🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash a1284c71db02401df19887a51a738b39fcd5c96716a26bf6cfd0f7de3a5619a3.

Database Entry


IOC ID:1975029
IOC: a1284c71db02401df19887a51a738b39fcd5c96716a26bf6cfd0f7de3a5619a3
IOC Type :sha256_hash
Threat Type :payload
Malware: Unknown malware
Confidence Level : Confidence level is high (85%)
Is compromised? : True
First seen:2026-10-20 05:11:00 UTC
Last seen:never
UUID:a75c4df9-cc3f-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:botnet elf go irc-bot

Avatar
Darkfibr
k4_irc_bot: a Brazilian-Portuguese Go IRC botnet client; twelve per-architecture cross-compiles of one go1.18.10 codebase (mips, mipsle, mips64, mips64le, arm, arm64, i386, x86_64, ppc64, ppc64le, s390x, riscv64). C2 discovered at http://wtf.btwpayme.top:8080. Capabilities include TCP flood, memexec, SOCKS5, SSH key injection, cron/systemd/rc.local persistence, /proc and mount-bind hiding, journald suppression, watchdog and md5-verified self-update. Static analysis only, never executed. Recovered from MalwareBazaar where abuse_ch had filed them 2026-10-19.