s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-3841688a8c1044321b3cf4c25331dcbce5d57817437c78b283d6828b6715976a high

📛 Threat Title

Mirai: iranbot-ultimate.ppc

Category: Mirai Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: elf. Size: 171316 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:35:49.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 3841688a8c1044321b3cf4c25331dcbce5d57817437c78b283d6828b6715976a VT 19 / 75

IOC database

Type
hash_sha256
Value
3841688a8c1044321b3cf4c25331dcbce5d57817437c78b283d6828b6715976a
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA256 hash of a malware sample (payload) attributed to Mirai

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 19 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious DDoS:Linux/Mirai.FTD
Antiy-AVL malicious Trojan[Backdoor]/Linux.Gafgyt
ClamAV malicious Unix.Trojan.Mirai-10012200-0
DrWeb malicious Linux.Mirai.11295
ESET-NOD32 malicious Linux/Mirai.FNP trojan
Fortinet malicious ELF/Agent.BA!tr
Google malicious Detected
huorong malicious Trojan/Linux.Mirai.np
Ikarus malicious Trojan.Linux.Multiverze
Kaspersky malicious HEUR:Backdoor.Linux.Mirai.nx
Kingsoft malicious Linux.Backdoor.Mirai.nx
McAfeeD malicious Trojan:Linux/Mirai.EQQ
Microsoft malicious Trojan:Linux/Multiverze!rfn
Rising malicious Backdoor.Mirai/Linux!8.13285 (CLOUD)
Sangfor malicious Backdoor.Linux.Mirai.V7eg
Sophos malicious Mal/Generic-S
Symantec malicious Linux.Mirai
Tencent malicious OB:Backdoor.Linux.Mirai.tnog
Varist malicious E32/Mirai.GE.gen!Eldorado

Details From VirusTotal

Basic Properties
MD57d916e2c130c7165770c4e26f259dea1
SHA-1321850f5b70b917a4a98fe740f4b97c28c9b0dbb
SHA-2563841688a8c1044321b3cf4c25331dcbce5d57817437c78b283d6828b6715976a
VHashf70f900bc1643228feb61b3f0fd640c5
SSDEEP3072:I1MLw83OG3HhnHix9quOLOpNUx9klVaQuOO5Nz:qMLw8z3ULquOeNUx9klVaQirz
TLSHT1C2F35B02770D4E43D1533EF02B3B1BE1879FEDA218B5A540792EBEC99271DB12185EE9
File typeELF
File type tagelf
MagicELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
File size167.3 KB
History
First seen on VirusTotal2026-10-31 14:44 UTC
Last submission2026-10-31 14:44 UTC
Last analysis2026-10-31 18:03 UTC
Last modified on VirusTotal2026-10-31 20:04 UTC
Known Names
  • vm9qhpvd.exe
  • idi79ad.exe
  • iranbot-ultimate.ppc
hash_sha1 321850f5b70b917a4a98fe740f4b97c28c9b0dbb VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/321850f5b70b917a4a98fe740f4b97c28c9b0dbb

IOC database

Type
hash_sha1
Value
321850f5b70b917a4a98fe740f4b97c28c9b0dbb
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/321850f5b70b917a4a98fe740f4b97c28c9b0dbb

hash_md5 7d916e2c130c7165770c4e26f259dea1 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/7d916e2c130c7165770c4e26f259dea1

IOC database

Type
hash_md5
Value
7d916e2c130c7165770c4e26f259dea1
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/7d916e2c130c7165770c4e26f259dea1

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: elf. Size: 171316 bytes. Tags: elf, Mirai, Torii. Reporter: abuse_ch. First seen: 2026-10-31 14:35:49.

Remediations (10)

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    You are currently viewing the MalwareBazaar entry for SHA256 16c4c2947ed6644acaf5a09814fd314c480b32dae0182f18830b93a88ec49b45. While MalwareBazaar tries to identify ...

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    You are currently viewing the MalwareBazaar entry for SHA256 7fa5131bc2a628f06499dfc8728f29f590abbbb2ebda3175b726fcccd6fab4c6. While MalwareBazaar tries to identify ...

  • Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15-Node ...
    web:cybersecuritynews.com

    Iran-linked hacker exposed after open server leak reveals botnet tools, SSH scripts, DDoS binaries, and active C2 development infrastructure.

  • ThreatFox | IranBot
    web:threatfox.abuse.ch

    The table below shows all indicators of compromise (IOCs) that are associated with this particulare tag (max 1000).

  • URLhaus | iranbot
    web:urlhaus.abuse.ch

    Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).

  • URLhaus | http://94.154.43.44/iranbot-ultimate.mips
    web:urlhaus.abuse.ch

    Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.

  • PDF Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.jisem-journal.com

    Eradicate Mirai malware is simple, is necessary just disconnect the device from the network and perform a reboot. Mirai malware exists in dynamic memory, rebooting the device clears the malware (US-CERT, 2016).

  • TrojanDownloader:Script/Iranbot.A - microsoft.com
    web:www.microsoft.com

    Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.

  • PDF Mirai Botnet - Quorum Cyber
    web:www.quorumcyber.com

    Mirai initially infected and weaponised devices such as smart cameras and Realtek routers2. The botnet variant was created in a racketeering attempt by the cofounders of Protraf Solutions, an organisation offering DDoS mitigation services.

  • Malware Detection and Mitigation Techniques: Lessons Learned from Mirai ...
    web:www.researchgate.net

    Presenting an in-depth security analysis of Mirai botnet, a malware that affected the availability of banking systems and put in evidence a new form of DDoS attack that works with IoT devices ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.