Trusted Design

Down the Rabbit Hole: Botnet Analysis for Non-Reverse Engineers

概要

Talos is often tasked with mapping the backend network for a specific piece of malware. One approach is to first reverse engineer the sample and determine exactly how it operates. But what if there is no time or resources to take the sample apart? This post is going to show how to examine a botnet from the Fareit family, starting with just an IP address. Then, using sandbox communities like Cisco ThreatGRID and open source products like Gephi and VirusTotal, we will track down and visualize the botnet.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

Fareit botnet family (score: 0.59)
Exploring a P2P Transient Botnet - From Discovery to Enumeration (score: 0.59)
Mirai Botnet Indicators (score: 0.59)
A New All-in-One Botnet: Proteus (score: 0.57)
Cisco's Talos Intelligence Group Blog: The Many Tentacles of the Necurs Botnet (score: 0.57)

このPulseに関連する脅威アクター (事実ベース)

Andariel

Score: 3.84

Matched TTPs:

T1590.005 - IP Addresses

MITREへのリンク →

Magic Hound

Score: 9.27

Matched TTPs:

T1590.005 - IP Addresses
T1016.001 - Internet Connection Discovery
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery

MITREへのリンク →

HAFNIUM

Score: 19.37

Matched TTPs:

T1590.005 - IP Addresses
T1016.001 - Internet Connection Discovery
T1583.005 - Botnet
T1016 - System Network Configuration Discovery
T1584.005 - Botnet
T1590 - Gather Victim Network Information

MITREへのリンク →

APT41

Score: 13.87

Matched TTPs:

T1568.002 - Domain Generation Algorithms
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1195.002 - Compromise Software Supply Chain
T1595.003 - Wordlist Scanning

MITREへのリンク →

TA551

Score: 4.13

Matched TTPs:

T1568.002 - Domain Generation Algorithms

MITREへのリンク →

HEXANE

Score: 5.42

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery

MITREへのリンク →

APT29

Score: 6.59

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1550.003 - Pass the Ticket

MITREへのリンク →

Gamaredon Group

Score: 3.95

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1082 - System Information Discovery

MITREへのリンク →

TA2541

Score: 7.10

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1082 - System Information Discovery
T1055.012 - Process Hollowing

MITREへのリンク →

Lotus Blossom

Score: 4.22

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1016 - System Network Configuration Discovery

MITREへのリンク →

FIN13

Score: 9.27

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1590.004 - Network Topology
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery

MITREへのリンク →

Turla

Score: 10.54

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1007 - System Service Discovery
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1124 - System Time Discovery

MITREへのリンク →

Volt Typhoon

Score: 20.64

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1007 - System Service Discovery
T1590.004 - Network Topology
T1016 - System Network Configuration Discovery
T1584.005 - Botnet
T1590 - Gather Victim Network Information
T1124 - System Time Discovery

MITREへのリンク →

FIN8

Score: 3.95

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1082 - System Information Discovery

MITREへのリンク →

APT5

Score: 3.84

Matched TTPs:

T1583.005 - Botnet

MITREへのリンク →

Ke3chang

Score: 9.04

Matched TTPs:

T1583.005 - Botnet
T1007 - System Service Discovery
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery

MITREへのリンク →

BRONZE BUTLER

Score: 8.96

Matched TTPs:

T1007 - System Service Discovery
T1550.003 - Pass the Ticket
T1124 - System Time Discovery

MITREへのリンク →

TeamTNT

Score: 9.33

Matched TTPs:

T1007 - System Service Discovery
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1595.001 - Scanning IP Blocks

MITREへのリンク →

Indrik Spider

Score: 6.37

Matched TTPs:

T1007 - System Service Discovery
T1590 - Gather Victim Network Information

MITREへのリンク →

OilRig

Score: 5.20

Matched TTPs:

T1007 - System Service Discovery
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery

MITREへのリンク →

Aquatic Panda

Score: 3.73

Matched TTPs:

T1007 - System Service Discovery
T1082 - System Information Discovery

MITREへのリンク →

Kimsuky

Score: 8.35

Matched TTPs:

T1007 - System Service Discovery
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1055.012 - Process Hollowing

MITREへのリンク →

Chimera

Score: 6.59

Matched TTPs:

T1007 - System Service Discovery
T1016 - System Network Configuration Discovery
T1124 - System Time Discovery

MITREへのリンク →

Earth Lusca

Score: 3.99

Matched TTPs:

T1007 - System Service Discovery
T1016 - System Network Configuration Discovery

MITREへのリンク →

admin@338

Score: 5.20

Matched TTPs:

T1007 - System Service Discovery
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery

MITREへのリンク →

APT1

Score: 3.99

Matched TTPs:

T1007 - System Service Discovery
T1016 - System Network Configuration Discovery

MITREへのリンク →

Salt Typhoon

Score: 3.84

Matched TTPs:

T1590.004 - Network Topology

MITREへのリンク →

BlackByte

Score: 5.83

Matched TTPs:

T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1055.012 - Process Hollowing

MITREへのリンク →

ZIRCONIUM

Score: 5.27

Matched TTPs:

T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1124 - System Time Discovery

MITREへのリンク →

Darkhotel

Score: 9.11

Matched TTPs:

T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1497 - Virtualization/Sandbox Evasion
T1124 - System Time Discovery

MITREへのリンク →

APT32

Score: 6.52

Matched TTPs:

T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1550.003 - Pass the Ticket

MITREへのリンク →

Lazarus Group

Score: 9.40

Matched TTPs:

T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1027.007 - Dynamic API Resolution
T1124 - System Time Discovery

MITREへのリンク →

Higaisa

Score: 5.27

Matched TTPs:

T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1124 - System Time Discovery

MITREへのリンク →

CURIUM

Score: 3.80

Matched TTPs:

T1082 - System Information Discovery
T1124 - System Time Discovery

MITREへのリンク →

APT38

Score: 5.74

Matched TTPs:

T1082 - System Information Discovery
T1036.006 - Space after Filename

MITREへのリンク →

Mustang Panda

Score: 15.88

Matched TTPs:

T1082 - System Information Discovery
T1176.002 - IDE Extensions
T1016 - System Network Configuration Discovery
T1678 - Delay Execution
T1027.007 - Dynamic API Resolution

MITREへのリンク →

FIN7

Score: 6.73

Matched TTPs:

T1082 - System Information Discovery
T1195.002 - Compromise Software Supply Chain
T1124 - System Time Discovery

MITREへのリンク →

Sidewinder

Score: 5.27

Matched TTPs:

T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1124 - System Time Discovery

MITREへのリンク →

Daggerfly

Score: 4.13

Matched TTPs:

T1082 - System Information Discovery
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

Contagious Interview

Score: 5.05

Matched TTPs:

T1082 - System Information Discovery
T1497 - Virtualization/Sandbox Evasion

MITREへのリンク →

Patchwork

Score: 4.36

Matched TTPs:

T1082 - System Information Discovery
T1055.012 - Process Hollowing

MITREへのリンク →

Moonstone Sleet

Score: 5.60

Matched TTPs:

T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

Sandworm Team

Score: 7.76

Matched TTPs:

T1082 - System Information Discovery
T1584.005 - Botnet
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

Dragonfly

Score: 4.40

Matched TTPs:

T1016 - System Network Configuration Discovery
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

menuPass

Score: 4.62

Matched TTPs:

T1016 - System Network Configuration Discovery
T1055.012 - Process Hollowing

MITREへのリンク →

Threat Group-3390

Score: 7.55

Matched TTPs:

T1016 - System Network Configuration Discovery
T1055.012 - Process Hollowing
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

Axiom

Score: 3.62

Matched TTPs:

T1584.005 - Botnet

MITREへのリンク →

Saint Bear

Score: 3.84

Matched TTPs:

T1497 - Virtualization/Sandbox Evasion

MITREへのリンク →

PROMETHIUM

Score: 4.13

Matched TTPs:

T1205.001 - Port Knocking

MITREへのリンク →

UNC3886

Score: 6.72

Matched TTPs:

T1205.001 - Port Knocking
T1124 - System Time Discovery

MITREへのリンク →

Gorgon Group

Score: 3.15

Matched TTPs:

T1055.012 - Process Hollowing

MITREへのリンク →

Volatile Cedar

Score: 4.13

Matched TTPs:

T1595.003 - Wordlist Scanning

MITREへのリンク →

APT28

Score: 9.08

Matched TTPs:

T1498 - Network Denial of Service
T1669 - Wi-Fi Networks

MITREへのリンク →

Ember Bear

Score: 4.13

Matched TTPs:

T1595.001 - Scanning IP Blocks

MITREへのリンク →

Equation

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Strider

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Volt Typhoon

Score: 0.78

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1007 - System Service Discovery
T1590 - Gather Victim Network Information
T1016 - System Network Configuration Discovery
T1584.005 - Botnet
T1124 - System Time Discovery
T1590.004 - Network Topology

MITREへのリンク →

HAFNIUM

Score: 0.74

Matched TTPs:

T1016.001 - Internet Connection Discovery
T1590 - Gather Victim Network Information
T1016 - System Network Configuration Discovery
T1584.005 - Botnet
T1590.005 - IP Addresses
T1583.005 - Botnet

MITREへのリンク →

Mustang Panda

Score: 0.61

Matched TTPs:

T1082 - System Information Discovery
T1678 - Delay Execution
T1016 - System Network Configuration Discovery
T1027.007 - Dynamic API Resolution
T1176.002 - IDE Extensions

MITREへのリンク →

APT41

Score: 0.55

Matched TTPs:

T1595.003 - Wordlist Scanning
T1082 - System Information Discovery
T1016 - System Network Configuration Discovery
T1568.002 - Domain Generation Algorithms
T1195.002 - Compromise Software Supply Chain

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る