ایکس لوڈر بوٹنیٹ آپریٹرز ماسک سی&امکانی نظریہ کا استعمال کرتے ہوئے سی سرورز

Check Point has discovered a new version of the XLoader botnet, an information-stealing botnet that attacks Windows and MacOS systems that uses a new way to mask C&C servers.

According to experts from Check Point, the new version of XLoader uses probability theory tohideattackers’ سی&C servers, making malware very difficult to detect.

We describe the changes malware authors applied to XLoader to obscure the C&C infrastructure – more than anything we saw before. Now it is significantly harder to separate the wheat from the chaff and discover the real C&C servers among thousands of legitimate domains used by Xloader as a smokescreen.Check Point experts write.

High stealth is achieved by hiding the domain name of the real C&C server along with a configuration containing 64 fake domains, from which 16 domains are randomly selected, and then two of these 16 are replaced with a fake C&C address and a real address.

You might also be interested to know what Russian Fronton Botnet Can Do Much More than Massive DDoS Attacks.

In new versions of XLoader, the mechanism has changed: after selecting 16 false domains from the configuration, the first eight domains are overwritten and given new random values before each communication cycle. At the same time, measures are taken to skip the real domain.

اس کے علاوہ, XLoader 2.5 replaces three domains from the created list with two fake server addresses and the real C&C server domain. The ultimate goal of the hackers is obviousto prevent the discovery of the real C&C server, based on the delays between accesses to the domains.

XLoader first creates a list of 16 domains that are randomly selected from the 64 domains stored in the configuration. After each attempt to access the selected 16 domains, the following code is executed:

سی&C servers of the XLoader botnet

The purpose of this piece of code is to partially overwrite the list of accessed domains with new random values. Therefore, if XLoader runs long enough, it will access new randomly selected domains. It’s important to pay attention to the fact that only the first 8 values are overwritten, and the remaining 8 remain the same as those that were selected immediately after launch.experts say.
Experts are very concerned about the fact that attackers use the principles of probability theory for their vile purposes. This suggests that hackers are becoming more resourceful in developing tactics and tools.

ہیلگا اسمتھ

مجھے ہمیشہ کمپیوٹر سائنسز میں دلچسپی تھی۔, خاص طور پر ڈیٹا سیکیورٹی اور تھیم, جسے آج کل کہا جاتا ہے۔ "ڈیٹا سائنس", میری ابتدائی نوعمری سے. ایڈیٹر ان چیف کے طور پر وائرس ہٹانے والی ٹیم میں آنے سے پہلے, میں نے کئی کمپنیوں میں سائبر سیکیورٹی کے ماہر کے طور پر کام کیا۔, ایمیزون کے ٹھیکیداروں میں سے ایک سمیت. ایک اور تجربہ: مجھے آرڈن اور ریڈنگ یونیورسٹیوں میں پڑھانا ملا ہے۔.

جواب چھوڑیں

یہ سائٹ سپیم کو کم کرنے کے لیے Akismet کا استعمال کرتی ہے۔. جانیں کہ آپ کے تبصرے کے ڈیٹا پر کیسے کارروائی کی جاتی ہے۔.

واپس اوپر کے بٹن پر