XBinder Variant malware

File types

• PE Executable34

Recurring C2 endpoints

• adobe-cdn[.]duckdns[.]org,chelou[.]duckdns[.]org,mauvaise[.]duckdns[.]org,truesir[.]duckdns[.]org,176[.]160[.]157[.]964
• adobe-cdn[.]duckdns[.]org,chelou[.]duckdns[.]org,mauvaise[.]duckdns[.]org4
• valid-rpg[.]gl[.]at[.]ply[.]gg1
• Artexxiz-64097[.]portmap[.]host1
• 8[.]tcp[.]cpolar[.]top1
• bildad[.]us[.]org,brandy[.]it[.]com1
• mestizo[.]co[.]com1
• admingdtg[.]vn,handyrenuopen[.]in[.]net,roofing[.]gb[.]net,wplog[.]jp[.]net,deepsteam[.]sa[.]com,zsyp[.]cn[.]com,popcima[.]it[.]com1
• admingdtg[.]vn,aliexpress[.]us[.]com1
• 176[.]160[.]157[.]96,uchiwa5[.]duckdns[.]org,mauvaise[.]duckdns[.]org,truesir[.]duckdns[.]org1

Defanged. Extracted statically from the configurations of public samples.