MB-ee478d119e7c62f74fd207301463e49d83f99db75ae1b787a5e4c6390fc74497
high
📛 Threat Title
Unknown: iranbot-ultimate.armv4l
Description
File type: elf. Size: 99688 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-27 16:02:04.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
ee478d119e7c62f74fd207301463e49d83f99db75ae1b787a5e4c6390fc74497
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/ee478d119e7c62f74fd207301463e49d83f99db75ae1b787a5e4c6390fc74497
IOC database
- Type
- hash_sha256
- Value
ee478d119e7c62f74fd207301463e49d83f99db75ae1b787a5e4c6390fc74497- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/ee478d119e7c62f74fd207301463e49d83f99db75ae1b787a5e4c6390fc74497
hash_sha1
2c1701074185544eb8d8ad59e9f45218b5cfe4d4
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/2c1701074185544eb8d8ad59e9f45218b5cfe4d4
IOC database
- Type
- hash_sha1
- Value
2c1701074185544eb8d8ad59e9f45218b5cfe4d4- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/2c1701074185544eb8d8ad59e9f45218b5cfe4d4
hash_md5
276a2e3c3e1ec9ab3e91caa40386f9eb
VT 2 / 75
IOC database
- Type
- hash_md5
- Value
276a2e3c3e1ec9ab3e91caa40386f9eb- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 2 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| ESET-NOD32 | malicious | Linux/Mirai.FNP trojan |
| huorong | malicious | Trojan/Linux.Mirai.nf |
Details From VirusTotal
Basic Properties
| MD5 | 276a2e3c3e1ec9ab3e91caa40386f9eb |
| SHA-1 | 2c1701074185544eb8d8ad59e9f45218b5cfe4d4 |
| SHA-256 | ee478d119e7c62f74fd207301463e49d83f99db75ae1b787a5e4c6390fc74497 |
| VHash | f8f543077ccee620f0a93edfa4180e16 |
| SSDEEP | 1536:ycMynERaM0Y4KeoavBJVPH2jgmWMUhSups6OyanPli4Txr606as/vP5eKTWgvOzg:ycMyn46d/+WdhYHnA4Z3rMPRzmS |
| TLSH | T1D7A31955F940EA26C6D0267AFB6D418C33530B78D3DA3106DE24AF3527FB91A4E3A906 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 32-bit LSB pie executable, ARM, EABI5 version 1 (SYSV), static-pie linked, stripped |
| File size | 97.4 KB |
History
| First seen on VirusTotal | 2026-10-27 08:14 UTC |
| Last submission | 2026-10-27 08:14 UTC |
| Last analysis | 2026-10-27 08:14 UTC |
| Last modified on VirusTotal | 2026-10-27 17:03 UTC |
Known Names
yllhepy.exeiranbot-ultimate.armv4lr1g4xn.exe
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 99688 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-27 16:02:04.
Remediations (10)
-
web:any.run
Online sandbox report for armv4l, tagged as auto, mirai, botnet, verdict: Malicious activity
-
web:github.com
IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...
-
web:github.com
IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...
-
web:maltiverse.com
iran.armv4l is a malicious file sample. 6 sightings from MalwareBazaar Abuse.ch, last seen 2026-04-06.
-
web:threatfox.abuse.ch
The page below gives you an overview on IOCs that are tagged with IranBot . You can also get this data through the ThreatFox API. Database Entry ... Indicators Of Compromise The table below shows all indicators of compromise (IOCs) that are associated with this particulare tag (max 1000).
-
web:urlhaus.abuse.ch
Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.joesandbox.com
Source: /tmp/ iranbot -ultimate.armv4l.elf (PID: 4096) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Source: iranbot -ultimate.armv4l.elf, 4096.1.000056054e96f000.000056054ea9d000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
-
web:www.joesandbox.com
Runtime Messages Command: /tmp/ iranbot -ultimate.armv4l.elf PID: 5407 Exit Code: 137 Exit Code Info: SIGKILL (9) Kill signal Killed: False Standard Output: i miss you = v1.0 Standard Error:
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.