Matryosh DDoS botnet targets Android-Based devices via ADB

guest · Feb 5, 2021

Matryosh DDoS botnet targets Android-Based devices via ADB
February 4, 2021
https://securityaffairs.co/wordpress/114216/malware/matryosh-ddos-botnet-android.html

On January 25, 2021, researchers at 360 netlab detected a suspicious ELF file, initially attributed to Mirai, but that later revealed his nature, a new bot tracked as Matryosh.

“On January 25, 2021, 360 netlab BotMon system labeled a suspicious ELF file as Mirai, but the network traffic did not match Mirai’s characteristics. This anomaly caught our attention, and after analysis, we determined that it was a new botnet that reused the Mirai framework, propagated through the ADB interface, and targeted Android-like devices with the main purpose of DDoS attacks.” reads the analysis published by the experts.
The Matryosh bot reuses the Mirai botnet framework and propagates through exposed Android Debug Bridge (ADB) interfaces to infect Android-like devices.
Click to expand...

Qihoo 360 Netlab: New Threat: Matryosh Botnet Is Spreading

Conclusion
Matryosh's cryptographic design has some novelty, but still falls into the Mirai single-byte XOR pattern, which is why it is easily flagged by antivirus software as Mirai; the changes at the network communication level indicates that its authors wanted to implement a mechanism to protect C2 by downlinking the configuration from the cloud, doing this will bring some difficulties to static analysis or simple IOC simulator.

However, the act of putting all remote hosts under the same SLD is not optimal, it might change and we will keep an eye on it.All the related domains have been blocked by our DNSmon system.
Click to expand...

Log in or Sign up

Matryosh DDoS botnet targets Android-Based devices via ADB

guest Guest

Log in or Sign up

Matryosh DDoS botnet targets Android-Based devices via ADB

guest Guest

Useful Searches