Skip to main content

Mirai

Malware Family

168 829 indicators of compromise attributed to Mirai across abuse.ch threat intelligence feeds.

Domains

197

IPs

489

URLs

173

Hashes

167 970

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (197)IPs (489)URLs (173)Hashes (167 970)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
reavercncv3.duckdns.orgdomain
kappadocia.netdomain
aaronweintraubfromcogent.comdomain
b.9-9-8.comdomain
net.booter.prodomain
voltagec2.techdomain
iloveboats.stdomain
zeero.skindomain
dcuyypjhxgjppihi.kozow.comdomain
uhadenozoowgoxokqgjvctlehtjmhwyocirfrjcg.duckdns.orgdomain
mobile.runds.duckdns.orgdomain
cc.xbqpdj.vipdomain
mirai.k4ss.loldomain
firmwareupdatechecksdoidv2627.buzzdomain
1.kurama.ltddomain
thespacemachines.stdomain
bd.p0p3w4sh3r3.boatsdomain
epsteinrapeniggers.duckdns.orgdomain
manbipll.duckdns.orgdomain
test.txtensatorxgyt.xyzdomain
69.33.213.199ip
176.65.139.154ip
144.172.105.56ip
154.222.16.141ip
109.123.211.81ip
104.64.0.199ip
147.45.50.108ip
217.217.243.76ip
89.32.41.50ip
194.48.251.116ip
103.54.153.177ip
36.90.147.144ip
104.143.206.116ip
185.231.155.250ip
5.230.170.237ip
101.99.95.124ip
107.151.233.216ip
176.65.139.202ip
121.45.148.201ip
153.117.33.140ip
http://178.16.53.91:8443/?h=178.16.53.91&p=8443&t=ws&a=l32&stage=trueurl
http://45.198.224.34/0upppcurl
http://103.83.87.122/iran.mipselurl
http://103.83.87.122/iran.armv4lurl
http://boatbeach.online/main_mipsurl
http://77.90.185.66/mirai.mpslurl
http://37.44.215.118/bins/sora.arm7url
http://89.32.41.16/bins/kla.shurl
http://47.239.127.71/lib/xxxurl
http://110.37.76.236:59516/Mozi.murl
http://89.32.41.16/bins/pmipsurl
http://5.182.210.174/d95abburl
http://103.83.87.122/iran.x86_64url
http://nova.podril1ak2.online/bins/nova.i686url
http://nova.podril1ak2.online/nova.shurl
http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=l32&stage=trueurl
http://119.165.235.139:57919/iurl
http://213.232.114.14/handshakebins.shurl
http://420mafia.eu/ar-15/ar15.arcurl
http://94.154.43.88/ohshit.shurl

Another file to check? Run a file hash reputation check.