The Linux XOR DDoS Botnets

More documents

Recommendations

Info

Net of LDX C2 Servers
<strong>The</strong> Largest C2 Server Net: N1 • <strong>The</strong>re were 81 C2 IPs and 34 hostnames in N1 net – Most of LDX botnets we tracked belonged to this net – Other families of botnets were found to be related to this net • elknot/mayday • It’s thought they were run by a very powerful group of crooks
Page 1 and 2: The Linux XOR DDoS Botnets Network
Page 3 and 4: LDX: Linux XOR DDoS • A notorious
Page 5 and 6: XOR Encrypted Sample Configs • C2
Page 7 and 8: C2 Info Extraction • C&C hostname
Page 9 and 10: Snippet 1 // sample_md5="2d7492e904
Page 11 and 12: C2 Extraction Steps 1. Locating the
Page 13 and 14: Statistics of The Extracted C2s •
Page 15 and 16: The REGISTER message • The first
Page 17 and 18: About Attacking Thread # • It’s
Page 19 and 20: Our Command Tracking System • The
Page 21 and 22: A Sample Tracked Command time famil
Page 23 and 24: Top 10 Attacked Ports • >95% atta
Page 25 and 26: Top 100 Active Botnets
Page 27 and 28: Targets in Map
Page 29 and 30: Repeated Commands in 1 Attack • W
Page 31 and 32: Different IPs, Same Target? • The
Page 33: Grouping C2 Servers • It’s not
Page 37 and 38: LDX Bots Distribution in Map
Page 39: Q&A

The Linux XOR DDoS Botnets

Create successful ePaper yourself

Delete template?

Save as template?