s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-34968bc2f981c733c1b8b1f0f44736a28c2d90e66e7f40f36affcad3c002426b high

📛 Threat Title

Mirai: iranbot-ultimate.mipsel

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 216212 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-10-27 15:49:41.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 34968bc2f981c733c1b8b1f0f44736a28c2d90e66e7f40f36affcad3c002426b VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/34968bc2f981c733c1b8b1f0f44736a28c2d90e66e7f40f36affcad3c002426b

IOC database

Type
hash_sha256
Value
34968bc2f981c733c1b8b1f0f44736a28c2d90e66e7f40f36affcad3c002426b
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/34968bc2f981c733c1b8b1f0f44736a28c2d90e66e7f40f36affcad3c002426b

hash_sha1 4da52823d6e1248c1f24448c19fe8691aacc8785 VT 15 / 75

IOC database

Type
hash_sha1
Value
4da52823d6e1248c1f24448c19fe8691aacc8785
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 15 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.nf
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.gen
Lionic malicious Trojan.ELF.Mirai.4!c
Microsoft malicious Trojan:Linux/Multiverze!rfn
Rising malicious Backdoor.Mirai/Linux!8.13285 (TFE:14:kClYD2UYuyP)
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious Linux.Backdoor.Mirai.Cdhl
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD56dc814b9363f43623b379be8e3ac67bc
SHA-14da52823d6e1248c1f24448c19fe8691aacc8785
SHA-25634968bc2f981c733c1b8b1f0f44736a28c2d90e66e7f40f36affcad3c002426b
VHashcc382e274888dba3c50baf9437c43eb9
SSDEEP6144:N+YYmOmRR82a9HcOis3H2qTOdRwKmoXL7zmOXRS:NJhRL4HcNA4S
TLSHT13A24F80A9F910FBBD8AFDE3702E90A0635CCA54722A43B753678D524F54E90F49E3C68
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size211.1 KB
History
First seen on VirusTotal2026-10-27 13:01 UTC
Last submission2026-10-27 13:01 UTC
Last analysis2026-10-27 18:03 UTC
Last modified on VirusTotal2026-10-27 20:08 UTC
Known Names
  • iranbot-ultimate.mipsel
  • paadk.exe
  • 58x1lt.exe
  • t32t77r.exe
  • 2h50g7kx.exe
  • c839a39a03fe3295e4a601346b771b59252644d21cbafb04c767dd6c762a2178
hash_md5 6dc814b9363f43623b379be8e3ac67bc VT 15 / 75

IOC database

Type
hash_md5
Value
6dc814b9363f43623b379be8e3ac67bc
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 15 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.nf
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.gen
Lionic malicious Trojan.ELF.Mirai.4!c
Microsoft malicious Trojan:Linux/Multiverze!rfn
Rising malicious Backdoor.Mirai/Linux!8.13285 (TFE:14:kClYD2UYuyP)
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious Linux.Backdoor.Mirai.Cdhl
Varist malicious E32/Mirai.JK.gen!Eldorado

Details From VirusTotal

Basic Properties
MD56dc814b9363f43623b379be8e3ac67bc
SHA-14da52823d6e1248c1f24448c19fe8691aacc8785
SHA-25634968bc2f981c733c1b8b1f0f44736a28c2d90e66e7f40f36affcad3c002426b
VHashcc382e274888dba3c50baf9437c43eb9
SSDEEP6144:N+YYmOmRR82a9HcOis3H2qTOdRwKmoXL7zmOXRS:NJhRL4HcNA4S
TLSHT13A24F80A9F910FBBD8AFDE3702E90A0635CCA54722A43B753678D524F54E90F49E3C68
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
File size211.1 KB
History
First seen on VirusTotal2026-10-27 13:01 UTC
Last submission2026-10-27 13:01 UTC
Last analysis2026-10-27 18:03 UTC
Last modified on VirusTotal2026-10-27 20:08 UTC
Known Names
  • iranbot-ultimate.mipsel
  • paadk.exe
  • 58x1lt.exe
  • t32t77r.exe
  • 2h50g7kx.exe
  • c839a39a03fe3295e4a601346b771b59252644d21cbafb04c767dd6c762a2178

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 216212 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-10-27 15:49:41.

Remediations (10)

  • public-research/iranbot/report.md at main · deepfield/public ... - GitHub
    web:github.com

    IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...

  • public-research/iranbot at main · deepfield/public-research
    web:github.com

    IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...

  • Kirk on Security - In-depth security news and investigation
    web:kirkonsecurity.com

    Iranbot instead configured its HTTP flood to function as a self-doxxing mechanism. Every WAF in the world that processes a single HTTP request from this botnet immediately receives a signed confession.

  • ThreatFox | 103.83.87.122:80
    web:threatfox.abuse.ch

    I'm a security researcher and I've been tracking an active non- Mirai -variant botnet Called Iranbot operated by an Egyptian threat actor (Telegram: @FuckIsra3l). I'm reaching out because I believe this is actionable enough for a takedown and I want to share everything I have.

  • URLhaus | iranbot
    web:urlhaus.abuse.ch

    Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).

  • URLhaus | http://94.154.43.44/iranbot-ultimate.mips
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • PDF Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.jisem-journal.com

    Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices compromised by malware.

  • Linux Analysis Report iranbot-ultimate.mipsel.elf
    web:www.joesandbox.com

    Source: iranbot -ultimate.mipsel.elf, 4114.1.00007ffd570cd000.00007ffd570ee000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

  • Automated Malware Analysis Report for iranbot-ultimate.mipsel.elf ...
    web:www.joesandbox.com

    AV Detection Multi AV Scanner detection for submitted file Source: iranbot -ultimate.mipsel.elf ReversingLabs: Detection: 13% Source: iranbot -ultimate.mipsel.elf Virustotal: Detection: 7% Perma Link

  • VirusTotal - File ...
    web:www.virustotal.com

    This ARM ELF binary is a botnet agent, explicitly self-identifying as 'iranbot' in its initialization strings ( 'iranbot init: death to israel'). It functions as a DDoS bot with multiple attack vectors, including SYN, TCP, UDP, ICMP, and GRE floods. Key malicious behaviors include C2 communication with 'iranbot .servecounterstrike.com', anti-honeypot checks that verify the /proc filesystem, and ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.