Essential information

Value / Name

panchan

Confidence

100/100

Revoked

Yes

Valid from

17/06/2022 13:06

Valid until

20/09/2023 13:06

Pattern type

yara

Published

20/12/2025 19:33

Modified

20/12/2025 20:23

Author / Source

AlienVault

Description

Pattern

rule panchan {
    meta:
        author = "Stiv Kupchik"
        filetype = "ELF"
        version = "1.0"
        reference = ""

    strings:
        $go_magic = "\xFF Go buildinf:" ascii // All go binaries have this magic header - we use this to verify we have a Go binary
        $str_p2p_header = "pan-chan's mining rig hi!" ascii
        $str_sharepeer = "sharepeer" ascii
        $str_sharerigconfig = "sharerigconfig" ascii
        $str_godmode_login = "(*???)/)??" ascii
        $public_key = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwaZwxk7A5U7cejo/8STO\x0a6TjEArLaG+EXhWQxjg2jwgtmNfYTOHg5Ss9e3vHdZCTEo/OIdJQC6If7POa+NbbR\x0a9HkagE0ZYjTXTWNP0PgUxEmcboYkO38fxMpI7Gp+331xzaYT4VY8t5Ko01lvkIoV\x0amxjDKJhSiUbCnFkz76qbjZHpLa0hcpXgO1sXx1IciwaVqlLpzncbmK7Ok3ymS3Ee\x0aG3KWQ/NEm4x8yHx07NI6b/cV/z5YOja9jul7POK8Owo17HuFIhfICgFk8Goc1VnM\x0aiypx91Thqz7IWaF5fTFdBp+0p/cUajcA6vDd3TM0FDzT4HafWppjsofOSoLvTwnq\x0aCwIDAQAB"
    
    condition:
        $go_magic and (all of ($str*) or $public_key)
}

Labels / Tags

Labels: botnet cryptominer golang panchan

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.