🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain imaweirdo.my.

Database Entry


IOC ID:1974458
IOC: imaweirdo.my
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
First seen:2026-10-19 16:47:00 UTC
Last seen:never
UUID:e0e3c12b-cbda-11f1-bd13-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:dead-drop DHT elf protokol
Reference: https://bazaar.abuse.ch/sample/4cae4c533e96cfa71e62966c8fa6339e1188629d2f0cfe86e040e733e10450e1/

Avatar
wristhulk
Undocumented Linux bot self-named 'protokol-client' (x86-64 build s7cn4.x86, 4cae4c533e96cfa71e62966c8fa6339e1188629d2f0cfe86e040e733e10450e1, dropped by 184.174.96.216). These 4 domains are DNS TXT dead drops for its C2 list: the bot queries TXT directly at 8.8.8.8/8.8.4.4/1.1.1.1/1.0.0.1/9.9.9.9/208.67.222.222, hex-decodes the answer and ChaCha20-decrypts it into ip:port records. Confirmed two ways: decrypted statically from the binary (77-byte ChaCha20 blob at 0x41f5a0) and observed in a sandboxed run (120 TXT queries in 2 min). Same encrypted C2 list is also published via BitTorrent DHT (BEP44 get, 13 bootstrap nodes); C2 sessions use a Noise-NK-style X25519 handshake with a pinned server key. Capabilities: DDoS, XMRig management, SOCKS/back-connect proxy, competitor killer; runs as 'crond'.