ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain irahook.com.

Database Entry


IOC ID:1849167
IOC: irahook.com
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-07-13 06:00:23 UTC
Last seen:never
UUID:cab3e1d1-7e55-11f1-97fa-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:CuteCraft Downloader IRAHook jar java minecraft stealer

Avatar
Anonymous
CuteCraft (aka PikaCraft-Mods), Java stealer/downloader distributed as a trojanized Minecraft mod. C2 dynamically confirmed via sandbox detonation. Beacon: GET /mods/api/log-download?key=ira-<8hex>::<profile>&client=<user>@<os>&status=... ; config pull GET /get/config (AES-256/PBKDF2). UA: irahook-client/1.0 ; header X-Ira-Id: ira-777-prime. Sample SHA256: e2a2f9aa22b140997b5348931219ca2f3a7f54735db1a630394284bf738c6513