The Immutable Payload

SHA256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 was first observed on March 31, 2026. It was last observed on June 10, 2026. In between: 85 downloads to 81 unique IP addresses. Same hash. Same binary. Not one byte different.

In an industry obsessed with polymorphic malware, metamorphic engines, and runtime-generated payloads, the Outlaw botnet deploys the same static binary for 2.5 months. This isn't naivety — it's a calculated bet: the targets are unmonitored systems where hash-based detection doesn't exist.

The pattern tells a story. Steady 5-10 infections per week (background propagation), then a May 11-18 explosion — 42 downloads in two weeks from 39 unique IPs. Then near-silence.

The spike isn't random. It's a coordinated push: someone acquired new credential lists, new scanning infrastructure, or simply decided to scale. The crash afterward suggests either operational disruption, goal achieved, or depleted target space.

The 40% Failure Rate

During the May spike: 42 successful a8460f44 downloads alongside 29 empty-hash failures. A 40% failure rate at peak load.

This is the C2 architecture cracking under pressure. The single distribution server — identified in TI-2026-052C as lacking CDN redundancy — can serve baseline traffic. But when the scanning infrastructure finds 39 new targets in two weeks, the download server intermittently fails.

The operators could fix this with a $5/month CDN. They don't. Either they don't care about 40% loss, or the infrastructure is intentionally minimal to reduce forensic exposure. Each additional server is another IP to burn, another hosting account to maintain, another potential seized box.

The Polymorphic Counterpoint

While Outlaw deploys one immutable binary, a parallel operation takes the opposite approach:

22 of 24 "sshd" hashes appear exactly once, from exactly one IP. Each attacker compiles a unique binary — different enough to evade hash-based signatures, similar enough to serve the same purpose: replacing the SSH daemon with a backdoored version.

This is the sophisticated end of the spectrum. Where Outlaw says "we don't care about detection," the sshd backdoor operators say "we must never match a known signature." Two philosophies of persistence, operating in the same victim space.

Ecosystem Consolidation

The hash diversity timeline reveals an ecological pattern:

In the first week, every download was a different binary — 11 unique hashes in 12 downloads. By May, a single payload dominates 80%+ of all activity. The ecosystem collapsed into a monoculture.

This mirrors biological competitive exclusion: when one organism (Outlaw/a8460f44) is sufficiently aggressive at eliminating competition (the kill -9 secure.sh command from TI-2026-052C), other species can't maintain presence. The malware literally kills competing miners on each infected host.

The result: a homogeneous botnet. One binary rules. Others are either killed on arrival or pushed to different ecological niches (the sshd backdoors persist because they serve a different function — access rather than mining).

The Exception: 94f2e4d8

One secondary hash defied the monoculture: 94f2e4d8d44368747fe11fa207dfb6094e55b1f5e0cc4b1c32b9e3c6e7b8e2fd. Twelve downloads from twelve unique IPs, spanning the full 91-day observation window (March 30 — June 29).

Also named "sshd." Also never mutated. But deployed to 12 IPs versus Outlaw's 81. This is either:

• The same operator's secondary payload for specific target profiles
• A competing operator with comparable infrastructure stability but smaller scale
• A specialized variant (e.g., ARM vs x86, or rooted vs non-rooted persistence)

Its survival alongside a8460f44 suggests the two don't compete — they coexist. Perhaps because they target different CPU architectures or implement different persistence mechanisms. The Outlaw botnet has historically supported multiple architectures from a single C2, making interpretation 1 most likely.

The Source Infrastructure

The dominant delivery method is SFTP transfer named "sshd" — the malware copies itself through the same SSH session it used for access. No external HTTP download, no second connection. The compromised SSH session IS the delivery channel.

GitHub as C2: 8 downloads from raw.githubusercontent.com in a single day (April 5), all from one IP. This actor stored their payload in a GitHub repository — abusing the platform's CDN for malware distribution. Fast, reliable, and extremely difficult to pre-emptively block.

31.170.22.205 (Latvia): The "Whisper" infrastructure from TI-2026-052B. Active for exactly one day — deploy, infect, rotate.

"notwork-monitoring": A creative typosquat of "network-monitoring" — designed to appear legitimate in process listings. Four different hashes in one day = rapid iteration testing.