MB-0c40e4750064afc1d00f7d76037ecfab33ff70a81d77d0bb6d39edf3d30e3123
high
📛 Threat Title
Mirai: iranbot-ultimate.x86_32
Description
File type: elf. Size: 99588 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-11-02 21:36:04.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
0c40e4750064afc1d00f7d76037ecfab33ff70a81d77d0bb6d39edf3d30e3123
IOC database
- Type
- hash_sha256
- Value
0c40e4750064afc1d00f7d76037ecfab33ff70a81d77d0bb6d39edf3d30e3123- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
182894927c52d37734ba47352c33110191b5a3fd
IOC database
- Type
- hash_sha1
- Value
182894927c52d37734ba47352c33110191b5a3fd- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
fec2baef0aff78f6acaabfc70744b0a8
IOC database
- Type
- hash_md5
- Value
fec2baef0aff78f6acaabfc70744b0a8- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 99588 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-11-02 21:36:04.
Remediations (10)
-
web:bazaar.abuse.ch
You are currently viewing the MalwareBazaar entry for SHA256 16c4c2947ed6644acaf5a09814fd314c480b32dae0182f18830b93a88ec49b45. While MalwareBazaar tries to identify ...
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:github.com
IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding.
-
web:github.com
IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.jisem-journal.com
Table 1 from Imperva's DDoS attacks report, shows the top countries of origin of Mirai DDoS attacks. At this time Mirai malware is having a low antivirus detection ratio, even in the architecture of x86. With the free software avsubmit.py create by Michael Ligh is possible to analyses a file using the VirusTotal engine from the command line.
-
web:www.joesandbox.com
General Information Joe Sandbox version: 45.0.0 Green Opal Analysis ID: 1992439 Start date and time: 2026-10-27 09:59:28 +01:00 Joe Sandbox product: CloudBasic Overall analysis duration: 0h 5m 6s Hypervisor based Inspection enabled: false Report type: full Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince ...
-
web:www.joesandbox.com
Automated Malware Analysis - Joe Sandbox IOC Report IOC Report iranbot -ultimate.x86_32.elf
-
web:www.microsoft.com
Microsoft Defender for Endpoint detects and removes this threat. This threat is a highly functional multi-component Internet of Things (IoT) malware primarily designed to allow remote attacker to take over and control affected device/s. The threat is also known as " MIRAI ". Find out ways that malware can get on your PC.
-
web:www.openhands.dev
Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.