ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://api.telegram.org/bot8850962001:AAGZazMZdUQkJOgJEP9YX1afUccTTnMmO5A/.

Database Entry

IOC ID:	1955651
IOC:	https://api.telegram.org/bot8850962001:AAGZazMZdUQkJOgJEP9YX1afUccTTnMmO5A/
IOC Type :	url
Threat Type :	botnet_cc
Malware:	Unknown RAT
Confidence Level :	Confidence level is high (90%)
Is compromised? :	False
ASN:	AS62041 Telegram
Country:	VG
First seen:	2026-10-06 14:30:51 UTC
Last seen:	never
UUID:	eda11901-c18d-11f1-bd81-42010aa4000a
Reporter	ksi_digital
Reward	5 credits from ThreatFox
Tags:	backdoor cowrie elf golang honeypot telegram telnet

ksi_digital

Telegram bot used as C2 by a custom Go backdoor (Go module "agent", go1.27.1, not Mirai) installed by agent_i.sh from 176.65.134.119 (our ThreatFox 1953800). How we observed it: the installer reached our Cowrie telnet honeypot; in our sandbox we fetched all 8 Linux builds from http://176.65.134.119/agent_<arch> (x86_64, i686, aarch64, armv7, mips, mipsle, mips64, mips64le). Every build hard-codes the same token 8850962001:AAGZazMZdUQkJOgJEP9YX1afUccTTnMmO5A and chat id -1004441259610, next to getChat/pinned_message/getUpdates/sendMessage and functions main.tgGetPinned, tgGetUpdates, tgSend, telegramFallbackLoop, resolveC2, parseC2Line, runCmd. Live sandbox run of a4f5bec5 (x86_64) 2026-10-06 10:10-10:13 UTC: the only connection was TLS to 149.154.166.110:443 with SNI api.telegram.org, held open for about 3 min (long-poll); 176.65.134.119:4444 (ThreatFox 1953806, tagged Mirai there) was allowed but never contacted. Persistence: systemd user unit systemd-logind.service ("System Logging Helper", Restart=always), .bashrc/.profile, cron, rc; process renamed to [kworker/0:1-events]. Build hashes submitted separately. Confidence 90 = token extracted from 8 builds and live TLS to api.telegram.org observed; message content not inspected.