s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-a49b29ce6b0157fbdffba49ae97e3524a4904867e28477828677799fd9450a35 high

📛 Threat Title

Unknown: iranbot-ultimate.x86_32

Category: Unknown Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 101708 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-31 14:35:46.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 a49b29ce6b0157fbdffba49ae97e3524a4904867e28477828677799fd9450a35 VT 19 / 75

IOC database

Type
hash_sha256
Value
a49b29ce6b0157fbdffba49ae97e3524a4904867e28477828677799fd9450a35
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Unknown

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 19 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan/Linux.Mirai.a
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
GData malicious Linux.Trojan.Agent.6US5VV
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious LINUX.Agent
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
McAfeeD malicious ti!A49B29CE6B01
Microsoft malicious Backdoor:Linux/Mirai.JK!MTB
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sangfor malicious Backdoor.Linux.Mirai.Vhef
SentinelOne malicious Static AI - Suspicious ELF
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious OB:Backdoor.Linux.Mirai.tnog
Varist malicious E32/ABApplication.XW

Details From VirusTotal

Basic Properties
MD5472e72767cfcd7f434551aa0265e3992
SHA-142ded4aceabf70caf8f833952003efc2521eff7a
SHA-256a49b29ce6b0157fbdffba49ae97e3524a4904867e28477828677799fd9450a35
VHash8237b6430b7aae6280750dc5bda4eea0
SSDEEP1536:5w5Yy6mFQ7tHWn6D1PuoYRR6CabvNIjMSnJeperugDQaYvP+wWArEmo80NvT1Uni:6YHY6xPuPay9EpdgUfWwW6s80WWzV
TLSHT1A9A33A06F7D3D0F1D9470DB051ABA33B8A34BE294030DB57EB90BFA56926B81B45932C
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
File size99.3 KB
History
First seen on VirusTotal2026-10-31 14:36 UTC
Last submission2026-10-31 14:36 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:06 UTC
Known Names
  • d21umms79.exe
  • iranbot-ultimate.x86_32
  • iranbot-ultimate.x86_32.elf
hash_sha1 42ded4aceabf70caf8f833952003efc2521eff7a VT 19 / 75

IOC database

Type
hash_sha1
Value
42ded4aceabf70caf8f833952003efc2521eff7a
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 19 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan/Linux.Mirai.a
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
GData malicious Linux.Trojan.Agent.6US5VV
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious LINUX.Agent
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
McAfeeD malicious ti!A49B29CE6B01
Microsoft malicious Backdoor:Linux/Mirai.JK!MTB
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sangfor malicious Backdoor.Linux.Mirai.Vhef
SentinelOne malicious Static AI - Suspicious ELF
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious OB:Backdoor.Linux.Mirai.tnog
Varist malicious E32/ABApplication.XW

Details From VirusTotal

Basic Properties
MD5472e72767cfcd7f434551aa0265e3992
SHA-142ded4aceabf70caf8f833952003efc2521eff7a
SHA-256a49b29ce6b0157fbdffba49ae97e3524a4904867e28477828677799fd9450a35
VHash8237b6430b7aae6280750dc5bda4eea0
SSDEEP1536:5w5Yy6mFQ7tHWn6D1PuoYRR6CabvNIjMSnJeperugDQaYvP+wWArEmo80NvT1Uni:6YHY6xPuPay9EpdgUfWwW6s80WWzV
TLSHT1A9A33A06F7D3D0F1D9470DB051ABA33B8A34BE294030DB57EB90BFA56926B81B45932C
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
File size99.3 KB
History
First seen on VirusTotal2026-10-31 14:36 UTC
Last submission2026-10-31 14:36 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:06 UTC
Known Names
  • d21umms79.exe
  • iranbot-ultimate.x86_32
  • iranbot-ultimate.x86_32.elf
hash_md5 472e72767cfcd7f434551aa0265e3992 VT 19 / 75

IOC database

Type
hash_md5
Value
472e72767cfcd7f434551aa0265e3992
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 19 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan/Linux.Mirai.a
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
GData malicious Linux.Trojan.Agent.6US5VV
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious LINUX.Agent
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
McAfeeD malicious ti!A49B29CE6B01
Microsoft malicious Backdoor:Linux/Mirai.JK!MTB
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sangfor malicious Backdoor.Linux.Mirai.Vhef
SentinelOne malicious Static AI - Suspicious ELF
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious OB:Backdoor.Linux.Mirai.tnog
Varist malicious E32/ABApplication.XW

Details From VirusTotal

Basic Properties
MD5472e72767cfcd7f434551aa0265e3992
SHA-142ded4aceabf70caf8f833952003efc2521eff7a
SHA-256a49b29ce6b0157fbdffba49ae97e3524a4904867e28477828677799fd9450a35
VHash8237b6430b7aae6280750dc5bda4eea0
SSDEEP1536:5w5Yy6mFQ7tHWn6D1PuoYRR6CabvNIjMSnJeperugDQaYvP+wWArEmo80NvT1Uni:6YHY6xPuPay9EpdgUfWwW6s80WWzV
TLSHT1A9A33A06F7D3D0F1D9470DB051ABA33B8A34BE294030DB57EB90BFA56926B81B45932C
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
File size99.3 KB
History
First seen on VirusTotal2026-10-31 14:36 UTC
Last submission2026-10-31 14:36 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:06 UTC
Known Names
  • d21umms79.exe
  • iranbot-ultimate.x86_32
  • iranbot-ultimate.x86_32.elf

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 101708 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-31 14:35:46.

Remediations (10)

  • IranBot · Diary of a Lost Honeypot
    web:blog.efespain.com

    IranBot is a Mirai fork, and one of the kind that has a name of its own: there's a public dossier with its markers, and they're unmistakable. The author left a joke inside the binary (Not a mirai at all) along with a political slogan, and named the files with an iran. prefix. That last part is worth stating in full, because it's the first thing people misread: those are strings he wrote ...

  • public-research/iranbot/report.md at main · deepfield/public ... - GitHub
    web:github.com

    IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...

  • public-research/iranbot at main · deepfield/public-research
    web:github.com

    IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...

  • ThreatFox | IranBot
    web:threatfox.abuse.ch

    The table below shows all indicators of compromise (IOCs) that are associated with this particulare tag (max 1000).

  • ThreatFox | http://91.92.43.221/iranbot-ultimate.x86_64
    web:threatfox.abuse.ch

    Unknown malware IOC: http://91.92.43.221/ iranbot -ultimate.x86_64 (url)

  • URLhaus | iranbot
    web:urlhaus.abuse.ch

    Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).

  • URLhaus | http://91.92.43.221/iranbot-ultimate.x86_32
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • Linux Analysis Report iranbot-ultimate.x86_32.elf
    web:www.joesandbox.com

    General Information Joe Sandbox version: 45.0.0 Green Opal Analysis ID: 1992439 Start date and time: 2026-10-27 09:59:28 +01:00 Joe Sandbox product: CloudBasic Overall analysis duration: 0h 5m 6s Hypervisor based Inspection enabled: false Report type: full Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince ...

  • Linux Analysis Report iranbot-ultimate.x86_32.elf - Joe Sandbox
    web:www.joesandbox.com

    System Summary Malicious sample detected (through community Yara rule) Source: iranbot -ultimate.x86_32.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown Source: 4100.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown Source: 4099.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY Matched rule ...

  • TrojanDownloader:Script/Iranbot.A - microsoft.com
    web:www.microsoft.com

    Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.