIQc0r7
TLSHT1D5E30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
File size142.8 KB
History
First seen on VirusTotal2026-10-21 18:20 UTC
Last submission2026-10-21 18:20 UTC
Last analysis2026-10-21 18:20 UTC
Last modified on VirusTotal2026-10-21 20:31 UTC
Known Names
  • armv7l
  • iran.armv7l.elf
  • z8zdn.exe
  • iran.armv7l
hash_md5 eb43ec8bdb2fae0852344995451bed7b VT 26 / 75

IOC database

Type
hash_md5
Value
eb43ec8bdb2fae0852344995451bed7b
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Linux.Mirai.146264
Antiy-AVL malicious Trojan/Linux.Gafgyt
Avast malicious ELF:Mirai-CYM [Trj]
AVG malicious ELF:Mirai-CYM [Trj]
Avira malicious EXP/ELF.Mirai.W
ClamAV malicious Unix.Trojan.Mirai-10056448-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.9874
ESET-NOD32 malicious Linux/Gafgyt.BST trojan
F-Secure malicious Exploit.EXP/ELF.Mirai.W
Fortinet malicious ELF/Gafgyt.LT!tr
GData malicious Linux.Trojan.Gafgyt.B
Google malicious Detected
huorong malicious Backdoor/Linux.Mirai.jx
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Agent.ei
Kingsoft malicious Script.Troj.Shell.2052936
McAfeeD malicious Trojan:Linux/Mirai.ERC
Microsoft malicious Trojan:Script/Wacatac.B!ml
Rising malicious Backdoor.Mirai/Linux!1.13313 (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
SentinelOne malicious Static AI - Malicious ELF
Skyhigh malicious LINUX/Mirai-FPL!EB43EC8BDB2F
Tencent malicious Backdoor.Linux.Gafgyt.mbxra
TrellixENS malicious LINUX/Mirai-FPL!EB43EC8BDB2F
Varist malicious E32/Gafgyt.C.gen!Camelot

Details From VirusTotal

Basic Properties
MD5eb43ec8bdb2fae0852344995451bed7b
SHA-10520ead3473e7ebc08faa4c11b54e94457eb9dd4
SHA-256cb0ec371a599291187e64f2e5f35c61f8423a30efe7af9e7831d612612ee3cd0
VHash16cfa1e0a33155f598010c1a754b7efd
SSDEEP3072:6nZpD+/4jw0P4GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWc7S0:6nZpD+/4jw0PpfvCazzQvCalfnIQc0r7
TLSHT1D5E30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
File size142.8 KB
History
First seen on VirusTotal2026-10-21 18:20 UTC
Last submission2026-10-21 18:20 UTC
Last analysis2026-10-21 18:20 UTC
Last modified on VirusTotal2026-10-21 20:31 UTC
Known Names
  • armv7l
  • iran.armv7l.elf
  • z8zdn.exe
  • iran.armv7l

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 146264 bytes. Tags: Mirai. Reporter: BlinkzSec. First seen: 2026-10-21 18:14:41.

Remediations (10)

  • Malware analysis armv7l Malicious activity - any.run
    web:any.run

    Online sandbox report for armv7l, tagged as auto, mirai , botnet, verdict: Malicious activity

  • Analysis iran.armv7l (MD5: 768A2164514F8499BA480B263428CAB5) Malicious ...
    web:app.any.run

    Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • iran.armv7l - Malicious Sample - Maltiverse
    web:maltiverse.com

    0 DNS Requests Score Hashes Filename: iran.armv7l md5: 3ba449cb1545b925ac2000f453b57d3d sha1: d985213aa7514ebef781407e7a612592741fee37 sha256: 98370a31aa0976e7291d5c5087a8c9770b2927e8c3399bc14a2402d01bc5839d

  • mirai | bin [.]armv7l | Triage™
    web:tria.ge

    Check this mirai report bin[.]armv7l, with a score of 10 out of 10.

  • mirai | armv7l [.]elf | Triage™
    web:tria.ge

    Check this mirai report armv7l[.]elf, with a score of 10 out of 10.

  • URLhaus | http://36.255.97.23/iran.armv7l
    web:urlhaus.abuse.ch

    The table below documents all payloads that URLhaus retrieved from this particular URL.

  • Linux Analysis Report iran.armv7l.elf - Joe Sandbox
    web:www.joesandbox.com

    Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Yara detected Mirai Drops files in suspicious directories Sample tries to set files in /etc globally writable Detected TCP or UDP traffic on non-standard ports Enumerates processes within the "proc" file system Found strings indicative of a multi-platform dropper Sample contains strings ...

  • Linux Analysis Report irannet.armv7l.elf - Joe Sandbox
    web:www.joesandbox.com

    Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices.

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2700 samples tracked, 27 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.