🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash ec36ef56f434d83d349ce67d2edc544c6f7f13b093713217ca57fdc7fc214601.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1975022
IOC: ec36ef56f434d83d349ce67d2edc544c6f7f13b093713217ca57fdc7fc214601
IOC Type :sha256_hash
Threat Type :payload
Malware: Unknown malware
Confidence Level : Confidence level is high (85%)
Is compromised? : True
First seen:2026-10-20 05:11:04 UTC
Last seen:never
UUID:a732e123-cc3f-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:botnet elf go irc-bot

Avatar
Darkfibr
k4_irc_bot: a Brazilian-Portuguese Go IRC botnet client; twelve per-architecture cross-compiles of one go1.18.10 codebase (mips, mipsle, mips64, mips64le, arm, arm64, i386, x86_64, ppc64, ppc64le, s390x, riscv64). C2 discovered at http://wtf.btwpayme.top:8080. Capabilities include TCP flood, memexec, SOCKS5, SSH key injection, cron/systemd/rc.local persistence, /proc and mount-bind hiding, journald suppression, watchdog and md5-verified self-update. Static analysis only, never executed. Recovered from MalwareBazaar where abuse_ch had filed them 2026-10-19.