ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash f22a00d85ef32ea57af7e9a08f08dbc0c4b3a927e3d823945b619864c1b6e58c.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1886062
IOC: f22a00d85ef32ea57af7e9a08f08dbc0c4b3a927e3d823945b619864c1b6e58c
IOC Type :sha256_hash
Threat Type :payload
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
First seen:2026-08-24 13:10:52 UTC
Last seen:never
UUID:c67d05e7-9faa-11f1-a7c1-42010aa4000a
Reporter denis90711
Reward 5 credits from ThreatFox
Tags:botnet panchan ssh-worm

Avatar
denis90711
Go-based SSH worm/P2P botnet (Panchan family, linux/elf): self-copies to /usr/bin/systemd-worker, scans :22 at ~1000 SYN/s, P2P on TCP 2210, XMRig presets. Same family as 94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00 (in ThreatFox since 2026-07-05).