Unveiling Stealthy WailingCrab Aided by DNS Intelligence

WailingCrab, a piece of malware reportedly abusing the Internet of Things (IoT) messaging protocol MQTT, gained notoriety for its stealth. IBM X-Force security researchers recently published an in-depth analysis of the malware.¹

The researchers publicized 24 indicators of compromise (IoCs) as part of their report, including one domain and 14 URLs. After extracting the URLs’ domains, we were left with 15 IoCs that we then subjected to an expansion analysis that led to the discovery of:

• 26 domains whose WHOIS records contained public email addresses found anywhere in the historical WHOIS records of the IoCs
• 17 IP addresses to which the domains identified as IoCs resolved
• 524 domains that shared the potentially dedicated hosts of the IoCs
• 978 domains that contained text strings found among the IoCs
• 2,002 subdomains that contained text strings found among the IoCs

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

—

• [1] https://securityintelligence.com/x-force/wailingcrab-malware-misues-mqtt-messaging-protocol/