SHA256MediumSignal 96/100
1e74bcd24e30947bd14cef6731ca63f69df060ba3dcac88b2321171335a6e8ef
First Seen
Dec 29, 2024
Last Seen
May 21, 2026
Found in 8 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
96%
Signal Score
96 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Feed Intelligence Summary
8 reports96% confidence
8
Source reports
96%
Confidence score
Category tags
abuseactive scanactive scanningakamai sirtalienvault_ransomwareaquabotaquabotv3armbad reputationbitcoin addressbitcoinaddressbotnetbotnet activitybotnet c2brute forcebuffer overflowc&c communicationc2 domaincommand & controlcommand and controlcommand injectioncommunication protocolconnected devicescopy snortcredential harvestingcredential stuffingcrypto cybercryptocurrencycyber threatdata encryptiondata exfiltrationdata store exposureddosddos attacksdefencedetect-debug-environmentdevice managementdistributed attacksdomaindomainsdust specterelfencryptionexecutable fileexploitexploitation activityextortionfile-hashgentlemen ransomwareidentity & access exploitationindicatorindustrial iotinfrastructure acquisitionreconnaissanceinitial accessinjection activityinternet of thingsiocsiotiot analyticsiot applicationsiot botnetiot platformsiot securityiot/ics attackips alertlinuxmalicious softwaremalwaremiraimirai botnetmitelmoonrise ratn8nnetwork scanningnetwork securitynoescapephishingphishing attackprocess injectionransom houseransomwareratrcereconnaissanceresearchedruby jumperself-deletesmart devicessnortsocial engineeringsystem disruptiont1021.001t1027t1040t1053.005t1055t1059.004t1068t1071.001t1078t1105t1110t1190t1202t1486t1490t1496t1497t1498t1499.002t1499.003t1550.002t1562.001t1565t1566.001t1566.002t1566.003t1587.001t1588.005t1590.001t1595t1595.001t1595.002t1595.003telecommunicationstenda ac1206threat actortimetor nodevoipvulnerability scanyarazerobot
Activity Timeline
May 21May 21
Threat Activity Heatmap
· Peak: 2026-05-21LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
96
SIGNAL
Signal Score
96%
Confidence
8
Reports
First seenDec 29, 2024
Last seenMay 21, 2026
VirusTotal
Not checked
WHOIS
- description
- ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
- references
- IOCs.2026.2.csv, https://www.akamai.com/blog/security-research/new-aquabot-mirai-variant-exploiting-mitel-phones, https://threatfox.abuse.ch/export/csv/recent/, https://bazaar.abuse.ch/export/csv/recent/, https://www.akamai.com/blog/security-research/2025-january-new-aquabot-mirai-variant-exploiting-mitel-phones#iocs
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 20 days ago
Appeared in 8 threat reports