🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain darknessdz16.ddns.net.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1983985
IOC: darknessdz16.ddns.net
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown RAT
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS24940 HETZNER-AS
Country:- DE
First seen:2026-10-25 06:20:56 UTC
Last seen:never
UUID:87348b8f-cffd-11f1-a74e-42010aa4000a
Reporter Dense
Reward 5 credits from ThreatFox
Tags:BuStation golang linux RAT

Avatar
Dense
Static analysis of ADB/Cowrie archive Go ELF SHA256 498bf6e48bca1fb616a51a274cae20d120d8c47cae6d3cad985e72254d18d575 captured 2026-10-09. main.parseConfig at 0x5493e0 sets default C2 darknessdz16.ddns.net and TCP port 99, then supports BS_HOST/BS_PORT overrides. Agent dial constructs host:port and calls Go net TCP dialing. BuStation markers and RAT command handlers (file/process/shell operations), persistence via cron/bashrc/systemd/XDG. API family unknown_rat used because exact family is unregistered. No sample execution, DNS lookup or C2 connection; this reports compiled-in configuration, not current server activity.