s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-836dc93d6401eee070aa8957494fdb6d1f5bbae0f75a6a22b075bb6bc3bbab7a high

📛 Threat Title

Mirai: iranbot-ultimate.x86_64

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 164160 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:35:37.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 836dc93d6401eee070aa8957494fdb6d1f5bbae0f75a6a22b075bb6bc3bbab7a VT 26 / 75

IOC database

Type
hash_sha256
Value
836dc93d6401eee070aa8957494fdb6d1f5bbae0f75a6a22b075bb6bc3bbab7a
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA256 hash of a malware sample (payload) attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Agent-AIN [PUP]
AVG malicious ELF:Agent-AIN [PUP]
Avira malicious PUA/LINUX.Agent.AIN
ClamAV malicious Unix.Dropper.Mirai-7540662-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.11295
Elastic malicious Linux.Trojan.Gafgyt
ESET-NOD32 malicious Linux/Mirai.FNP trojan
F-Secure malicious PotentialRisk.PUA/LINUX.Agent.AIN
Fortinet malicious ELF64/Mirai.TSU!tr.botnet
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Trojan.Linux.Gafgyt
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Mirai.GF!MTB
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sangfor malicious Backdoor.Linux.Mirai.Vcn0
SentinelOne malicious Static AI - Malicious ELF
Sophos malicious Mal/Generic-S
Symantec malicious PUA.Gen.2
Tencent malicious OB:Backdoor.Linux.Mirai.tnog

Details From VirusTotal

Basic Properties
MD5bc9e2ed65f6ba6fe6c3c09717dd1e64c
SHA-11c72f8faf3bc470990fed06dc9588e575879517f
SHA-256836dc93d6401eee070aa8957494fdb6d1f5bbae0f75a6a22b075bb6bc3bbab7a
VHashee180490703d62cbab032ce440e25e6d
SSDEEP3072:EDwyKWI+5l/4R/AvQAT8O1CK3BJTkL8c2CvEv:EDw3ktRD0hwv
TLSHT1B0F33A0776C2CDFFC496D1F44BEBA5379972FC2D1530B11A6780BEA22E58EA06A1D710
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
File size160.3 KB
History
First seen on VirusTotal2026-10-31 14:36 UTC
Last submission2026-10-31 14:36 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 22:41 UTC
Known Names
  • h53ugzk.exe
  • iranbot-ultimate.x86_64
  • iranbot-ultimate.x86_64.elf
hash_sha1 1c72f8faf3bc470990fed06dc9588e575879517f VT 26 / 75

IOC database

Type
hash_sha1
Value
1c72f8faf3bc470990fed06dc9588e575879517f
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Agent-AIN [PUP]
AVG malicious ELF:Agent-AIN [PUP]
Avira malicious PUA/LINUX.Agent.AIN
ClamAV malicious Unix.Dropper.Mirai-7540662-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.11295
Elastic malicious Linux.Trojan.Gafgyt
ESET-NOD32 malicious Linux/Mirai.FNP trojan
F-Secure malicious PotentialRisk.PUA/LINUX.Agent.AIN
Fortinet malicious ELF64/Mirai.TSU!tr.botnet
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Trojan.Linux.Gafgyt
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Mirai.GF!MTB
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sangfor malicious Backdoor.Linux.Mirai.Vcn0
SentinelOne malicious Static AI - Malicious ELF
Sophos malicious Mal/Generic-S
Symantec malicious PUA.Gen.2
Tencent malicious OB:Backdoor.Linux.Mirai.tnog

Details From VirusTotal

Basic Properties
MD5bc9e2ed65f6ba6fe6c3c09717dd1e64c
SHA-11c72f8faf3bc470990fed06dc9588e575879517f
SHA-256836dc93d6401eee070aa8957494fdb6d1f5bbae0f75a6a22b075bb6bc3bbab7a
VHashee180490703d62cbab032ce440e25e6d
SSDEEP3072:EDwyKWI+5l/4R/AvQAT8O1CK3BJTkL8c2CvEv:EDw3ktRD0hwv
TLSHT1B0F33A0776C2CDFFC496D1F44BEBA5379972FC2D1530B11A6780BEA22E58EA06A1D710
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
File size160.3 KB
History
First seen on VirusTotal2026-10-31 14:36 UTC
Last submission2026-10-31 14:36 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 22:41 UTC
Known Names
  • h53ugzk.exe
  • iranbot-ultimate.x86_64
  • iranbot-ultimate.x86_64.elf
hash_md5 bc9e2ed65f6ba6fe6c3c09717dd1e64c VT 26 / 75

IOC database

Type
hash_md5
Value
bc9e2ed65f6ba6fe6c3c09717dd1e64c
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 26 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Agent-AIN [PUP]
AVG malicious ELF:Agent-AIN [PUP]
Avira malicious PUA/LINUX.Agent.AIN
ClamAV malicious Unix.Dropper.Mirai-7540662-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.11295
Elastic malicious Linux.Trojan.Gafgyt
ESET-NOD32 malicious Linux/Mirai.FNP trojan
F-Secure malicious PotentialRisk.PUA/LINUX.Agent.AIN
Fortinet malicious ELF64/Mirai.TSU!tr.botnet
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Trojan.Linux.Gafgyt
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Mirai.GF!MTB
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sangfor malicious Backdoor.Linux.Mirai.Vcn0
SentinelOne malicious Static AI - Malicious ELF
Sophos malicious Mal/Generic-S
Symantec malicious PUA.Gen.2
Tencent malicious OB:Backdoor.Linux.Mirai.tnog

Details From VirusTotal

Basic Properties
MD5bc9e2ed65f6ba6fe6c3c09717dd1e64c
SHA-11c72f8faf3bc470990fed06dc9588e575879517f
SHA-256836dc93d6401eee070aa8957494fdb6d1f5bbae0f75a6a22b075bb6bc3bbab7a
VHashee180490703d62cbab032ce440e25e6d
SSDEEP3072:EDwyKWI+5l/4R/AvQAT8O1CK3BJTkL8c2CvEv:EDw3ktRD0hwv
TLSHT1B0F33A0776C2CDFFC496D1F44BEBA5379972FC2D1530B11A6780BEA22E58EA06A1D710
File typeELF
File type tagelf
MagicELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
File size160.3 KB
History
First seen on VirusTotal2026-10-31 14:36 UTC
Last submission2026-10-31 14:36 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 22:41 UTC
Known Names
  • h53ugzk.exe
  • iranbot-ultimate.x86_64
  • iranbot-ultimate.x86_64.elf

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 164160 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:35:37.

Remediations (10)

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    You are currently viewing the MalwareBazaar entry for SHA256 16c4c2947ed6644acaf5a09814fd314c480b32dae0182f18830b93a88ec49b45. While MalwareBazaar tries to identify ...

  • Mirai (malware) - Wikipedia
    web:en.wikipedia.org

    Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.

  • public-research/iranbot/report.md at main · deepfield/public ... - GitHub
    web:github.com

    Summary IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding.

  • public-research/iranbot at main · deepfield/public-research
    web:github.com

    IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...

  • ThreatFox | http://91.92.43.221/iranbot-ultimate.x86_64
    web:threatfox.abuse.ch

    Unknown malware IOC: http://91.92.43.221/ iranbot -ultimate.x86_64 (url)

  • URLhaus | iranbot
    web:urlhaus.abuse.ch

    Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).

  • URLhaus | http://91.92.43.221/iranbot-ultimate.x86_64
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • Linux Analysis Report iranbot-ultimate.mipsel.elf
    web:www.joesandbox.com

    Source: /tmp/ iranbot -ultimate.mipsel.elf (PID: 4114) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Source: iranbot -ultimate.mipsel.elf, 4114.1.000055791f6df000.000055791f766000.rw-.sdmp Binary or memory string: yU!/etc/qemu-binfmt/mipsel

  • PDF Mirai Botnet - Quorum Cyber
    web:www.quorumcyber.com

    Mirai initially infected and weaponised devices such as smart cameras and Realtek routers2. The botnet variant was created in a racketeering attempt by the cofounders of Protraf Solutions, an organisation offering DDoS mitigation services.

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2800 samples tracked, 28 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.