TF-MAL-elf.zergeca
📛 Threat Title
Malware family: Zergeca
Description
ThreatFox malware family `elf.zergeca`. Printable name: Zergeca.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.zergeca
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.zergeca
IOC database
- Type
- domain
- Value
elf.zergeca- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.zergeca
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.zergeca
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.xlab.qianxin.com
Functionally, Zergeca is not just a typical DDoS botnet; besides supporting six different attack methods, it also has capabilities for proxying, scanning, self-upgrading, persistence, file transfer, reverse shell, and collecting sensitive device information. From a network communication perspective, Zergeca also has the following unique features:
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:cybernoz.com
The discovery of Zergeca highlights botnets' continuous evolution and increasing sophistication. With its advanced scanning, persistence features, and multi-functional capabilities, Zergeca poses a significant cybersecurity threat.
-
web:malpedia.caad.fkie.fraunhofer.de
Zergeca is a DDoS-botnet and backdoor written in Golang. It uses modified UPX for packing, with the magic number 0x30219101 instead of "UPX!". It is being distributed via weak telnet passwords and known vulnerabilities.
-
web:rewterz.com
Zergeca , a newly discovered botnet capable of executing distributed denial-of-service (DDoS) attacks, has garnered significant attention from cybersecurity researchers.
-
web:sechub.in
The DDoS botnet Zergeca supports six attack methods and implements additional functionalities such as proxying, scanning, self-upgrading, persistence, file transfer, reverse shell, and collecting sensitive device information.
-
web:securitricks.com
Description An analysis of a newly discovered botnet named Zergeca , implemented in Go language, with capabilities for DDoS attacks, proxying, scanning, self-upgrading, persistence, file transfer, reverse shell, and collecting sensitive device information. The report delves into the botnet 's unique features, including its multi-DNS resolution methods, encrypted communication protocol, and ...
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.mphasis.com
The information contained in this message is proprietary. It is for Mphasis and its customers only. Copyright 2023. All rights reserved by Mphasis.
-
web:www.scworld.com
Further examination of the Zergeca botnet revealed four different modules for persistence, proxying, cryptominer and backdoor malware removal, and device takeovers, said researchers, who also noted the botnet's support for six various DDoS intrusions.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.