Drifter Propose Change

DDoS bot for Android TV boxes, delivered over exposed ADB as an APK that runs a native ARM ELF. Its C2 domains imitate IP-camera brands (hikvision-cctv[.]su, nvms9000[.]su), and its config table is encrypted with a custom RC4-derived cipher with AES MixColumns diffusion. It follows Mirai's design without Mirai code.

References

There is no Yara-Signature yet.