We have taken the below sample hash for this analysis: (SHA256), ae582545c3196afa5ac6419db9d57b11633e8282f29e3cd48fe31b9dd250a963, which is a GUI-based 32-bit executable written in. Figure 1 – TA’s advertisement about MDBotnet on a DW forum The figure below illustrates the MDBotnet advertisement by the TA on a cybercrime forum. Additionally, the advertisement provides detailed information about the features included in the MDBotnet service. The price mentioned for the MDBotnet service is 2,500₽ (Russian Rubles) with a lifetime access offer.

The primary objective of a DDoS attack is to disrupt the target’s operations, cause financial loss, or damage its reputation. This MDBotnet malware has been specifically designed for carrying out distributed denial-of-service (DDoS) attacks on targeted victims by employing an HTTP/SYN flood attack technique.Ī DDoS attack is a malicious attempt to disrupt the normal functioning of a computer network, service, or website by overwhelming it with a flood of internet traffic or requests. Our analysis indicates that the origins of this malware can be attributed to a Threat Actor (TA) associated with Russia.

Russian Hacktivists Peddling DDoS-As-A-Service in Cyber-Crime ForumĬyble Research and Intelligence Labs (CRIL) recently uncovered a new strain of malware named “MDBotnet” on a cybercrime forum.

Download c&c ta