🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 176.65.139.227:80.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1973811
IOC: 176.65.139.227:80
IOC Type :ip:port
Threat Type :payload_delivery
Malware: Mirai
Malware alias:Katana
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS219502 STORMCLOUD-AS
Country:- US
First seen:2026-10-19 06:20:16 UTC
Last seen:never
UUID:a5312c3a-cb61-11f1-bd13-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:elf minefox Mirai
Reference: https://bazaar.abuse.ch/sample/68805da92456eb377426f890b7f95fcd7d5552f148fe033827d67566027f4cd7/

Avatar
wristhulk
Mirai-family 'minefox' build (C2 minefox.lol / 176.65.139.196, loader kla.sh, payloads saved as 'robben'). Static analysis (Ghidra) of px86 68805da92456eb377426f890b7f95fcd7d5552f148fe033827d67566027f4cd7: an L7 'browser' attack handler downloads a helper with a raw HTTP request 'GET /bins/browser_<arch> HTTP/1.0' to hard-coded 176.65.139.227:80, saves it as /tmp/browser and runs it with the target URL, rate and duration. Same build also spreads kla.sh via an applyapp.cgi SETROOTCERTIFICATE command injection. 176.65.139.227 previously served minefox /bins/* builds (URLhaus, 2026-09-16).