TF-1983180
high
📛 Threat Title
Mirai: URL that delivers a malware payload http://91.92.43.221/iranbot-ultimate.mipsel
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mirai (aliases: Katana). Confidence: 100. First seen: 2026-10-24 15:43:45 UTC. Reporter: Dense. Tags: elf, honeypot, IranBot, Mirai.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
http://91.92.43.221/iranbot-ultimate.mipsel
VT 27 / 94
IOC database
- Type
- url
- Value
http://91.92.43.221/iranbot-ultimate.mipsel- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://urlhaus.abuse.ch/downloads/text_recent/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 27 of 94 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alphaMountain.ai | malicious | malicious |
| BitDefender | malicious | malware |
| Certego | malicious | malicious |
| CINS Army | malicious | malicious |
| Cluster25 | malicious | malicious |
| CRDF | malicious | malicious |
| CyRadar | malicious | malicious |
| Dr.Web | malicious | malicious |
| Emsisoft | malicious | malware |
| ESET | malicious | malware |
| Forcepoint ThreatSeeker | malicious | malicious |
| Fortinet | malicious | malware |
| G-Data | malicious | malware |
| GreyNoise | malicious | malicious |
| Gridinsoft | malicious | malicious |
| IPsum | malicious | malicious |
| Kaspersky | malicious | malware |
| Lionic | malicious | malicious |
| MalwareURL | malicious | malware |
| SOCRadar | malicious | phishing |
| Sophos | malicious | malware |
| URLhaus | malicious | malicious |
| VIPRE | malicious | malware |
| Webroot | malicious | malicious |
| AlphaSOC | suspicious | suspicious |
| BlockList | suspicious | suspicious |
| Guardpot | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Final URL | http://91.92.43.221/iranbot-ultimate.mipsel |
| Last HTTP status | 200 |
History
| First seen on VirusTotal | 2026-10-19 11:17 UTC |
| Last submission | 2026-10-24 15:45 UTC |
| Last analysis | 2026-10-24 15:45 UTC |
| Last modified on VirusTotal | 2026-10-24 19:42 UTC |
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mirai (aliases: Katana). Confidence: 100. First seen: 2026-10-24 15:43:45 UTC. Reporter: Dense. Tags: elf, honeypot, IranBot, Mirai.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:malpedia.caad.fkie.fraunhofer.de
Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the ...
-
web:threatfox.abuse.ch
You are viewing the ThreatFox database entry for ip:port 91.92.43.221:80.
-
web:urlhaus.abuse.ch
URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL .
-
web:www.cloudsek.com
CloudSEK uncovered a large-scale Loader- as -a-Service botnet distributing RondoDoX, Mirai , and Morte payloads through SOHO routers, IoT devices, and enterprise apps. Exploiting weak credentials, unsanitized inputs, and old CVEs, the campaign surged 230% in mid-2025, weaponizing compromised devices for cryptomining, DDoS, and enterprise intrusions. With rapid infrastructure rotation and multi ...
-
web:www.imperva.com
The image shows an example of a bash script that , when executed, downloads a second-stage binary that installs the Mirai malware onto the infected host. This surge in malicious URL delivery coincides with attackers' increasing use of AI and machine learning to generate sophisticated DDoS attacks.
-
web:www.radware.com
Mirai as an Evolving IoT Botnet Ecosystem As of 2026, Mirai is a reusable malware lineage and attack framework that continues to shape IoT-driven DDoS activity. Radware describes Mirai as one of the defining IoT botnets because its leaked source code enabled attackers to create customized variants and rapidly expand DDoS capabilities across poorly secured connected devices. The key risk is ...
-
web:www.youtube.com
We walk through the full triage process step-by-step: extracting strings, IPs, URLs , and payload commands, checking hashes, identifying the architecture, and confirming how the malware spreads and ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.