Mirai Botnet Hiding C2 Servers in XOR-Encoded DNS Records

The report

A Mirai kit on our honeypot keeps its server addresses in DNS, XOR-encoded. Sandboxes miss it. How we decoded it offline and confirmed both servers.

Read the full analysis: Mirai Botnet Hiding C2 Servers in XOR-Encoded DNS Records (KSI Digital).

Indicators

Malware C

• seris[.]gd

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#18). This page is generated from that record and the report’s own title and summary; nothing is rewritten.