Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
SKYSEA Client View is a popular piece of asset management software in Japan. The software had a vulnerability (CVE-2016-7836) that allowed remote code execution due to a flaw in processing authentication on the TCP connection with the management console program. | Before March 2018, the attackers used to leverage Wali and the small downloader in order to spread xxmm and Datper.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Before March 2018, the attackers used to leverage Wali and the small downloader in order to spread xxmm and Datper.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Both backdoors have unusually large inflated binaries (ranging between 50,000KB and 200,000KB). This is a tactic used to evade inspection by traditional antivirus software and other security products.
Uses encryption ... RSA + onetime RC4 encryption in its communication
Uses HTTP/S with proxy ... GET or POST request ... Type 0,1: HTTP C2 Communication | Understanding Command and Control - An Anatomy of xxmm Communication ... xxmm communicates with specified C2 server ... supports various communication types
Emdivi is a bot that communicates via HTTP protocol... Agtid is a bot that communicates via HTTP protocol.
Also supports TCP/UDP/ICMP ... Type 4 TCP ... Type 5 UDP ... Type 6 ICMP
"3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode..."; "APT33 has used AES for encryption of command and control traffic."; "Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode)."; "Duqu ... data stream can be encrypted with AES-CBC."; "PoisonIvy uses the Camellia cipher to encrypt communications."
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Downloader/first-stage backdoor associated with REDBALDKNIGHT. Can open a shell and uses a steganography toolkit (xxmm2_builder / xxmm2_steganography) to embed malicious code/configuration (executables or URLs) into image files; shares the same alternative base64+RC4 steganography/encryption approach observed in later Daserf variants.
xxmm is a follow-on backdoor/bot distributed after initial compromise in BRONZE BUTLER/Tick campaigns, with related C&C panel infrastructure and configuration similarities to Wali.
A remote access trojan with multi-protocol command-and-control support over HTTP/S, TCP, UDP, and ICMP. It uses RSA plus one-time RC4 or default-key RC4 with LZNT1 compression and custom Base64-like encoding. It supports system reconnaissance, file listing/upload/download/deletion, directory creation, process creation, remote shell, PowerShell encoded command execution, changing C2 URLs and sleep intervals, plugin loading, and uninstall functionality.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.