TF-MAL-elf.matryosh
📛 Threat Title
Malware family: Matryosh
Description
ThreatFox malware family `elf.matryosh`. Printable name: Matryosh.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.matryosh
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.matryosh
IOC database
- Type
- domain
- Value
elf.matryosh- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.matryosh
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.matryosh
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
Matryoshka is a malware framework used by CopyKittens that consists of a dropper, loader, and RAT. It has multiple versions; v1 was seen in the wild from July 2016 until January 2017. v2 has fewer commands and other minor differences.
-
web:blog.netlab.360.com
Matryosh has no integrated scanning, vulnerability exploitation modules, the main function is DDoS attack, it supports tcpraw, icmpecho, udpplain attacks, the basic process is shown in the following figure.
-
web:cyberpress.org
A new evolution in the "ClickFix" social engineering campaign targeting macOS users. This latest variant, dubbed Matryoshka due to its nested obfuscation techniques, uses deceptive tactics to trick victims into executing a malicious Terminal command. While the ClickFix strategy is not new, Matryoshka introduces stronger evasion methods, making detection more challenging for automated ...
-
web:cybersecuritynews.com
Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Matryoshka RAT malware family including references, samples and yara signatures.
-
web:securityaffairs.com
Matryosh DDoS botnet targets Android-Based devices via ADB Netlab researchers spotted a new Android malware , dubbed Matryosh , that is infecting devices to recruit them in a distributed denial-of-service (DDoS) botnet. On January 25, 2021, researchers at 360 netlab detected a suspicious ELF file, initially attributed to Mirai, but that later revealed his nature, a new bot tracked as Matryosh ...
-
web:www.cyberinsight.ca
In the ever-evolving landscape of cybersecurity, a new threat has emerged: the Matryoshka methodology. Named after the Russian nesting dolls, this technique involves layering malware within seemingly innocuous files, making detection and mitigation a complex task.
-
web:www.fortinet.com
FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.
-
web:www.intego.com
Executive Summary Intego Antivirus Labs is tracking an evolution of the "ClickFix" social engineering campaign targeting macOS users. Dubbed Matryoshka Intego analyzed the Matryoshka ClickFix variant using typosquatting and a Terminal paste lure to deliver an AppleScript stealer and target crypto wallets.
-
web:www.tomsguide.com
The botnet malware , which the researchers at Qihoo 360's Netlab are calling " Matryosh " because its functions are layered like a Russian matryoshka nesting doll, using the Android Debug Bridge (ADB ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.