ตัวดำเนินการ XLoader Botnet Mask C&เซิร์ฟเวอร์ C โดยใช้ทฤษฎีความน่าจะเป็น
Check Point ได้ค้นพบบ็อตเน็ต XLoader เวอร์ชันใหม่, an information-stealing botnet that attacks Windows and MacOS systems that uses a new way to mask C&เซิร์ฟเวอร์ซี.
According to experts from จุดตรวจ, the new version of เอ็กซ์โหลดเดอร์ uses probability theory ถึง “hide” attackers’ ค&เซิร์ฟเวอร์ซี, making malware very difficult to detect.
High stealth is achieved by hiding the domain name of the real C&C server along with a configuration containing 64 fake domains, from which 16 domains are randomly selected, and then two of these 16 are replaced with a fake C&C address and a real address.
คุณอาจสนใจที่จะรู้ว่าอะไร Russian ข้างหน้า Botnet Can Do Much More than Massive ดีดอส Attacks.
In new versions of XLoader, the mechanism has changed: after selecting 16 false domains from the configuration, the first eight domains are overwritten and given new random values before each communication cycle. ในเวลาเดียวกัน, measures are taken to skip the real domain.
นอกจากนี้, เอ็กซ์โหลดเดอร์ 2.5 replaces three domains from the created list with two fake server addresses and the real C&C server domain. The ultimate goal of the hackers is obvious – to prevent the discovery of the real C&เซิร์ฟเวอร์ซี, based on the delays between accesses to the domains.
XLoader first creates a list of 16 domains that are randomly selected from the 64 domains stored in the configuration. After each attempt to access the selected 16 domains, the following code is executed:
