Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
we determined that it was a new botnet that reused the Mirai framework, propagated through the ADB interface, and targeted Android-like devices with the main purpose of DDoS attacks. For this reason we named it Matryosh.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Matryosh stores sensitive resources encrypted to prevent the relevant functions from being spotted by security researchers.
After that establishes connection with the TOR proxy. And finally communicates with TOR C2 through the proxy and waits for the execution of the commands sent by C2.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a botnet whose Tor- and cloud-based C2 implementation influenced ZHtrap's network architecture.
A botnet targeting Android-like devices via exposed ADB. It downloads architecture-specific ELF payloads, uses layered/XOR-obfuscated configuration, retrieves TOR proxy and TOR C2 information via DNS TXT records, and performs DDoS attacks including tcpraw, icmpecho, and udpplain.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.