Honeypot capture
godhive
Novel, not on VTC2 live
Purpose-built Rust framework. A multi-chain wallet drainer and exchange-withdrawal automation come first, with XMRig mining as the fallback, plus a worm and a command channel layered to survive takedown. The binary carries strings for far more; the report separates what was observed from what is only scaffolded.
- Family
- godhive
- First seen
- July 2026
- Vector
- Exposed Docker API
- Format
- 6.2 MB x86-64 ELF (static musl), Rust
- VirusTotal
- Not on VirusTotal (fully novel)
- Tags
- rust · crypto-stealer · cryptominer · worm · docker
- Report
- A novel Rust crypto-stealer and miner framework
- Sample
- By request. Email [email protected]
SHA-256
-
4194f2337c2b261ed6e1fd0b6d18f0ba75388bdc91a2658eb827a154ed784f36