MB-d04f48531b23798dcd0ce0951af57999a7b2fc375ff0e3175a48b3db221d1816
high
📛 Threat Title
Unknown: iranbot-ultimate.aarch64
Description
File type: elf. Size: 91832 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-27 00:33:53.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
d04f48531b23798dcd0ce0951af57999a7b2fc375ff0e3175a48b3db221d1816
IOC database
- Type
- hash_sha256
- Value
d04f48531b23798dcd0ce0951af57999a7b2fc375ff0e3175a48b3db221d1816- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
3bca05525745c10f493b05f50cbeb2ce897a1913
IOC database
- Type
- hash_sha1
- Value
3bca05525745c10f493b05f50cbeb2ce897a1913- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
5ecdba3c4578c53c34698395da5f8b9d
IOC database
- Type
- hash_md5
- Value
5ecdba3c4578c53c34698395da5f8b9d- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 91832 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-27 00:33:53.
Remediations (10)
-
web:github.com
IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...
-
web:github.com
IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...
-
web:threatfox.abuse.ch
I'm a security researcher and I've been tracking an active non-Mirai-variant botnet Called Iranbot operated by an Egyptian threat actor (Telegram: @FuckIsra3l). I'm reaching out because I believe this is actionable enough for a takedown and I want to share everything I have.
-
web:urlhaus.abuse.ch
Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.joesandbox.com
Source: /tmp/ iranbot -ultimate.aarch64.elf (PID: 4092) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Source: iranbot -ultimate.aarch64.elf, 4092.1.000055af8f0f6000.000055af8f1bb000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/aarch64
-
web:www.joesandbox.com
General Information Joe Sandbox version: 45.0.0 Green Opal Analysis ID: 1988814 Start date and time: 2026-10-19 14:09:26 +02:00 Joe Sandbox product: CloudBasic Overall analysis duration: 0h 4m 30s Hypervisor based Inspection enabled: false Report type: full Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0 ...
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.unknowncheats.me
Quick overview The tool rebuilds a specific Wardogs EXE so it can run without relying on Theia's protection runtime. It decrypts protected pages, copi
-
web:www.virustotal.com
This ARM ELF binary is a botnet agent, explicitly self-identifying as 'iranbot' in its initialization strings ( 'iranbot init: death to israel'). It functions as a DDoS bot with multiple attack vectors, including SYN, TCP, UDP, ICMP, and GRE floods. Key malicious behaviors include C2 communication with 'iranbot .servecounterstrike.com', anti-honeypot checks that verify the /proc filesystem, and ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.