AI
Mirai IoT botnet malware
Local reference
Suspicious dependency
Inferred
Static ARM Mirai IoT bot with watchdog and procfs control surface: upx@0
Watchdog-backed process killer: upx@0
Static ARM IoT bot with procfs control service: upx@0
| 0x0 | 7f454c46010101030000000000000000 | .ELF............ |
| 0x10 | 0200280001000000904b010034000000 | ..(......K..4... |
| 0x20 | 00000000020000043400200003002800 | ........4. ...(. |
| 0x30 | 00000000010000000000000000800000 | ................ |
| 0x40 | 008000007ddd00007ddd000005000000 | ....}...}....... |
| 0x50 | 0080000001000000586c0000586c0300 | ........Xl..Xl.. |
| 0x60 | 586c0300000000000000000006000000 | Xl.............. |
| 0x70 | 0080000051e574640000000000000000 | ....Q.td........ |
| 0x80 | 00000000000000000000000007000000 | ................ |
| 0x90 | 04000000bff794615550582108120d17 | .......aUPX!.... |
| 0xa0 | 000000009636030096360300d4000000 | .....6...6...... |
| 0xb0 | 6b0000000e0000001a03003f91458468 | k..........?.E.h |
| 0xc0 | 3bdedea60f23f0d42419aa166ff9c8c3 | ;....#..$...o... |
| 0xd0 | e90fd03dd5af393f22484c6f9a08187f | ...=..9?"HLo.... |
| 0xe0 | 28c4ed8f77c8fcdd993121bd6a9aa59b | (...w....1!.j... |
| 0xf0 | f215b8b7af8ccc2200c656c44bddc67a | ......."..V.K..z |
| 0x100 | f407f240e6dbb7c8fa969ae85c91eef8 | ...@........\... |
| 0x110 | 89832c6edf434194f0b8234101576731 | ..,n.CA...#A.Wg1 |
| 0x120 | 18c10018350200a9c800000e5000001a | ....5.......P... |
| 0x130 | 030006b08f6da701aa74154fe8261165 | .....m...t.O.&.e |
| 0x140 | f9d1f7b741f5f3f685479b246f50d981 | ....A....G.$oP.. |
| 0x8614 | 9847e0e3049f0dfe4c1e88b818453377 | .G......L....E3w |
| 0x8624 | 725153d24c418745778c0d794318999f | rQS.LA.Ew..yC... |
| 0x8634 | f4fc8e5aa56e1a3cf69b7ec073f24dd7 | ...Z.n.<..~.s.M. |
| 0x8644 | 385cb7e1cd205466f97a131edd8821eb | 8\... Tf.z....!. |
| 0x8654 | 0de68738507350f384f0ffb4e3a7c32f | ...8PsP......../ |
| 0x8664 | 13bf201e032c4343fcfc364c77652e80 | .. ..,CC..6Lwe.. |
| 0x8674 | 929049cdf2a326bf2a280e0d681c7088 | ..I...&.*(..h.p. |
| 0x8684 | 0ed232599b75cd91f3cdaaf89ada6ea4 | ..2Y.u........n. |
| 0x8694 | 6c1792daf7d833f000fb30bb7563313d | l.....3...0.uc1= |
| 0x86a4 | 29327c9f7968d6aec2dd991ac764e879 | )2|.yh.......d.y |
| 0x86b4 | 3aec00594e4d0289ce308f57fe7791df | :..YNM...0.W.w.. |
| 0x86c4 | 9fa1224f5770d6c2aada217785a6cb42 | .."OWp....!w...B |
| 0x86d4 | be3066899c1d97b3d9c7e1887be1d6d4 | .0f.........{... |
| 0x86e4 | 01623008fe02c7ec47ac98c0a477f8b9 | .b0.....G....w.. |
| 0x86f4 | 8b3832e9322f64daf6c67d07d3ace166 | .82.2/d...}....f |
| 0x8704 | 0fa6c51fee933974d4ea7b11de1a3494 | ......9t..{...4. |
| 0x8714 | a92634ddae28370c9184f64cf87ff609 | .&4..(7....L.... |
| 0x8724 | 71f2d9fab0e7a389f653a05b566e35c8 | q........S.[Vn5. |
| 0x8734 | b622a5ef1c46bc755e1e76 | ."...F.u^.v |
| 0xd644 | 0e3060e00000a0e3003081e500b082e5 | .0`......0...... |
| 0xd654 | 000000ea0100a0e330d08de2f08fbde8 | ........0....... |
| 0xd664 | 1e20a0e314108fe20200a0e30470a0e3 | . ...........p.. |
| 0xd674 | 000000ef7f00a0e30170a0e3000000ef | .........p...... |
| 0xd684 | 50524f545f455845437c50524f545f57 | PROT_EXEC|PROT_W |
| 0xd694 | 52495445206661696c65642e0a000a00 | RITE failed..... |
| 0xd6a4 | 24496e666f3a20546869732066696c65 | $Info: This file |
| 0xd6b4 | 206973207061636b6564207769746820 | is packed with |
| 0xd6c4 | 74686520555058206578656375746162 | the UPX executab |
| 0xd6d4 | 6c65207061636b657220687474703a2f | le packer http:/ |
| 0xd6e4 | 2f7570782e73662e6e657420240a0024 | /upx.sf.net $..$ |
| 0xd6f4 | 49643a2055505820332e393420436f70 | Id: UPX 3.94 Cop |
| 0xd704 | 7972696768742028432920313939362d | yright (C) 1996- |
| 0xd714 | 32303137207468652055505820546561 | 2017 the UPX Tea |
| 0xd724 | 6d2e20416c6c20526967687473205265 | m. All Rights Re |
| 0xd734 | 7365727665642e20240a0000140a0000 | served. $....... |
| 0xd744 | 310600000e5000001a03006c02532c94 | 1....P.....l.S,. |
| 0xd754 | baec25f53a9b4c11aae5b73e2b3b06aa | ..%.:.L....>+;.. |
| 0xd764 | 00726d4a16f70b86f882356e39239582 | .rmJ......5n9#.. |
| 0xd774 | ee8c5d3d3229a6 | ..]=2). |
Loading traits…
Identity
| SHA-256 | 131c71f16cb132c6258ddae86b6e21aca7c07b3cf50b1d2efb66ecb55af78fee |
|---|---|
| Filename | nz.arm7 |
| Package | 131c71f16cb132c6258ddae86b6e21aca7c07b3cf50b1d2efb66ecb55af78fee |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | linux |
| Domain | abuse.ch |
Timeline
| First seen | 3 Aug 2026 22:02 UTC |
|---|---|
| First analyzed | 5 Aug 2026 11:28 UTC |
| Last analyzed | 5 Aug 2026 11:28 UTC |
| Last updated | 5 Aug 2026 11:28 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | b5ca8 |
Not seeing what you expected? Let us know