TF-1983181
high
📛 Threat Title
Mirai: URL that delivers a malware payload http://91.92.43.221/iranbot-ultimate.x86_32
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mirai (aliases: Katana). Confidence: 100. First seen: 2026-10-24 15:43:46 UTC. Reporter: Dense. Tags: elf, honeypot, IranBot, Mirai.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
http://91.92.43.221/iranbot-ultimate.x86_32
VT 26 / 94
IOC database
- Type
- url
- Value
http://91.92.43.221/iranbot-ultimate.x86_32- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://urlhaus.abuse.ch/downloads/text_recent/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 26 of 94 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alphaMountain.ai | malicious | malicious |
| BitDefender | malicious | malware |
| Certego | malicious | malicious |
| Cluster25 | malicious | malicious |
| CRDF | malicious | malicious |
| CyRadar | malicious | malicious |
| Dr.Web | malicious | malicious |
| Emsisoft | malicious | malware |
| ESET | malicious | malware |
| Forcepoint ThreatSeeker | malicious | malicious |
| Fortinet | malicious | malware |
| G-Data | malicious | malware |
| GreyNoise | malicious | malicious |
| Gridinsoft | malicious | malicious |
| IPsum | malicious | malicious |
| Kaspersky | malicious | malware |
| Lionic | malicious | malicious |
| MalwareURL | malicious | malware |
| SOCRadar | malicious | phishing |
| Sophos | malicious | malware |
| URLhaus | malicious | malicious |
| VIPRE | malicious | malware |
| Webroot | malicious | malicious |
| AlphaSOC | suspicious | suspicious |
| BlockList | suspicious | suspicious |
| Guardpot | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Final URL | http://91.92.43.221/iranbot-ultimate.x86_32 |
| Last HTTP status | 200 |
History
| First seen on VirusTotal | 2026-10-19 11:17 UTC |
| Last submission | 2026-10-24 21:12 UTC |
| Last analysis | 2026-10-24 21:12 UTC |
| Last modified on VirusTotal | 2026-10-25 01:04 UTC |
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mirai (aliases: Katana). Confidence: 100. First seen: 2026-10-24 15:43:46 UTC. Reporter: Dense. Tags: elf, honeypot, IranBot, Mirai.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:github.com
This repository contains a static malware analysis of the IoT Mirai malware (loader component) obtained from theZoo malware repository. The objective of this project is to understand Mirai's infection mechanism, network behavior, architecture-specific payload delivery, and execution flow using reverse engineering techniques.
-
web:malwareanalyzer.com
MalwareAnalyzer is a public malware analysis and threat intelligence platform. You submit a file, a URL , or a hash, and it returns a verdict backed by multi-engine static scanning, real sandbox execution, extracted indicators, and a threat graph you can pivot through.
-
web:threatfox.abuse.ch
You are viewing the ThreatFox database entry for ip:port 91.92.43.221:80.
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL .
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL . URLhaus was not able to retrieve a payload from this URL . It's possible that the malware payload is offline or requests from URLhaus are being blocked by the remote server.
-
web:www.imperva.com
The image shows an example of a bash script that , when executed, downloads a second-stage binary that installs the Mirai malware onto the infected host. This surge in malicious URL delivery coincides with attackers' increasing use of AI and machine learning to generate sophisticated DDoS attacks.
-
web:www.radware.com
Mirai as an Evolving IoT Botnet Ecosystem As of 2026, Mirai is a reusable malware lineage and attack framework that continues to shape IoT-driven DDoS activity. Radware describes Mirai as one of the defining IoT botnets because its leaked source code enabled attackers to create customized variants and rapidly expand DDoS capabilities across poorly secured connected devices. The key risk is ...
-
web:www.youtube.com
We walk through the full triage process step-by-step: extracting strings, IPs, URLs , and payload commands, checking hashes, identifying the architecture, and confirming how the malware spreads and ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.