TF-MAL-elf.torii
📛 Threat Title
Malware family: Torii
Description
ThreatFox malware family `elf.torii`. Printable name: Torii.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.torii
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.torii
IOC database
- Type
- domain
- Value
elf.torii- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.torii
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.torii
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.avast.com
Any script kiddie now can use the Mirai source code, make a few changes, give it a new Japanese-sounding name, and then release it as a new botnet. Over the past week, we have been observing a new malware strain, which we call Torii , that differs from Mirai and other botnets we know of, particularly in the advanced techniques it uses.
-
web:echoxec.com
Mirai Malware in 2025: Variant Behavior, Exploit Chains, and Mitigation Insights This post explores the latest Mirai botnet variants actively exploiting critical vulnerabilities in Samsung MagicINFO, DVR devices, and Wazuh servers. It highlights key behaviors observed through sandbox analysis, exploitation techniques, and provides actionable recommendations to defend against these evolving ...
-
web:github.com
Jackskid carries legacy attribution markers from the Persirai (2017) and Torii (2018) IoT botnet families, shares technical similarities and C2 infrastructure with Aisuru, and exhibits strong naming and architectural ties to the CatDDoS derivative ecosystem that emerged from a late-2023 source code leak.
-
web:learn.microsoft.com
Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Torii malware family including references, samples and yara signatures.
-
web:plrj.org
The developers of the botnet seek wide coverage and for this purpose they created binaries for multiple CPU architectures, tailoring the malware for stealth and persistence. Communication with the command and control (C2) servers is encrypted and capabilities include exfiltration and, command execution.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.cloudflare.com
Mitigation and detection Defending against SSA-themed phishing requires both individual and organizational mitigations , such as: Cyber hygiene: Avoid clicking links unless you have verified they are not malicious; keep all software up-to-date; disable Office macros.
-
web:www.idtheftcenter.org
A new social security scam uses fake SSA emails to trick users into installing remote access tools onto their devices.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.