ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash ef355778546bc6e044330691404b63eddf83d7fc6073047394a25dd0e98c7d7d.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1817387
IOC: ef355778546bc6e044330691404b63eddf83d7fc6073047394a25dd0e98c7d7d
IOC Type :sha256_hash
Threat Type :payload
Malware: XMRIG
Confidence Level : Confidence level is high (90%)
Is compromised? : False
First seen:2026-05-23 08:59:06 UTC
Last seen:2026-06-01 17:21:18 UTC
UUID:3108a8fd-5607-11f1-b930-42010aa4000a
Reporter nullblue67
Reward 5 credits from ThreatFox
Tags:dota3 linux mdrfckr outlaw Shellbot xmrig

Avatar
nullblue67
Outlaw dota3 toolkit tarball. Captured 2026-05-22 via Cowrie SSH honeypot from 102.210.149.105 (ZA, KoTDA). Login ubuntu:Ubuntu123 + mdrfckr SSH key persistence. Tarball extracts .rsync/ directory with XMRig fork (crond UPX-packed), Perl Stealth ShellBot v0.2a (b/run, IRC C2 179.43.139.83:443 channel #001), and multi-arch helpers (kthreadadd32/64). Mining pool 179.43.139.83:80 plus failover siblings 179.43.139.80/81/82/84. Wallet 483fmPjXwX75xmkaJ3dm4vVGWZLHn3GDuKycHypVLr9SgiT6oaZgVh26iZRpwKEkTZCAmUS8tykuwUorM3zGtWxPBFqwuxS. Same /24 as already-reported 179.43.139.84 (elf.perlbot #009 channel) - this dota3 variant pivots channel to #001.