The Linux XOR DDoS Botnets

More documents

Recommendations

Info

Target GEO Distribution • ~22K in China, ~12K in USA • 33 target IPs were in POLAND • Others in FR/HK/…
Targets in Map
Page 1 and 2: The Linux XOR DDoS Botnets Network
Page 3 and 4: LDX: Linux XOR DDoS • A notorious
Page 5 and 6: XOR Encrypted Sample Configs • C2
Page 7 and 8: C2 Info Extraction • C&C hostname
Page 9 and 10: Snippet 1 // sample_md5="2d7492e904
Page 11 and 12: C2 Extraction Steps 1. Locating the
Page 13 and 14: Statistics of The Extracted C2s •
Page 15 and 16: The REGISTER message • The first
Page 17 and 18: About Attacking Thread # • It’s
Page 19 and 20: Our Command Tracking System • The
Page 21 and 22: A Sample Tracked Command time famil
Page 23 and 24: Top 10 Attacked Ports • >95% atta
Page 25: Top 100 Active Botnets
Page 29 and 30: Repeated Commands in 1 Attack • W
Page 31 and 32: Different IPs, Same Target? • The
Page 33 and 34: Grouping C2 Servers • It’s not
Page 35 and 36: The Largest C2 Server Net: N1 • T
Page 37 and 38: LDX Bots Distribution in Map
Page 39: Q&A

The Linux XOR DDoS Botnets

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?