>samit_hota
Back to IOCs
G013948 indicators

Mirai — Indicators of Compromise

Samit Hota·
#ioc#mirai

Overview

Indicators of compromise associated with Mirai. 48 indicators listed below, linked to the G0139 adversary profile.

Not exhaustive, and confidence varies. Always corroborate against your own telemetry before taking action.

TypeIndicatorFirst SeenConfidence
ip:port103.83.87.122:80July 19, 2026100%
ip:port103.83.87.122:2222July 19, 2026100%
ip:port103.83.87.122:4444July 19, 2026100%
ip:port103.83.87.122:8060July 19, 2026100%
ip:port103.83.87.122:4444July 19, 2026100%
urlhttp://103.83.87.122/telnet.shJuly 19, 2026100%
urlhttp://103.83.87.122/iran.x86_64July 19, 2026100%
urlhttp://103.83.87.122/iran.aarch64July 19, 2026100%
urlhttp://103.83.87.122/iran.m68kJuly 19, 2026100%
urlhttp://103.83.87.122/iran.mipsJuly 19, 2026100%
urlhttp://103.83.87.122/iran.mipselJuly 19, 2026100%
urlhttp://103.83.87.122/iran.powerpcJuly 19, 2026100%
urlhttp://103.83.87.122/iran.sparcJuly 19, 2026100%
urlhttp://103.83.87.122/iran.sh4July 19, 2026100%
urlhttp://103.83.87.122/iran.arcJuly 19, 2026100%
urlhttp://103.83.87.122/iran.i486July 19, 2026100%
urlhttp://103.83.87.122/iran.armv4lJuly 19, 2026100%
urlhttp://103.83.87.122/iran.armv5lJuly 19, 2026100%
urlhttp://103.83.87.122/iran.armv6lJuly 19, 2026100%
urlhttp://103.83.87.122/iran.armv7lJuly 19, 2026100%
sha256_hashb1a6dba6636b519d76d7219f6264ac9f1456681c0855baef954fb435d3e25ce5July 19, 2026100%
sha256_hashbf38b3e5d645c78377599a6c218a347312c5a3daef693c7931f2710806d85317July 19, 2026100%
sha256_hashf5cb6dadaee4399a1f014ef5946d0a4c1af578d15ff078e725e0757f28dc8493July 19, 2026100%
sha256_hashe987bb8b32facef51c3cc5a94bd51e01d8c3be8a19c106de70147ab5ce84dc66July 19, 2026100%
sha256_hash6e709fb9b09d9f8318724a8620812f55411a3ea49de6319c4832885547773dddJuly 19, 2026100%
sha256_hash0d64cd75599dea5b8cf393b6e2b709f51b3971e64b96920e0707020e22ee7953July 19, 2026100%
sha256_hashf38d748d9ea29424c28744c52bcd1d14328d49fcb604ca08fab3547ec500d6f0July 19, 2026100%
sha256_hashb4acd1ab65624b694946b1181bba0732bb63c88c51b8334914c26c1805b2e1aaJuly 19, 2026100%
sha256_hash21c5f4a04173a5176d60b06095bf5d25e0022ffbe304601e368eccf718587dc8July 19, 2026100%
sha256_hashec442a132f27486d1dfa3faa92c03e10012afe2b8de39fa9b42b367f7971c989July 19, 2026100%
sha256_hash9538c8a2edeaa8667134a469d03a7057ddc1e753ce1e5250f92f01c1097fcb1dJuly 19, 2026100%
sha256_hashd8cd1d9f8c092aa4a6c1b1b2b97c7de71d55c2af8332532d2956e4f5becac17eJuly 19, 2026100%
sha256_hash95f5bd70c4e40f9663b67d40d23a46ca21d97448f9a609be10b12837e6a59805July 19, 2026100%
sha256_hashb1f2808e05cb42894790c12172ffacf8673a0a7e14c7af5ad43d5bedfa62a5e4July 19, 2026100%
ip:port45.150.195.235:80July 16, 202675%
ip:port205.237.110.232:80July 16, 202675%
ip:port113.19.109.137:8635July 15, 202675%
ip:port185.242.3.87:80July 14, 202675%
ip:port45.225.135.18:80July 13, 202675%
ip:port45.225.135.18:1212July 13, 202675%
ip:port64.89.163.22:443July 13, 202675%
ip:port45.225.135.18:8080July 13, 202675%
ip:port45.225.135.18:9091July 13, 202675%
ip:port45.225.135.18:6262July 13, 202675%
ip:port59.110.152.228:9292July 13, 202675%
domainwifihgu.duckdns.orgJuly 13, 2026100%
ip:port91.92.42.50:80July 13, 202675%
ip:port45.90.163.37:18129July 12, 2026100%

Related content

Adversary Profile

Threat Actor Profile: TeamTNT (G0139)

IOCs

Tsunami — Indicators of Compromise

IOCs

5.t Downloader — Indicators of Compromise

IOCs

ACR Stealer — Indicators of Compromise

Seeing these indicators in your logs?

Let's figure out how far it's gotten.

Book an advisory call