Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
23 IOCs
Botnet Rising Star: The Evolution and In-Depth Technical Analysis of Dysphoria
Threat Actors
Malware Families
Excerpt
This report is jointly published by the CNCERT and XLAB. Since Q1 2026, XLab has been continuously tracking an emerging botnet family named Dysphoria whose bot population exceeds 200,000. Within just a few months this family has gone through frequent variant updates and technical iterations, demonstrating remarkable staying power. Its evolutionary path not only spans the jackskid and fbot variants, but has also recently introduced a covert C2 resolution mechanism based on…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →23 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | e7e1694162639ed587625432a79cfaa49f560d11 | High | Score 83/100 | First seen |
| SHA1 | b0782a9d6eef2ce02f734a6e5e1d8e0f9a2b65be | High | Score 83/100 | First seen |
| CVE | CVE-2016-20016 | Medium | Score 50/100 | First seen |
| CVE | CVE-2025-34152 | Medium | Score 54/100 | First seen |
| CVE | CVE-2022-35733 | Medium | Score 54/100 | First seen |
| SHA1 | 9c1716d770ea69e8e1418d96d52222396ecb4362 | High | Score 83/100 | First seen |
| SHA1 | 25081bdec05f64eb4f313420c82d8de957e30026 | High | Score 83/100 | First seen |
| SHA1 | 8db6c78533c176f13b61405cdc3f8fad703325f1 | High | Score 83/100 | First seen |
| CVE | CVE-2013-3307 | High | Score 63/100 | First seen |
| SHA1 | a3b9575897c16cbf6afe3af1aa8b55171ea6edf9 | High | Score 83/100 | First seen |
| CVE | CVE-2025-55182 | High | Score 82/100 | First seen |
| CVE | CVE-2020-25499 | Medium | Score 54/100 | First seen |
| CVE | CVE-2018-14558 | Medium | Score 54/100 | First seen |
| CVE | CVE-2020-8515 | Medium | Score 52/100 | First seen |
| SHA1 | 955ff909972958098f0d4a06bcc4d6b9eea90449 | High | Score 83/100 | First seen |
| CVE | CVE-2025-28137 | Medium | Score 54/100 | First seen |
| SHA1 | 73651c02b29f1c07e3177e86c967fc45e9f30f0f | High | Score 83/100 | First seen |
| CVE | CVE-2025-9528 | Medium | Score 54/100 | First seen |
| SHA1 | c1bedea261f325441fb9a75c50b11d0c8fb01ac6 | High | Score 83/100 | First seen |
| SHA1 | dcea71b9ab9de8efca301de9e2f7bf11c7132364 | High | Score 83/100 | First seen |
| CVE | CVE-2017-5259 | Medium | Score 54/100 | First seen |
| SHA1 | b7faa44ab0772047a8581bbfdd9c561e28fc66de | High | Score 83/100 | First seen |
| SHA1 | df510f6f69a5c149c216c7b3accc4f460d8cf363 | High | Score 83/100 | First seen |
IOC Relationship Graph
Building graph…