s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-a38e01fb77059eb4032fabd7acd8c35872a3dcde1ba04c7ceb0bfc11e63d4d9a high

📛 Threat Title

Mirai: iranbot-ultimate.arm5

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 167072 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:36:23.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 a38e01fb77059eb4032fabd7acd8c35872a3dcde1ba04c7ceb0bfc11e63d4d9a VT 16 / 75

IOC database

Type
hash_sha256
Value
a38e01fb77059eb4032fabd7acd8c35872a3dcde1ba04c7ceb0bfc11e63d4d9a
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA256 hash of a malware sample (payload) attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 16 of 75 VirusTotal vendors

VendorVerdictDetection
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
DrWeb malicious Linux.Mirai.11295
Elastic malicious Linux.Generic.Threat
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Linux.Bot
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Trojan:Linux/Mirai.Z!MTB
Rising malicious Backdoor.Mirai/Linux!1.11724 (CLASSIC)
SentinelOne malicious Static AI - Malicious ELF
Tencent malicious OB:Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.DJ.gen!Camelot

Details From VirusTotal

Basic Properties
MD5430d14ad0baf5ec1e24b014966378d60
SHA-181d878eacaaba3e45dfa4d8e61b65bb0f9bcf655
SHA-256a38e01fb77059eb4032fabd7acd8c35872a3dcde1ba04c7ceb0bfc11e63d4d9a
VHash8611a64c71b514818e2ac595e7559ba9
SSDEEP3072:/khFyBb05U4Mpu6KFzI7TAyJECR9+IOwUe0tfkFEFjAM2VUy0oYWHAv2feoBcM9h:/kTK3pu66ehe7HfoMopJYWHAOfvW4fuU
TLSHT1ADF3F842F9418F17C9C726F6BBFE42C836166B79D7FA310299247FA0378A4D60E39611
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
File size163.2 KB
History
First seen on VirusTotal2026-10-31 18:03 UTC
Last submission2026-10-31 18:03 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:05 UTC
Known Names
  • iranbot-ultimate.arm5
hash_sha1 81d878eacaaba3e45dfa4d8e61b65bb0f9bcf655 VT 16 / 75

IOC database

Type
hash_sha1
Value
81d878eacaaba3e45dfa4d8e61b65bb0f9bcf655
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 16 of 75 VirusTotal vendors

VendorVerdictDetection
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
DrWeb malicious Linux.Mirai.11295
Elastic malicious Linux.Generic.Threat
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Linux.Bot
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Trojan:Linux/Mirai.Z!MTB
Rising malicious Backdoor.Mirai/Linux!1.11724 (CLASSIC)
SentinelOne malicious Static AI - Malicious ELF
Tencent malicious OB:Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.DJ.gen!Camelot

Details From VirusTotal

Basic Properties
MD5430d14ad0baf5ec1e24b014966378d60
SHA-181d878eacaaba3e45dfa4d8e61b65bb0f9bcf655
SHA-256a38e01fb77059eb4032fabd7acd8c35872a3dcde1ba04c7ceb0bfc11e63d4d9a
VHash8611a64c71b514818e2ac595e7559ba9
SSDEEP3072:/khFyBb05U4Mpu6KFzI7TAyJECR9+IOwUe0tfkFEFjAM2VUy0oYWHAv2feoBcM9h:/kTK3pu66ehe7HfoMopJYWHAOfvW4fuU
TLSHT1ADF3F842F9418F17C9C726F6BBFE42C836166B79D7FA310299247FA0378A4D60E39611
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
File size163.2 KB
History
First seen on VirusTotal2026-10-31 18:03 UTC
Last submission2026-10-31 18:03 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:05 UTC
Known Names
  • iranbot-ultimate.arm5
hash_md5 430d14ad0baf5ec1e24b014966378d60 VT 16 / 75

IOC database

Type
hash_md5
Value
430d14ad0baf5ec1e24b014966378d60
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 16 of 75 VirusTotal vendors

VendorVerdictDetection
Antiy-AVL malicious Trojan[Backdoor]/Linux.Mirai
DrWeb malicious Linux.Mirai.11295
Elastic malicious Linux.Generic.Threat
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Linux.Bot
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
Lionic malicious Trojan.ELF.Mirai.4!c
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Trojan:Linux/Mirai.Z!MTB
Rising malicious Backdoor.Mirai/Linux!1.11724 (CLASSIC)
SentinelOne malicious Static AI - Malicious ELF
Tencent malicious OB:Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.DJ.gen!Camelot

Details From VirusTotal

Basic Properties
MD5430d14ad0baf5ec1e24b014966378d60
SHA-181d878eacaaba3e45dfa4d8e61b65bb0f9bcf655
SHA-256a38e01fb77059eb4032fabd7acd8c35872a3dcde1ba04c7ceb0bfc11e63d4d9a
VHash8611a64c71b514818e2ac595e7559ba9
SSDEEP3072:/khFyBb05U4Mpu6KFzI7TAyJECR9+IOwUe0tfkFEFjAM2VUy0oYWHAv2feoBcM9h:/kTK3pu66ehe7HfoMopJYWHAOfvW4fuU
TLSHT1ADF3F842F9418F17C9C726F6BBFE42C836166B79D7FA310299247FA0378A4D60E39611
File typeELF
File type tagelf
MagicELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
File size163.2 KB
History
First seen on VirusTotal2026-10-31 18:03 UTC
Last submission2026-10-31 18:03 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:05 UTC
Known Names
  • iranbot-ultimate.arm5

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 167072 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:36:23.

Remediations (10)

  • public-research/iranbot/report.md at main · deepfield/public ... - GitHub
    web:github.com

    IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...

  • public-research/iranbot at main · deepfield/public-research
    web:github.com

    IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...

  • Prophetic Post by Intern on CVE-2023-1389 Foreshadows Mirai Botnet ...
    web:isc.sans.edu

    Last week, Jonah Latimer posted here about traffic he saw to his own EC2 web honeypot exploiting CVE-2023-1389. I found this looking at new URL strings to our honepot network, and so for on 29 Nov 23, there have been about 300 detections for this vulnerability pulling a shell script from 45.95.146.26 a quick little shell script that does little more than figure out the architecture of the ...

  • Kirk on Security - In-depth security news and investigation
    web:kirkonsecurity.com

    Iranbot instead configured its HTTP flood to function as a self-doxxing mechanism. Every WAF in the world that processes a single HTTP request from this botnet immediately receives a signed confession.

  • Mirai Botnet | ARM Reverse Engineering Walkthrough
    web:trainsec.net

    Final Thoughts: A Call to Continuous Mastery Unpacking an ARM-based Mirai sample exemplifies the thrill and challenge of modern cybersecurity work. As IoT devices and Linux-based systems become more ubiquitous in enterprise networks, staying on top of evolving threats is essential. Take this as your motivation to keep refining your reverse engineering, malware analysis, and forensics ...

  • URLhaus | http://94.154.43.44/iranbot-ultimate.mips
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • URLhaus | http://176.65.139.156/iranbot-ultimate.mips
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • PDF Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.jisem-journal.com

    Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices compromised by malware.

  • Automated Malware Analysis Management Report for iranbot-ultimate ...
    web:www.joesandbox.com

    Uses the "uname" system call to query kernel version information (possible evasion)

  • Linux Analysis Report iranbot-ultimate.arm5.elf - Joe Sandbox
    web:www.joesandbox.com

    Source: /tmp/ iranbot -ultimate.arm5.elf (PID: 5270) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Source: iranbot -ultimate.arm5.elf, 5270.1.0000563036afa000.0000563036c28000.rw-.sdmp Binary or memory string: 60V!/etc/qemu-binfmt/arm

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.