{ "type": "MD5", "indicator": "4d2e0dcc1b2e9cafe0ed5d68e2bd94de", "general": { "sections": [ "general", "analysis" ], "type": "md5", "type_title": "FileHash-MD5", "indicator": "4d2e0dcc1b2e9cafe0ed5d68e2bd94de", "validation": [], "base_indicator": { "id": 4057300784, "indicator": "787d67ebdca4e1832b23d703284c1e033e226757f272bc5320d4907683f40f94", "type": "FileHash-SHA256", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "684a648dc8f4d7aa1e1e8588", "name": "Mirai", "description": "9e351f4e01814f3211b5a32c38c1d157ceb8204be79502f26e3e527453a073d9", "modified": "2026-02-04T01:02:11.629000", "created": "2025-06-12T05:24:29.102000", "tags": [ "Mirai" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "DDoS:Linux/Gafgyt.YA!MTB", "display_name": "DDoS:Linux/Gafgyt.YA!MTB", "target": "/malware/DDoS:Linux/Gafgyt.YA!MTB" } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 200, "FileHash-SHA1": 200, "FileHash-SHA256": 1000 }, "indicator_count": 1400, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "FileHash-SHA256", "related_indicator_is_active": 1 }, { "id": "6819c4e061801b38a9d9de26", "name": "[GS-25-16106] Mirai Botnet IOCs - SEC-1275-1", "description": "The Mirai botnet, a malicious software designed to disrupt the internet, has been reported to the Court of Arbitration for Sport (CAS) in London, but what does this mean?", "modified": "2025-06-05T08:03:40.910000", "created": "2025-05-06T08:14:24.055000", "tags": [ "mirai botnet", "iocs", "mirai", "linux", "botnet mirai", "botnet iocs", "gs2519125", "gs25181222", "gs2518122", "gs2518120", "twitter" ], "references": [ "https://1275.ru/ioc/gs-25-16106-mirai-botnet-iocs_10448", "https://1275.ru/ioc/gs-25-16105-mirai-botnet-iocs_10442", "https://1275.ru/ioc/gs-25-16104-mirai-botnet-iocs_10418", "https://1275.ru/ioc/gs-25-15101-mirai-botnet-iocs_10391", "https://1275.ru/ioc/gs-25-15100-mirai-botnet-iocs_10375" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Gnostis", "id": "44738", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_44738/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 806, "FileHash-SHA1": 806, "FileHash-SHA256": 806, "URL": 11, "hostname": 6, "domain": 7 }, "indicator_count": 2442, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "359 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "FileHash-SHA1", "related_indicator_is_active": 1 }, { "id": "673070cd09c88011db534ea0", "name": "MalwareBazaar Recent Additions", "description": "", "modified": "2025-05-15T11:08:58.764000", "created": "2024-11-10T08:37:33.473000", "tags": [], "references": [ "https://bazaar.abuse.ch/export/csv/recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 39, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 85650 }, "indicator_count": 85650, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "380 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "FileHash-SHA256", "related_indicator_is_active": 1 }, { "id": "681bf4a692b47e56e45b7df1", "name": "ACTIVIDAD MALICIOSA | Relacionada con Mirai 07-05-2024", "description": "Mirai fue una botnet, una red de dispositivos conectados a internet, que se utiliz\u00f3 para llevar a cabo ataques masivos y disruptivos. Su principal enfoque estaba en dispositivos de Internet de las cosas (IoT), como c\u00e1maras de seguridad y enrutadores, que a menudo ten\u00edan contrase\u00f1as d\u00e9biles o predeterminadas. Mirai escaneaba la web en busca de estos dispositivos vulnerables y los incorporaba a su red, creando as\u00ed un ej\u00e9rcito de bots. Luego, los hackers que controlaban Mirai pod\u00edan utilizar esta red para lanzar ataques de denegaci\u00f3n de servicio distribuidos (DDoS), los cuales abrumaban los servidores y causaban interrupciones en servicios en l\u00ednea, sitios web y plataformas. Este incidente resalt\u00f3 la importancia de asegurar adecuadamente los dispositivos IoT para prevenir el abuso de botnets como Mirai.", "modified": "2025-05-08T00:02:46.191000", "created": "2025-05-08T00:02:46.191000", "tags": [ "ta0001", "ta0007", "ta0011", "command", "control", "ta0040", "t1010", "t1190", "exploit", "t1498", "service" ], "references": [ "https://darfe.es/ciberwiki/index.php?title=Mirai", "https://www.virustotal.com/graph/embed/g11570a1d01cb42d5aa0107b31f2874f9b269cb3939db45879748f1b89b2f7ba5?theme=light" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" }, { "id": "T1595", "name": "Active Scanning", "display_name": "T1595 - Active Scanning" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "esoporteingenieria2020", "id": "121604", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_121604/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5248, "FileHash-SHA1": 5248, "FileHash-SHA256": 5248 }, "indicator_count": 15744, "is_author": false, "is_subscribing": null, "subscriber_count": 268, "modified_text": "388 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "FileHash-SHA1", "related_indicator_is_active": 1 } ], "references": [ "https://1275.ru/ioc/gs-25-16106-mirai-botnet-iocs_10448", "https://1275.ru/ioc/gs-25-15100-mirai-botnet-iocs_10375", "https://bazaar.abuse.ch/export/csv/recent/", "https://www.virustotal.com/graph/embed/g11570a1d01cb42d5aa0107b31f2874f9b269cb3939db45879748f1b89b2f7ba5?theme=light", "https://darfe.es/ciberwiki/index.php?title=Mirai", "https://1275.ru/ioc/gs-25-16104-mirai-botnet-iocs_10418", "https://1275.ru/ioc/gs-25-15101-mirai-botnet-iocs_10391", "https://1275.ru/ioc/gs-25-16105-mirai-botnet-iocs_10442" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Mirai", "Ddos:linux/gafgyt.ya!mtb" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "684a648dc8f4d7aa1e1e8588", "name": "Mirai", "description": "9e351f4e01814f3211b5a32c38c1d157ceb8204be79502f26e3e527453a073d9", "modified": "2026-02-04T01:02:11.629000", "created": "2025-06-12T05:24:29.102000", "tags": [ "Mirai" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "DDoS:Linux/Gafgyt.YA!MTB", "display_name": "DDoS:Linux/Gafgyt.YA!MTB", "target": "/malware/DDoS:Linux/Gafgyt.YA!MTB" } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 200, "FileHash-SHA1": 200, "FileHash-SHA256": 1000 }, "indicator_count": 1400, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "FileHash-SHA256", "related_indicator_is_active": 1 }, { "id": "6819c4e061801b38a9d9de26", "name": "[GS-25-16106] Mirai Botnet IOCs - SEC-1275-1", "description": "The Mirai botnet, a malicious software designed to disrupt the internet, has been reported to the Court of Arbitration for Sport (CAS) in London, but what does this mean?", "modified": "2025-06-05T08:03:40.910000", "created": "2025-05-06T08:14:24.055000", "tags": [ "mirai botnet", "iocs", "mirai", "linux", "botnet mirai", "botnet iocs", "gs2519125", "gs25181222", "gs2518122", "gs2518120", "twitter" ], "references": [ "https://1275.ru/ioc/gs-25-16106-mirai-botnet-iocs_10448", "https://1275.ru/ioc/gs-25-16105-mirai-botnet-iocs_10442", "https://1275.ru/ioc/gs-25-16104-mirai-botnet-iocs_10418", "https://1275.ru/ioc/gs-25-15101-mirai-botnet-iocs_10391", "https://1275.ru/ioc/gs-25-15100-mirai-botnet-iocs_10375" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Gnostis", "id": "44738", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_44738/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 806, "FileHash-SHA1": 806, "FileHash-SHA256": 806, "URL": 11, "hostname": 6, "domain": 7 }, "indicator_count": 2442, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "359 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "FileHash-SHA1", "related_indicator_is_active": 1 }, { "id": "673070cd09c88011db534ea0", "name": "MalwareBazaar Recent Additions", "description": "", "modified": "2025-05-15T11:08:58.764000", "created": "2024-11-10T08:37:33.473000", "tags": [], "references": [ "https://bazaar.abuse.ch/export/csv/recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 39, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 85650 }, "indicator_count": 85650, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "380 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "FileHash-SHA256", "related_indicator_is_active": 1 }, { "id": "681bf4a692b47e56e45b7df1", "name": "ACTIVIDAD MALICIOSA | Relacionada con Mirai 07-05-2024", "description": "Mirai fue una botnet, una red de dispositivos conectados a internet, que se utiliz\u00f3 para llevar a cabo ataques masivos y disruptivos. Su principal enfoque estaba en dispositivos de Internet de las cosas (IoT), como c\u00e1maras de seguridad y enrutadores, que a menudo ten\u00edan contrase\u00f1as d\u00e9biles o predeterminadas. Mirai escaneaba la web en busca de estos dispositivos vulnerables y los incorporaba a su red, creando as\u00ed un ej\u00e9rcito de bots. Luego, los hackers que controlaban Mirai pod\u00edan utilizar esta red para lanzar ataques de denegaci\u00f3n de servicio distribuidos (DDoS), los cuales abrumaban los servidores y causaban interrupciones en servicios en l\u00ednea, sitios web y plataformas. Este incidente resalt\u00f3 la importancia de asegurar adecuadamente los dispositivos IoT para prevenir el abuso de botnets como Mirai.", "modified": "2025-05-08T00:02:46.191000", "created": "2025-05-08T00:02:46.191000", "tags": [ "ta0001", "ta0007", "ta0011", "command", "control", "ta0040", "t1010", "t1190", "exploit", "t1498", "service" ], "references": [ "https://darfe.es/ciberwiki/index.php?title=Mirai", "https://www.virustotal.com/graph/embed/g11570a1d01cb42d5aa0107b31f2874f9b269cb3939db45879748f1b89b2f7ba5?theme=light" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "display_name": "T1190 - Exploit Public-Facing Application" }, { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" }, { "id": "T1595", "name": "Active Scanning", "display_name": "T1595 - Active Scanning" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "esoporteingenieria2020", "id": "121604", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_121604/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5248, "FileHash-SHA1": 5248, "FileHash-SHA256": 5248 }, "indicator_count": 15744, "is_author": false, "is_subscribing": null, "subscriber_count": 268, "modified_text": "388 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "FileHash-SHA1", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "4d2e0dcc1b2e9cafe0ed5d68e2bd94de", "type": "Hash" }, "abuseipdb": null, "urlhaus": { "indicator": "4d2e0dcc1b2e9cafe0ed5d68e2bd94de", "found": true, "verdict": "malicious", "file_type": "elf", "file_size": "58828", "md5": "4d2e0dcc1b2e9cafe0ed5d68e2bd94de", "sha256": "787d67ebdca4e1832b23d703284c1e033e226757f272bc5320d4907683f40f94", "signature": "Mirai", "first_seen": "2025-04-13", "last_seen": "2025-04-17", "url_count": "13", "urls": [ { "url": "http://comwebdisk.webprocediweb.com/resgod.arc", "status": "offline", "threat": "", "date_added": "", "tags": [] }, { "url": "http://eversioneweb.com/resgod.arc", "status": "offline", "threat": "", "date_added": "", "tags": [] }, { "url": "http://continueoraweb.com/resgod.arc", "status": "offline", "threat": "", "date_added": "", "tags": [] }, { "url": "http://ora-0-web.com/resgod.arc", "status": "offline", "threat": "", "date_added": "", "tags": [] }, { "url": "http://104.168.101.27/resgod.arc", "status": "offline", "threat": "", "date_added": "", "tags": [] } ], "error": null }, "from_cache": true, "_cached_at": 1780212929.1020858 }