static-urls · Crawled Jul 29, 2026
僵尸网络新秀：Dysphoria 演进与深度技术分析
34 IoCs 1 CVEs
Read original article ↗
AI Summary
Dysphoria 是一个自2026年初开始活跃的新兴僵尸网络家族，已控制超过20万台设备。该僵尸网络通过弱口令爆破和多个已知IoT漏洞进行传播，包括CVE-2017-17215、CVE-2020-8515等。其技术演进迅速，引入了基于以太坊ENS和Solana SNS区块链域名的C2隐蔽解析机制，并将受感染主机转化为C2中继节点，增强了抗打击能力。最新变种使用自定义RC4加密算法、UPnP内网穿透和动态中继架构，具备强大的DDoS攻击能力，宣称可达到4Tbps，并已实现商业化攻击服务运营。
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 34 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 217[.]60[.]195[.]160 | Details → |
| IP | 76[.]164[.]203[.]171 | Details → |
| IP | 92[.]42[.]100[.]131 | Details → |
| IP | 78[.]153[.]155[.]152 | Details → |
| IP | 144[.]31[.]38[.]215 | Details → |
| Domain | i[.]peer4you[.]net | Details → |
| Domain | o[.]peer4you[.]net | Details → |
| Domain | login[.]trees4sale[.]net | Details → |
| Domain | www[.]trees4sale[.]net | Details → |
| Domain | c2[.]saintpetersburgresident[.]ru | Details → |
| Domain | peer[.]saintpetersburgresident[.]ru | Details → |
| Domain | kieron[.]androiddebugbridge[.]su | Details → |
| Domain | dysphoria[.]androiddebugbridge[.]su | Details → |
| Domain | telaviv[.]androiddebugbridge[.]su | Details → |
| Domain | jerusalem[.]androiddebugbridge[.]su | Details → |
| Domain | node[.]androiddebugbridge[.]su | Details → |
| Domain | wow[.]androiddebugbridge[.]su | Details → |
| GitHub Repo | m3rnbvs5d.eth | Details → |
| GitHub Repo | burrberry.eth | Details → |
| GitHub Repo | ukranianhorseriding.eth | Details → |
| GitHub Repo | 24carnforth2merseyside.sol | Details → |
| SHA-1 | c1bedea261f325441fb9a75c50b11d0c8fb01ac6 | Details → |
| SHA-1 | a3b9575897c16cbf6afe3af1aa8b55171ea6edf9 | Details → |
| SHA-1 | 8db6c78533c176f13b61405cdc3f8fad703325f1 | Details → |
| SHA-1 | 9c1716d770ea69e8e1418d96d52222396ecb4362 | Details → |
| SHA-1 | 73651c02b29f1c07e3177e86c967fc45e9f30f0f | Details → |
| SHA-1 | 955ff909972958098f0d4a06bcc4d6b9eea90449 | Details → |
| SHA-1 | 25081bdec05f64eb4f313420c82d8de957e30026 | Details → |
| SHA-1 | dcea71b9ab9de8efca301de9e2f7bf11c7132364 | Details → |
| SHA-1 | df510f6f69a5c149c216c7b3accc4f460d8cf363 | Details → |
| SHA-1 | b0782a9d6eef2ce02f734a6e5e1d8e0f9a2b65be | Details → |
| SHA-1 | e7e1694162639ed587625432a79cfaa49f560d11 | Details → |
| SHA-1 | b7faa44ab0772047a8581bbfdd9c561e28fc66de | Details → |
| Filename | libdalvikengine.so | Details → |
MITRE ATT&CK TTPs 28 techniques
T1001.002 Steganography · Command And Control T1021.004 SSH · Lateral Movement T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.004 Unix Shell · Execution T1070.001 Clear Windows Event Logs · Defense Evasion T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1098 Account Manipulation · Persistence T1110 Brute Force · Credential Access T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1203 Exploitation for Client Execution · Execution T1210 Exploitation of Remote Services · Lateral Movement T1211 Exploitation for Defense Evasion · Defense Evasion T1218 System Binary Proxy Execution · Defense Evasion T1485 Data Destruction · Impact T1566 Phishing · Initial Access T1569 System Services · Execution T1570 Lateral Tool Transfer · Lateral Movement T1571 Non-Standard Port · Command And Control T1572 Protocol Tunneling · Command And Control T1589 Gather Victim Identity Information · Reconnaissance T1595 Active Scanning · Reconnaissance T1599 Network Boundary Bridging · Defense Evasion T1650 Acquire Access · Resource Development