{"id":"44e6f71cf949e4b3f8bf34d193ac449f","title":"Go Linux Bot (SSH/Discord) — Go Linux Bot (SSH/Discord) · 木马/恶意软件 · ELF64","md5":"44e6f71cf949e4b3f8bf34d193ac449f","sha256":"38dd590230477de92aec21c75432a4df5df521c6975be04cfa66ffd1853f87a0","family":"Go Linux Bot (SSH/Discord)","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"Go","file_format":"ELF64","compiler":"Go","published_at":"2026-08-06T16:00:00.000Z","summary":"该样本为 Go 语言编译的 Linux x86-64 后门程序(5.2MB, ELF 段头已剥离)。具备完整的 SSH 客户端/服务器功能(包括多种密钥交换算法和认证方式), 通过 Discord Webhook 作为 C2 通信渠道进行数据外泄和指令接收。内置 SFTP 文件传输能力, 可用于横向移动和文件窃取。利用多达 7 个不同 IP 地理定位服务获取受害主机公网 IP。Discord Webhook URL 完全硬编码, 可用于追踪和关停。此样本疑似 Linux 僵尸网络节点, 具备 SSH 自传播能力。","url":"https://zseceye.com/report/44e6f71cf949e4b3f8bf34d193ac449f","json_url":"https://zseceye.com/report/44e6f71cf949e4b3f8bf34d193ac449f.json","html_url":"https://zseceye.com/report/44e6f71cf949e4b3f8bf34d193ac449f","hash_urls":{"md5":"https://zseceye.com/hash/44e6f71cf949e4b3f8bf34d193ac449f","sha256":"https://zseceye.com/hash/38dd590230477de92aec21c75432a4df5df521c6975be04cfa66ffd1853f87a0"},"search_urls":{"md5":"https://zseceye.com/?q=44e6f71cf949e4b3f8bf34d193ac449f","sha256":"https://zseceye.com/?q=38dd590230477de92aec21c75432a4df5df521c6975be04cfa66ffd1853f87a0"},"sample_download_url":"https://zseceye.com/report/44e6f71cf949e4b3f8bf34d193ac449f/sample","sample_filename":"38dd590230477de9.zip","iocs":[],"ips":[]}