MB-c02ebdb7bc04e053235feb0399c9ee1d32416542424095ecab60e21dc2fc7a11
high
📛 Threat Title
Unknown: iranbot-ultimate.mipsel
Description
File type: elf. Size: 216180 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-23 07:13:51.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
c02ebdb7bc04e053235feb0399c9ee1d32416542424095ecab60e21dc2fc7a11
IOC database
- Type
- hash_sha256
- Value
c02ebdb7bc04e053235feb0399c9ee1d32416542424095ecab60e21dc2fc7a11- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
513e71b0ebd59183f28193e3d1a3828419ec09a5
IOC database
- Type
- hash_sha1
- Value
513e71b0ebd59183f28193e3d1a3828419ec09a5- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
6bbf428ec79215946219b0782b4c4ba3
IOC database
- Type
- hash_md5
- Value
6bbf428ec79215946219b0782b4c4ba3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 216180 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-10-23 07:13:51.
Remediations (10)
-
web:community.immersivelabs.com
Most implants wait for an operator to send commands. Iris, also tracked as C2Agent, waits for a goal. The operator types something like "get the administrator's password" and an AI model takes it from there, choosing each command, reading the output and deciding what to do next. If you defend Windows endpoints in an organization that uses AI tools, this one's worth your time.
-
web:github.com
IranBot is a DDoS botnet that runs the standard malware maturation story in reverse. Over six weeks and three builds, from an armv7l binary on 2026-06-08 to a self-spreading x86_64 worm on 2026-07-20, it shed its command encryption, stripped its polish, and discarded most of its branding. The first build carried a bespoke command cipher, seven attack methods, and a proper systemd service. The ...
-
web:github.com
IranBot is a self-branded ("IRAN-BOTNET", "death to Israel") ARM/Linux and x86_64 DDoS botnet tracked across three distinct builds between June and July 2026. Attribution is by code, not the branding. Over six weeks the family shed its command encryption, its polish, and its branding while gaining a telnet backdoor and then self-propagation, and it never reused command-and-control ...
-
web:threatfox.abuse.ch
The page below gives you an overview on IOCs that are tagged with IranBot . You can also get this data through the ThreatFox API. Database Entry ... Indicators Of Compromise The table below shows all indicators of compromise (IOCs) that are associated with this particulare tag (max 1000).
-
web:urlhaus.abuse.ch
Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with iranbot . Database Entry ... Malware URLs The table below shows all malware URLs that are associated with this particular tag (max 1000).
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.joesandbox.com
Source: /tmp/ iranbot -ultimate.mipsel.elf (PID: 4114) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Source: iranbot -ultimate.mipsel.elf, 4114.1.000055791f6df000.000055791f766000.rw-.sdmp Binary or memory string: yU!/etc/qemu-binfmt/mipsel
-
web:www.joesandbox.com
Source: iranbot -ultimate.mipsel.elf, 4114.1.00007ffd570cd000.00007ffd570ee000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.unknowncheats.me
Quick overview The tool rebuilds a specific Wardogs EXE so it can run without relying on Theia's protection runtime. It decrypts protected pages, copi
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.