Skip to main content

Mirai

Malware Family

166 532 indicators of compromise attributed to Mirai across abuse.ch threat intelligence feeds.

Domains

193

IPs

428

URLs

152

Hashes

165 759

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (193)IPs (428)URLs (152)Hashes (165 759)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
bigyahu.fansdomain
jkqhdbbbqwiujkaz.hopto.orgdomain
kys.botdealers.stdomain
kamru.sudomain
foreskin.ccdomain
musika.botlesscucks.stdomain
rolex22.duckdns.orgdomain
hjcddajltcsdas.hopto.orgdomain
download.logltech.workers.devdomain
stoplooking.botlesscucks.stdomain
iloveboats.stdomain
c2.saintpetersburgresident.rudomain
sopa1805.duckdns.orgdomain
cc.xbqpdj.vipdomain
69sexy.duckdns.orgdomain
mirai.k4ss.loldomain
gooning.stdomain
chanbomaydi.devs.surfdomain
oonpczqujhsboufx.loseyourip.comdomain
bd.p0p3w4sh3r3.boatsdomain
172.104.49.49ip
45.39.33.92ip
176.65.139.8ip
176.65.148.145ip
77.239.124.123ip
91.108.243.146ip
141.98.10.61ip
45.135.194.70ip
31.56.209.8ip
2.27.203.59ip
45.131.108.107ip
46.203.233.163ip
160.250.181.124ip
154.222.16.160ip
162.249.125.140ip
217.60.195.187ip
179.43.182.70ip
176.65.139.202ip
5.230.170.238ip
31.77.227.102ip
http://196.251.121.142/a3f8d2/kaizen.mpslurl
http://176.65.139.151/Sakura.shurl
http://176.65.139.206/hiddenbin/Space.arm7url
http://nova.podril1ak2.online/bins/nova.i586url
http://boatbeach.online/main_sh4url
http://45.148.10.210/blackbihurl
http://139.95.24.51:8081/?h=139.95.24.51&p=8081&t=ws&a=l32&stage=trueurl
http://89.34.227.96:8088/?h=89.34.227.96&p=8088&t=ws&a=l64&stage=trueurl
http://77.90.185.66/mirai.arm5url
http://nova.podril1ak2.online/bins/nova.armv5lurl
http://37.44.215.118/bins/sora.arm7url
http://api.ddenv.site/arm6url
http://91.92.47.97/bins/wget.shurl
http://loveher.dpdns.orgurl
http://103.79.185.121/7891.shurl
http://api.ddenv.site/arm5url
http://nova.podril1ak2.online/bins/nova.i686url
http://78.153.140.16/d.shurl
http://213.232.114.14/handshakebins.shurl
http://103.83.87.122/iran.sparcurl

Another file to check? Run a file hash reputation check.