SSH-Targeting Golang Bots Becoming the New Norm
Tags
attack-pattern: Botnet - T1583.005 Botnet - T1584.005 Credentials - T1589.001 Domains - T1583.001 Domains - T1584.001 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Ssh - T1021.004 Vulnerabilities - T1588.006 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID d67a0caa-a0f3-450d-ba17-e86a6ed10c59
Fingerprint a78c99590819ce4b
Analysis status DONE
Considered CTI value 2
Text language
Published June 19, 2020, midnight
Added to db Sept. 11, 2022, 12:35 p.m.
Last updated Sept. 4, 2024, 7:49 a.m.
Headline SSH-Targeting Golang Bots Becoming the New Norm
Title SSH-Targeting Golang Bots Becoming the New Norm
Detected Hints/Tags/Attributes 48/1/57
Source URLs
Redirection Url
Details Source https://labs.bitdefender.com/2020/06/ssh-targeting-golang-bots-becoming-the-new-norm/
URL Provider
Details Provider Source level domain
Details bitdefender.com labs.bitdefender.com
Attributes
Details Type #Events CTI Value
Details sha1 1 
c979b74150642985c67756998e3eda1dbcddd92d
Details sha1 1 
5e4607eeac2648977a34696d262c352d39572f27
Details sha1 1 
9d43843ec98c67059020772cc5b2e8a7eb9bad0c
Details sha1 1 
615444a26a057ebc3288f75f7ef78a3ff78fbaf4
Details sha1 1 
6de5e6a3dc676985d819f2c2ac62d46fa5dc5d2f
Details sha1 1 
267c05d6410e8ab03b188b218426952905f6b9d4
Details sha1 1 
80e7ab516de2e3f47852d71b5c7a0c306ea6b5a5
Details sha1 1 
3731c18fb084ebc95bfec29ae4bbae2c6ecbd7fd
Details sha1 2 
007dd1362ca43d06b0ca633aa6099493063df7ca
Details sha1 2 
0296faedf44c3c376794b09fa59ead1512712a68
Details sha1 2 
05be2d82e8a98da991699f88bda9d1160525c957
Details sha1 2 
086ce30530db7a1b72b9b0b270cd4a1dcc2fa9e6
Details sha1 2 
161dd2e5634e9f5f85632500ea701886ce49a155
Details sha1 2 
1c62dfc839e694fd6517dfd736ee8d312ca0ff21
Details sha1 2 
2a1e03b568b4e86f36083adf249966aaca610550
Details sha1 2 
3be8947a898d0539666c98c00b53ebe84c006fcf
Details sha1 2 
3ccdbd4044623f9639277baa9f3dbec42c66fcf0
Details sha1 2 
3dc474b7f4779e4dce565d7c863e0a01fd17a059
Details sha1 2 
56534152c27b991b2bf54635027d11cd8287d227
Details sha1 2 
5a0f8d0607e20aea0157a5572039ff255c0ae88b
Details sha1 2 
5d1aa62b6c67b5678a3697153afbcdf45932f4af
Details sha1 2 
6278fa0cf6c5c1f98f242702ea95ce38a40b79cf
Details sha1 2 
70a010d97e9d4cc64aff0daeefcd2ca44d22b7f4
Details sha1 2 
7afac23e95b4f83769f7ff7df462988d997b964a
Details sha1 2 
7fdec673db4fdf3391995cc6adc3895794f8ff02
Details sha1 2 
88aa38f5c03ffdf7f6c3770f6349fbbc86bd9ab4
Details sha1 2 
92b02a4987b360a50f96f86ef3b78a8df2a4d1a8
Details sha1 2 
9454754c054fa94715121062a553d9aac3331065
Details sha1 2 
98b540cfb43f1cbfc9ab558bbf55ca8806942d87
Details sha1 2 
9d51af0e3602702d5096d108aea2fff620031cd2
Details sha1 2 
a79933eb5fd08745c2742dff4b852d57d4b681e4
Details sha1 2 
b47c25a3e34efb40023eeeaddcefa2ead2a71ba8
Details sha1 2 
baf322bc7a837cd37b0cd132221b8ef2cbfda4f3
Details sha1 2 
bfd425f2af8ab662cc28ad53ca0bd5f0e44f0600
Details sha1 2 
c9a570eef414a2511955d704643455ddbfe5d930
Details sha1 2 
cae869da63ceb8997e140f14fa2ffccec55ac8a6
Details sha1 2 
d282272b1eec3aab3956e690e56582792109e822
Details sha1 2 
d331447e55a99692b196147750132770daf28e5b
Details sha1 2 
d39a2f63dc953c0c1c67cd7a9bec3c5aab9d3628
Details sha1 2 
d6674f5563f07a4ef2db7e37967cffe78b98e85e
Details sha1 2 
dbbe855f86059b19bb91b8c78dd2770c9565b733
Details sha1 2 
dcdd9b4f3fb5a713e5e6ac81f5eb0f1f283ee7ea
Details sha1 2 
e266f3ca2ad74a3398d3c0996da1c11c631554cb
Details sha1 2 
fcbc3eb70cc8b1bd19b7d990ba360f1ea2a359c3
Details sha1 1 
fd9ed7940e949f7c5ad0346fd719407de2d1989c
Details IPv4 1 
193.56.28.120
Details IPv4 1 
185.234.216.34
Details Url 1 
http://193.56.28.120/linux-386-ircflu
Details Url 1 
http://193.56.28.120/linux-amd64-ircflu
Details Url 1 
http://193.56.28.120/linux-arm-ircflu
Details Url 1 
http://193.56.28.120/linux-mips64-ircflu
Details Url 1 
http://193.56.28.120/linux-mips64le-ircflu
Details Url 1 
http://193.56.28.120/linux-mips-ircflu
Details Url 1 
http://193.56.28.120/linux-mipsle-ircflu
Details Url 1 
http://193.56.28.120/linux-ppc64-ircflu
Details Url 1 
http://193.56.28.120/linux-ppc64le-ircflu
Details Url 1 
http://193.56.28.120/linux-s390x-ircflu