🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 77.239.124.135:9111.

Database Entry


IOC ID:1976419
IOC: 77.239.124.135:9111
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS198364 BANATSYNC-SRL
Country:- RO
First seen:2026-10-21 05:31:44 UTC
Last seen:never
UUID:f0c88f62-ccc0-11f1-8fc0-42010aa4000a
Reporter notasandov
Reward 10 credits from sektor7_intel
Tags:ARM elf zig
Reference: https://bazaar.abuse.ch/sample/265b728a1d9ae98eb8c5d30c97fd1ce94ade71fbd3944987fb983bcac33c3618/

Avatar
notasandov
C2 hard-coded in the Zig-built l4_* bot (sha256 265b728a...). Static analysis: resolves 77.239.124.135 port 9111 over TCP, sends 'REGISTER linux <arch>', accepts 'stop' and 'update' (update fetches http://77.239.124.135/l4_<arch> to /tmp/.upd). Payload URLs on 94.237.6.18 seen 2026-10-14.