xlabs_v1 is a Mirai-derived botnet that targets internet-exposed devices running Android Debug Bridge (ADB) on TCP port 5555. It supports 21 flood variants across TCP, UDP, and raw protocols including RakNet and OpenVPN-shaped UDP capable of bypassing consumer-grade DDoS protection. The malware supports multi-architecture builds covering ARM, MIPS, x86-64, and ARC. It features a bandwidth-profiling routine that opens 8,192 parallel TCP sockets to geographically nearest Speedtest servers, saturates them for 10 seconds, and reports measured data transfer rate back to the control panel. The bot is statically-linked ARMv7, runs on stripped Android firmwares, and is delivered through ADB-shell pastes into /data/local/tmp. It includes a 'killer' subsystem to terminate competitors and lacks persistence mechanisms, requiring re-infection after bandwidth profiling. Contains ChaCha20-encrypted strings embedded in every build.