🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain keke.lol.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:2020039
IOC: keke.lol
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown RAT
Confidence Level : Confidence level is high (90%)
Is compromised? : False
ASN:AS132203 TENCENT-NET-AP-CN
Country:- CN
First seen:2026-11-08 07:47:40 UTC
Last seen:never
UUID:49d5661e-db28-11f1-a74e-42010aa4000a
Reporter LoneNco
Reward 5 credits from ThreatFox
Tags:ens etherhiding IRAHook java minecraft RAT stealer
Reference: https://bazaar.abuse.ch/sample/80a4f9250bf9a8dca131a0a2b1b9525e9338aa79c8d9d295bc61dd61db965ddf/

Avatar
LoneNco
IRAHook ('ewa') Java stealer/RAT C2 domains recovered from the operator's own ENS updates. The 'ewa' text record (AES-256-GCM, key ce93d02ae6136061eaf9dada7fd2a8c977cf4531719b280b63277267f99ddc79) on irahook.eth (wallet 0xBE92A7d0E6b13eD0b9843958735aC6c24147c35D) and turko.eth / el.turko.eth (wallet 0x8B6155c4fd0B10507EE9659099F74A25Be55e7b0) was decrypted across the full on-chain history. These domains were served as the WebSocket C2 (wss://<domain>/ws) at the dates shown. They're historical and may no longer resolve. Dates (first set): acilicak.lol set 2026-08-26 via irahook.eth; gelmedi.lol set 2026-08-30 via turko.eth; zbabuvj.lol set 2026-09-13 via el.turko.eth; 3169.lol set 2026-09-16 via el.turko.eth; dumbaero.lol set 2026-09-16 via el.turko.eth; 7dak.lol set 2026-09-17 via el.turko.eth; wuhhuu.lol set 2026-09-18 via el.turko.eth; 3131.lol set 2026-09-19 via el.turko.eth; ahmetaga.lol set 2026-09-19 via el.turko.eth; keke.lol set 2026-09-20 via el.turko.eth; kiyamet.lol set 2026-09-20 via el.turko.eth; lastabuse.lol set 2026-09-21 via el.turko.eth; kabab.lol set 2026-09-22 via el.turko.eth; helelele.lol set 2026-09-23 via el.turko.eth. Current C2: ewababa.sbs. Related samples: loader 66cd0c8614ada8ef7600c0903ca4795b2f97162c6ef1c4718b1a26879865aab3, stage 2 80a4f9250bf9a8dca131a0a2b1b9525e9338aa79c8d9d295bc61dd61db965ddf.