s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-4d9f8f57fc448178b38575682d16731eccbbf1cd2aae51b774345aef34b605ef high

📛 Threat Title

Mirai: iranbot-ultimate.sh4

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 147488 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:35:35.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 4d9f8f57fc448178b38575682d16731eccbbf1cd2aae51b774345aef34b605ef VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/4d9f8f57fc448178b38575682d16731eccbbf1cd2aae51b774345aef34b605ef

IOC database

Type
hash_sha256
Value
4d9f8f57fc448178b38575682d16731eccbbf1cd2aae51b774345aef34b605ef
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA256 hash of a malware sample (payload) attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/4d9f8f57fc448178b38575682d16731eccbbf1cd2aae51b774345aef34b605ef

hash_sha1 4e6425b5828f4911c95c891b6bf4aa18ac7326b4 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/4e6425b5828f4911c95c891b6bf4aa18ac7326b4

IOC database

Type
hash_sha1
Value
4e6425b5828f4911c95c891b6bf4aa18ac7326b4
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/4e6425b5828f4911c95c891b6bf4aa18ac7326b4

hash_md5 7edc679fac72bb9bf3d11ead3e31b10a VT 25 / 75

IOC database

Type
hash_md5
Value
7edc679fac72bb9bf3d11ead3e31b10a
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 25 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious Backdoor:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
Avast malicious ELF:Mirai-VT [Trj]
AVG malicious ELF:Mirai-VT [Trj]
Avira malicious TR/LINUX.Mirai.VT
ClamAV malicious Unix.Dropper.Mirai-7136288-0
Cynet malicious Malicious (score: 99)
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
F-Secure malicious Trojan.TR/LINUX.Mirai.VT
GData malicious Linux.Trojan.Agent.PS312V
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Trojan.Linux.Mirai
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.Linux.Mirai.K!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Backdoor:Linux/Gafgyt.P!MTB
Rising malicious Backdoor.Mirai/Linux!1.1402C (CLASSIC)
Sangfor malicious Suspicious.Linux.Save.a
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious Trojan.Linux.Mirai.zk
Varist malicious E32/Mirai.DJ.gen!Camelot

Details From VirusTotal

Basic Properties
MD57edc679fac72bb9bf3d11ead3e31b10a
SHA-14e6425b5828f4911c95c891b6bf4aa18ac7326b4
SHA-2564d9f8f57fc448178b38575682d16731eccbbf1cd2aae51b774345aef34b605ef
VHash00b26008a8fe7a815c8999cf5721a7ce
SSDEEP3072:zHf4TZu7rZxFfvxF9zjSqF32E5MvJ/lW7rji:zHf2OZxtvj9zWuGvJ/Q7vi
TLSHT135E35A63ED299F1AC116E0F0A1B25E381B43FD2648571FFAA576EAE40143DC8F6053B8
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
File size144.0 KB
History
First seen on VirusTotal2026-10-31 14:45 UTC
Last submission2026-10-31 14:45 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:05 UTC
Known Names
  • kjutp2.exe
  • iranbot-ultimate.sh4

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 147488 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:35:35.

Remediations (10)

  • public-research/iranbot/report.md at main · deepfield/public ... - GitHub
    web:github.com

    IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...

  • public-research/iranbot at main · deepfield/public-research
    web:github.com

    The full analysis is in report.md: a build-by-build account of the family's devolving encryption, rising propagation capability, and throwaway infrastructure, plus detection guidance and indicators.

  • Kirk on Security - In-depth security news and investigation
    web:kirkonsecurity.com

    Iranbot instead configured its HTTP flood to function as a self-doxxing mechanism. Every WAF in the world that processes a single HTTP request from this botnet immediately receives a signed confession.

  • Mirai botnet digest: threat overview, analytics and remediation
    web:socprime.com

    Explore the Mirai Botnet Digest: in-depth threat overview, analytics, and actionable remediation insights to detect and defend against Mirai -based IoT attacks.

  • Mirai Botnet | ARM Reverse Engineering Walkthrough
    web:trainsec.net

    Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...

  • PDF Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.jisem-journal.com

    Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices compromised by malware. The methods presented are generic and can be used to mitigate any malware of the same nature.

  • Linux Analysis Report iranbot-ultimate.mipsel.elf
    web:www.joesandbox.com

    Source: /tmp/ iranbot -ultimate.mipsel.elf (PID: 4114) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Source: iranbot -ultimate.mipsel.elf, 4114.1.000055791f6df000.000055791f766000.rw-.sdmp Binary or memory string: yU!/etc/qemu-binfmt/mipsel

  • Automated Malware Analysis Management Report for iranbot-ultimate ...
    web:www.joesandbox.com

    Uses the "uname" system call to query kernel version information (possible evasion)

  • PDF Mirai Botnet - Quorum Cyber
    web:www.quorumcyber.com

    Mirai initially infected and weaponised devices such as smart cameras and Realtek routers2. The botnet variant was created in a racketeering attempt by the cofounders of Protraf Solutions, an organisation offering DDoS mitigation services.

  • Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.researchgate.net

    Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.