s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-2f8a614401855c54637c061a49d9d4f8c0d5a0e694b0e0d246e70761a2b3d628 high

📛 Threat Title

Mirai: iranbot-ultimate.mipsel

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 216212 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-10-27 16:02:01.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 2f8a614401855c54637c061a49d9d4f8c0d5a0e694b0e0d246e70761a2b3d628 VT 10 / 75

IOC database

Type
hash_sha256
Value
2f8a614401855c54637c061a49d9d4f8c0d5a0e694b0e0d246e70761a2b3d628
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 10 of 75 VirusTotal vendors

VendorVerdictDetection
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.nf
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.gen
Microsoft malicious Trojan:Script/Wacatac.C!ml
Rising malicious Backdoor.Mirai/Linux!8.13285 (TFE:14:kClYD2UYuyP)
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD51691f85ecab60d542d9f7a231925abb0
SHA-17dfcba2c37aef95832f36829728f54adba52f289
SHA-2562f8a614401855c54637c061a49d9d4f8c0d5a0e694b0e0d246e70761a2b3d628
VHashcc382e274888dba3c50baf9437c43eb9
SSDEEP6144:N+kYmOmRR82a9HcOis3H2qTOdRwKmoXL7zmOXiS:NNhRL4HcNATS
TLSHT1FE24F80A9F910FBBD8AFDE3702E90A0635CCA54722A43B753678D524F54E90F49E3C68
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size211.1 KB
History
First seen on VirusTotal2026-10-27 08:14 UTC
Last submission2026-10-27 08:14 UTC
Last analysis2026-10-27 08:14 UTC
Last modified on VirusTotal2026-10-28 00:51 UTC
Known Names
  • oflgf.exe
  • iranbot-ultimate.mipsel
  • f3fcavmcw.exe
hash_sha1 7dfcba2c37aef95832f36829728f54adba52f289 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/7dfcba2c37aef95832f36829728f54adba52f289

IOC database

Type
hash_sha1
Value
7dfcba2c37aef95832f36829728f54adba52f289
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/7dfcba2c37aef95832f36829728f54adba52f289

hash_md5 1691f85ecab60d542d9f7a231925abb0 VT 10 / 75

IOC database

Type
hash_md5
Value
1691f85ecab60d542d9f7a231925abb0
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 10 of 75 VirusTotal vendors

VendorVerdictDetection
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.nf
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.gen
Microsoft malicious Trojan:Script/Wacatac.C!ml
Rising malicious Backdoor.Mirai/Linux!8.13285 (TFE:14:kClYD2UYuyP)
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD51691f85ecab60d542d9f7a231925abb0
SHA-17dfcba2c37aef95832f36829728f54adba52f289
SHA-2562f8a614401855c54637c061a49d9d4f8c0d5a0e694b0e0d246e70761a2b3d628
VHashcc382e274888dba3c50baf9437c43eb9
SSDEEP6144:N+kYmOmRR82a9HcOis3H2qTOdRwKmoXL7zmOXiS:NNhRL4HcNATS
TLSHT1FE24F80A9F910FBBD8AFDE3702E90A0635CCA54722A43B753678D524F54E90F49E3C68
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size211.1 KB
History
First seen on VirusTotal2026-10-27 08:14 UTC
Last submission2026-10-27 08:14 UTC
Last analysis2026-10-27 08:14 UTC
Last modified on VirusTotal2026-10-28 00:51 UTC
Known Names
  • oflgf.exe
  • iranbot-ultimate.mipsel
  • f3fcavmcw.exe

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 216212 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-10-27 16:02:01.

Remediations (10)

  • public-research/iranbot/report.md at main · deepfield/public ... - GitHub
    web:github.com

    IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...

  • public-research/iranbot at main · deepfield/public-research
    web:github.com

    IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...

  • Kirk on Security - In-depth security news and investigation
    web:kirkonsecurity.com

    Iranbot instead configured its HTTP flood to function as a self-doxxing mechanism. Every WAF in the world that processes a single HTTP request from this botnet immediately receives a signed confession.

  • PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy ...
    web:thehackernews.com

    Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE ...

  • ThreatFox | 103.83.87.122:80
    web:threatfox.abuse.ch

    I'm a security researcher and I've been tracking an active non- Mirai -variant botnet Called Iranbot operated by an Egyptian threat actor (Telegram: @FuckIsra3l). I'm reaching out because I believe this is actionable enough for a takedown and I want to share everything I have.

  • URLhaus | iranbot
    web:urlhaus.abuse.ch

    Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).

  • URLhaus | http://94.154.43.44/iranbot-ultimate.mips
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • Linux Analysis Report iranbot-ultimate.mipsel.elf
    web:www.joesandbox.com

    Source: iranbot -ultimate.mipsel.elf, 4114.1.00007ffd570cd000.00007ffd570ee000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

  • Automated Malware Analysis Report for iranbot-ultimate.mipsel.elf ...
    web:www.joesandbox.com

    AV Detection Multi AV Scanner detection for submitted file Source: iranbot -ultimate.mipsel.elf ReversingLabs: Detection: 13% Source: iranbot -ultimate.mipsel.elf Virustotal: Detection: 7% Perma Link

  • VirusTotal - File ...
    web:www.virustotal.com

    This ARM ELF binary is a botnet agent, explicitly self-identifying as 'iranbot' in its initialization strings ( 'iranbot init: death to israel'). It functions as a DDoS bot with multiple attack vectors, including SYN, TCP, UDP, ICMP, and GRE floods. Key malicious behaviors include C2 communication with 'iranbot .servecounterstrike.com', anti-honeypot checks that verify the /proc filesystem, and ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.