MB-51209ddd399a406106b96e4c4742758d991982c74115bce7836cfea5cffe816e
high
📛 Threat Title
Unknown: iranbot-ultimate.armv4l
Description
File type: elf. Size: 99688 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-23 07:13:53.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
51209ddd399a406106b96e4c4742758d991982c74115bce7836cfea5cffe816e
IOC database
- Type
- hash_sha256
- Value
51209ddd399a406106b96e4c4742758d991982c74115bce7836cfea5cffe816e- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
d87a540a4a400c91582b410456cba6d423032b23
IOC database
- Type
- hash_sha1
- Value
d87a540a4a400c91582b410456cba6d423032b23- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
7dc8ba87c7d9ad8b9a33a31f14863ded
IOC database
- Type
- hash_md5
- Value
7dc8ba87c7d9ad8b9a33a31f14863ded- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 99688 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-23 07:13:53.
Remediations (10)
-
web:github.com
IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...
-
web:github.com
IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...
-
web:maltiverse.com
iran.armv4l is a malicious file sample. 6 sightings from MalwareBazaar Abuse.ch, last seen 2026-04-06.
-
web:threatfox.abuse.ch
The page below gives you an overview on IOCs that are tagged with IranBot . You can also get this data through the ThreatFox API. Database Entry ... Indicators Of Compromise The table below shows all indicators of compromise (IOCs) that are associated with this particulare tag (max 1000).
-
web:urlhaus.abuse.ch
Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.joesandbox.com
iranbot -ultimate.armv4l.elf Status: finished Submission Time: 2026-10-18 13:38:37 +02:00 Clean
-
web:www.joesandbox.com
Runtime Messages Command: /tmp/ iranbot -ultimate.armv4l.elf PID: 4096 Exit Code: 137 Exit Code Info: SIGKILL (9) Kill signal Killed: False Standard Output: Iranbot -Ultimate-V1 init: join t.me/flylegit Standard Error:
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.virustotal.com
This ARM ELF binary is a botnet agent, explicitly self-identifying as 'iranbot' in its initialization strings ( 'iranbot init: death to israel'). It functions as a DDoS bot with multiple attack vectors, including SYN, TCP, UDP, ICMP, and GRE floods. Key malicious behaviors include C2 communication with 'iranbot .servecounterstrike.com', anti-honeypot checks that verify the /proc filesystem, and ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.