s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-27ca6bc2a7b05f067b593dfaac4866a0cff39207d500ab87ffff0c9881f962fc high

📛 Threat Title

Mirai: iranbot-ultimate.mipsel

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 216148 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-11-02 15:47:04.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 27ca6bc2a7b05f067b593dfaac4866a0cff39207d500ab87ffff0c9881f962fc VT 13 / 75

IOC database

Type
hash_sha256
Value
27ca6bc2a7b05f067b593dfaac4866a0cff39207d500ab87ffff0c9881f962fc
First seen
Last seen
Attached to this threat
Appears in
3 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 13 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
McAfeeD malicious Trojan:Script/Mirai.EHA
Microsoft malicious Trojan:Script/Wacatac.B!ml
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD502cc4b3c002bad22cbf131597e1ca4a0
SHA-1bccf6174b8daebcf027c6e5cb7b0933cc2bd7229
SHA-25627ca6bc2a7b05f067b593dfaac4866a0cff39207d500ab87ffff0c9881f962fc
VHashcc382e274888dba3c50baf9437c43eb9
SSDEEP6144:KdTchOr9xIK34tZMPuwqjL/znZOwKwkvg47zWIK5G:KV/xzOZMGpkS
TLSHT13224E8099F910FBBD8AFDE3702E90A1635CCA54722A43B753678D528F54E90B49E3C78
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size211.1 KB
History
First seen on VirusTotal2026-11-02 15:47 UTC
Last submission2026-11-02 15:47 UTC
Last analysis2026-11-02 18:03 UTC
Last modified on VirusTotal2026-11-02 20:03 UTC
Known Names
  • nw17i.exe
  • iranbot-ultimate.mipsel.elf
hash_md5 02cc4b3c002bad22cbf131597e1ca4a0 VT 13 / 75

IOC database

Type
hash_md5
Value
02cc4b3c002bad22cbf131597e1ca4a0
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
URLhaus payload hash attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 13 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
McAfeeD malicious Trojan:Script/Mirai.EHA
Microsoft malicious Trojan:Script/Wacatac.B!ml
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD502cc4b3c002bad22cbf131597e1ca4a0
SHA-1bccf6174b8daebcf027c6e5cb7b0933cc2bd7229
SHA-25627ca6bc2a7b05f067b593dfaac4866a0cff39207d500ab87ffff0c9881f962fc
VHashcc382e274888dba3c50baf9437c43eb9
SSDEEP6144:KdTchOr9xIK34tZMPuwqjL/znZOwKwkvg47zWIK5G:KV/xzOZMGpkS
TLSHT13224E8099F910FBBD8AFDE3702E90A1635CCA54722A43B753678D528F54E90B49E3C78
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size211.1 KB
History
First seen on VirusTotal2026-11-02 15:47 UTC
Last submission2026-11-02 15:47 UTC
Last analysis2026-11-02 18:03 UTC
Last modified on VirusTotal2026-11-02 20:03 UTC
Known Names
  • nw17i.exe
  • iranbot-ultimate.mipsel.elf
hash_sha1 bccf6174b8daebcf027c6e5cb7b0933cc2bd7229 VT 13 / 75

IOC database

Type
hash_sha1
Value
bccf6174b8daebcf027c6e5cb7b0933cc2bd7229
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 13 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
McAfeeD malicious Trojan:Script/Mirai.EHA
Microsoft malicious Trojan:Script/Wacatac.B!ml
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD502cc4b3c002bad22cbf131597e1ca4a0
SHA-1bccf6174b8daebcf027c6e5cb7b0933cc2bd7229
SHA-25627ca6bc2a7b05f067b593dfaac4866a0cff39207d500ab87ffff0c9881f962fc
VHashcc382e274888dba3c50baf9437c43eb9
SSDEEP6144:KdTchOr9xIK34tZMPuwqjL/znZOwKwkvg47zWIK5G:KV/xzOZMGpkS
TLSHT13224E8099F910FBBD8AFDE3702E90A1635CCA54722A43B753678D528F54E90B49E3C78
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size211.1 KB
History
First seen on VirusTotal2026-11-02 15:47 UTC
Last submission2026-11-02 15:47 UTC
Last analysis2026-11-02 18:03 UTC
Last modified on VirusTotal2026-11-02 20:03 UTC
Known Names
  • nw17i.exe
  • iranbot-ultimate.mipsel.elf

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 216148 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-11-02 15:47:04.

Remediations (10)

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    You are currently viewing the MalwareBazaar entry for SHA256 b143a651b27791f58aa3fed1b83f9ad1e918bbe0f65336ba883da13dd87d9ca2. While MalwareBazaar tries to identify ...

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    You are currently viewing the MalwareBazaar entry for SHA256 e6f9acc77d22ddda23d40838c8268de2991800a7d8f1de049941e6b9ddf7b3c6. While MalwareBazaar tries to identify ...

  • The Mirai Botnet: The Infamous DDoS Weapon - Blog
    web:dailysecurityreview.com

    The Mirai botnet, a notorious piece of malware, launched devastating DDoS attacks in 2016. This blog post delves into its origins, spread, impact, and the ongoing threat it represents, providing crucial information on mitigating Mirai botnet risks.

  • public-research/iranbot/report.md at main · deepfield/public ... - GitHub
    web:github.com

    IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...

  • public-research/iranbot at main · deepfield/public-research
    web:github.com

    IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...

  • ThreatFox | IranBot
    web:threatfox.abuse.ch

    The table below shows all indicators of compromise (IOCs) that are associated with this particulare tag (max 1000).

  • URLhaus | iranbot
    web:urlhaus.abuse.ch

    Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).

  • Linux Analysis Report iranbot-ultimate.mipsel.elf
    web:www.joesandbox.com

    Source: /tmp/ iranbot -ultimate.mipsel.elf (PID: 4019) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Source: iranbot -ultimate.mipsel.elf, 4019.1.0000564de46ef000.0000564de4776000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel

  • Automated Malware Analysis Report for iranbot-ultimate.mipsel.elf ...
    web:www.joesandbox.com

    Runtime Messages Command: /tmp/ iranbot -ultimate.mipsel.elf PID: 4019 Exit Code: 137 Exit Code Info: SIGKILL (9) Kill signal Killed: False Standard Output: Standard Error:

  • TrojanDownloader:Script/Iranbot.A - microsoft.com
    web:www.microsoft.com

    Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.