🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain thunder.godofthunder.st.

Database Entry


IOC ID:1980208
IOC: thunder.godofthunder.st
IOC Type :domain
Threat Type :botnet_cc
Malware: Mirai
Malware alias:Katana
Confidence Level : Confidence level is high (90%)
Is compromised? : False
ASN:AS2152 CENIC-2152
Country:- US
First seen:2026-10-22 15:43:24 UTC
Last seen:never
UUID:73cf6a74-ce27-11f1-8717-42010aa4000a
Reporter coredump
Reward 5 credits from ThreatFox
Tags:botnet CVE-2025-55182 CVE-2026-109618 DDoS Mirai
Reference: https://bazaar.abuse.ch/sample/0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486/

Avatar
coredump
Decrypted from the bot's ChaCha20 string table (key 5a3f2e7b..., see MalwareBazaar comment). thunder.godofthunder.st is the C2; its A record is byte-permuted (answer b0.b1.b2.b3 -> real C2 b0.b3.b1.b2). hackattackkaboom.botlesscucks.st is the self-update host; hik.gettingheadfromduckysmom.st is in the config.