ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 120.26.164.252:9918.

Database Entry

IOC ID:	1915667
IOC:	120.26.164.252:9918
IOC Type :	ip:port
Threat Type :	payload_delivery
Malware:	Payload
Confidence Level :	Confidence level is high (85%)
Is compromised? :	False
ASN:	AS37963 ALIBABA-CN-NET
Country:	CN
First seen:	2026-09-12 13:44:23 UTC
Last seen:	never
UUID:	892d4b09-aead-11f1-b569-42010aa4000a
Reporter	Chuan_jian_guo
Reward	5 credits from ThreatFox
Tags:	Downloader elf ssh-worm

Chuan_jian_guo

Malware payload servers serving /linux ELF (3.7MB static x86-64, GCC 11.2.1, custom packed, embedded SSH brute-force dictionary - worm). Dropped by SSH bots via curl/wget//dev/tcp triple-fallback, executed with segmented base64-XOR config argv, writes used cred to /tmp/.opass. Payload captured 2026-09-12 from honeypot, C2 still live.