🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 00870b27070a7789a569a5d30336253f99b8df64e7eb488413b4c11450614268.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1975028
IOC: 00870b27070a7789a569a5d30336253f99b8df64e7eb488413b4c11450614268
IOC Type :sha256_hash
Threat Type :payload
Malware: Unknown malware
Confidence Level : Confidence level is high (85%)
Is compromised? : True
First seen:2026-10-20 05:11:00 UTC
Last seen:never
UUID:a756aa07-cc3f-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:botnet elf go irc-bot

Avatar
Darkfibr
k4_irc_bot: a Brazilian-Portuguese Go IRC botnet client; twelve per-architecture cross-compiles of one go1.18.10 codebase (mips, mipsle, mips64, mips64le, arm, arm64, i386, x86_64, ppc64, ppc64le, s390x, riscv64). C2 discovered at http://wtf.btwpayme.top:8080. Capabilities include TCP flood, memexec, SOCKS5, SSH key injection, cron/systemd/rc.local persistence, /proc and mount-bind hiding, journald suppression, watchdog and md5-verified self-update. Static analysis only, never executed. Recovered from MalwareBazaar where abuse_ch had filed them 2026-10-19.