ThreatFox IOC Database
You are viewing the ThreatFox database entry for url http://91.92.43.221/iranbot-ultimate.aarch64.
Database Entry
| IOC ID: | 1983177 |
|---|---|
| IOC: | http://91.92.43.221/iranbot-ultimate.aarch64 |
| IOC Type : | url |
| Threat Type : | payload_delivery |
| Malware: | Mirai |
| Malware alias: | Katana |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| ASN: | AS207043 DEDIK-IO |
| First seen: | 2026-10-24 15:43:41 UTC |
| Last seen: | 2026-10-26 05:55:42 UTC |
| UUID: | 704afd57-cfb7-11f1-a74e-42010aa4000a |
| Reporter |  Dense |
| Reward | 5 credits from ThreatFox |
| Tags: | elf honeypot IranBot Mirai |
Dense
Iranbot-Ultimate-V1 builds ("join t.me/flylegit"), delivered by a loader script run on an SSH honeypot; each file was captured from these URLs (2026-10-22/24). C2 for these builds already reported: minecraftsmp14[.]duckdns[.]org. C2 traffic is ChaCha20 (key ULT1M4T3-STY-CNC-CH4CH4-K3Y!2026, nonce STY-ULT-0001).SHA256 aarch64 3a713c5ce832c00a959f2603dd757e453c5b4b01b3d2f528ee4636db8c012777
SHA256 armv4l 65a5c5011c2d1686ae033fe23f57893891d787f6d7abeb0434ba8fff709e12d2
SHA256 mips 7a522a8facd97df8ec3022376630080ee9e3b71e9e9a3a15fe60b3a1ce86f78c
SHA256 mipsel 4c7480ddc29b7043661ab8ab12b518d05f9dd54efd00d87b50b6710607384899
SHA256 x86_32 f44a227e87d6ae4e2ac8d0ec5c206a7dfcddde8bfe2b05027bfa458b60e163ca
Loader SHA256 2923ea4ee6579db31e6fb4e28c12b39785ed25d8a5994a7c8f3de199f7933f9a