s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-3a78f93413c17abfc38e2359cf69fe491586ea4b626ecc844d19902a60177fd3 high

📛 Threat Title

Mirai: iranbot-ultimate.m68k

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 188352 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:35:55.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 3a78f93413c17abfc38e2359cf69fe491586ea4b626ecc844d19902a60177fd3 VT 23 / 75

IOC database

Type
hash_sha256
Value
3a78f93413c17abfc38e2359cf69fe491586ea4b626ecc844d19902a60177fd3
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA256 hash of a malware sample (payload) attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 23 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDOS:Linux/Mirai
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Mirai-PB [Trj]
AVG malicious ELF:Mirai-PB [Trj]
Avira malicious TR/LINUX.Mirai.PB
ClamAV malicious Unix.Trojan.Gafgyt-7782058-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
F-Secure malicious Trojan.TR/LINUX.Mirai.PB
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Linux/Mirai.EQY
Microsoft malicious Backdoor:Linux/Mirai.HF!MTB
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sangfor malicious Suspicious.Linux.Save.a
Sophos malicious Mal/Generic-S
Tencent malicious OB:Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.DJ.gen!Camelot

Details From VirusTotal

Basic Properties
MD5d49ab15c29450d4595c91ff073f8c1b8
SHA-15c94ba3a2d8e57824ad0767b23ff5ae244267133
SHA-2563a78f93413c17abfc38e2359cf69fe491586ea4b626ecc844d19902a60177fd3
VHash2eff0ead665567f024c94afae8731fcd
SSDEEP3072:b8Zd43408PCTYY6nAtRkB0GyaOBDLbNgHnzeibtUVdjbi6LEMrW9X:b8ZS3v8PCTB6rVyaIDLbNInfbtQLEMOX
TLSHT139042AC3F900DEBBF80BF777449308097130FF6A09525A32726779AAAE3A0D51567E46
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
File size183.9 KB
History
First seen on VirusTotal2026-10-31 18:03 UTC
Last submission2026-10-31 18:03 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:05 UTC
Known Names
  • iranbot-ultimate.m68k
hash_sha1 5c94ba3a2d8e57824ad0767b23ff5ae244267133 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/5c94ba3a2d8e57824ad0767b23ff5ae244267133

IOC database

Type
hash_sha1
Value
5c94ba3a2d8e57824ad0767b23ff5ae244267133
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/5c94ba3a2d8e57824ad0767b23ff5ae244267133

hash_md5 d49ab15c29450d4595c91ff073f8c1b8 VT 23 / 75

IOC database

Type
hash_md5
Value
d49ab15c29450d4595c91ff073f8c1b8
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 23 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDOS:Linux/Mirai
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Mirai-PB [Trj]
AVG malicious ELF:Mirai-PB [Trj]
Avira malicious TR/LINUX.Mirai.PB
ClamAV malicious Unix.Trojan.Gafgyt-7782058-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
F-Secure malicious Trojan.TR/LINUX.Mirai.PB
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Linux/Mirai.EQY
Microsoft malicious Backdoor:Linux/Mirai.HF!MTB
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sangfor malicious Suspicious.Linux.Save.a
Sophos malicious Mal/Generic-S
Tencent malicious OB:Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.DJ.gen!Camelot

Details From VirusTotal

Basic Properties
MD5d49ab15c29450d4595c91ff073f8c1b8
SHA-15c94ba3a2d8e57824ad0767b23ff5ae244267133
SHA-2563a78f93413c17abfc38e2359cf69fe491586ea4b626ecc844d19902a60177fd3
VHash2eff0ead665567f024c94afae8731fcd
SSDEEP3072:b8Zd43408PCTYY6nAtRkB0GyaOBDLbNgHnzeibtUVdjbi6LEMrW9X:b8ZS3v8PCTB6rVyaIDLbNInfbtQLEMOX
TLSHT139042AC3F900DEBBF80BF777449308097130FF6A09525A32726779AAAE3A0D51567E46
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
File size183.9 KB
History
First seen on VirusTotal2026-10-31 18:03 UTC
Last submission2026-10-31 18:03 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:05 UTC
Known Names
  • iranbot-ultimate.m68k

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 188352 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:35:55.

Remediations (10)

  • public-research/iranbot/report.md at main · deepfield/public ... - GitHub
    web:github.com

    IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...

  • CVE-2026-98432 temporary mitigation - GitHub
    web:github.com

    This repository holds scripts that drop IPv4 TCP packets carrying IP options on a Linux host. On hosts without SELinux/Smack NetLabel CIPSO labeling, CVE-2026-98432 (a Linux kernel IPv4 TCP use-after-free) cannot trigger without such packets. It is a temporary mitigation , not a fix. It was not tested against a real exploit (there is no public PoC), and no vendor endorses it. If your ...

  • Kirk on Security - In-depth security news and investigation
    web:kirkonsecurity.com

    Iranbot is a linux botnet featuring a custom encryption cipher, seven distinct DDoS flood methods, a self-replication scanner, anti-debug logic, systemd persistence, and a hardcoded C2 domain that sounds like a nine-year-old named their cat.

  • Mirai-like ELF Reversing, Part I: Stage1 Trust Gate, Command Dispatch ...
    web:taogoldi.github.io

    Static analysis of a Mirai -lineage ELF bot covering C2 trust verification, seven-method command dispatch, anti-competition killer logic, and reproducible extraction scripts.

  • ThreatFox | 103.83.87.122:80
    web:threatfox.abuse.ch

    I'm a security researcher and I've been tracking an active non- Mirai -variant botnet Called Iranbot operated by an Egyptian threat actor (Telegram: @FuckIsra3l). I'm reaching out because I believe this is actionable enough for a takedown and I want to share everything I have.

  • URLhaus | iranbot
    web:urlhaus.abuse.ch

    Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).

  • PDF Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.jisem-journal.com

    Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices compromised by malware.

  • Automated Malware Analysis Report for iran.m68k.elf - Joe Sandbox
    web:www.joesandbox.com

    3 other IPs or domains Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file iran.m68k.elf started dash rm started

  • Linux Analysis Report iranbot-ultimate.m68k.elf - Joe Sandbox
    web:www.joesandbox.com

    Signatures AV Detection Antivirus / Scanner detection for submitted sample Source: iranbot -ultimate.m68k.elf Avira: detected Multi AV Scanner detection for submitted file Source: iranbot -ultimate.m68k.elf ReversingLabs: Detection: 22%

  • Mirai Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Mirai threat intelligence: 2800 samples tracked, 28 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.