Trusted Design

A New All-in-One Botnet: Proteus

概要

The ART team at Fortinet has discovered a new malware named Proteus, a multifunctional botnet written in .NET that appears to be a proxy, coin miner, e-commerce merchant account checker, and keylogger. This particular botnet is downloaded by the Andromeda botnet. The handful of malicious features densely packed in this new malware also includes the ability to drop other malware. We have compiled its main features in this brief analysis.

Created: 2026-02-23

Indicators

• URL - http://proteus-network.ml/bins/cpu.zip -
• URL - http://proteus-network.ml/bins/zm.exe -
• URL - http://proteus-network.ml/bins/cm.exe -
• FileHash-MD5 - 49fd4020bf4d7bd23956ea892e6860e9 -
• URL - http://proteus-network.ml/bins/chrome.exe/ -
• FileHash-SHA256 - d23b4a30f6b1f083ce86ef9d8ff434056865f6973f12cb075647d013906f51a2 -
• domain - proteus-network.ml -
• domain - proteus-network.biz -

類似Pulses

• GamaPoS: The Andromeda Botnet Connection (score: 0.68)
• MSIL/Agent.PYO botnet (score: 0.67)
• Malware-Traffic-Analysis.net - 2017-12-04 - Dridex is back, Baby! - Necurs Botnet malspam pushes Dridex (score: 0.66)
• Botnet - Fluxerbot (score: 0.65)
• Malware-Traffic-Analysis.net - 2017-10-24 - Necurs Botnet malspam uses DDE attack to push Locky (score: 0.65)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る