Dark.IoT (505c6a54-a701-4a4b-85d4-0f2038b7b46a)

This malware is characterized by alternative DNS connections and connects to several *.lib domains using custom DNS servers.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Mirai (fcdfd4af-da35-49a8-9610-19be8a487185)	Botnet	Dark.IoT (505c6a54-a701-4a4b-85d4-0f2038b7b46a)	Botnet	1
Mirai (fcdfd4af-da35-49a8-9610-19be8a487185)	Botnet	Owari (f24ad5ca-04c5-4cd0-bd72-209ebce4fdbc)	Botnet	2
Mirai (fcdfd4af-da35-49a8-9610-19be8a487185)	Botnet	Sora (025ab0ce-bffc-11e8-be19-d70ec22c5d56)	Botnet	2
Mirai (fcdfd4af-da35-49a8-9610-19be8a487185)	Botnet	Mirai (dcbf1aaa-1fdd-4bfc-a35e-145ffdfb5ac5)	Tool	2
Mirai (fcdfd4af-da35-49a8-9610-19be8a487185)	Botnet	Mirai (ELF) (17e12216-a303-4a00-8283-d3fe92d0934c)	Malpedia	2
Owari (f24ad5ca-04c5-4cd0-bd72-209ebce4fdbc)	Botnet	Owari (ec67f206-6464-48cf-a012-3cdfc1278488)	Malpedia	3
Owari (f24ad5ca-04c5-4cd0-bd72-209ebce4fdbc)	Botnet	Sora (025ab0ce-bffc-11e8-be19-d70ec22c5d56)	Botnet	3
Owari (f24ad5ca-04c5-4cd0-bd72-209ebce4fdbc)	Botnet	Mirai (dcbf1aaa-1fdd-4bfc-a35e-145ffdfb5ac5)	Tool	3
Sora (025ab0ce-bffc-11e8-be19-d70ec22c5d56)	Botnet	Mirai (dcbf1aaa-1fdd-4bfc-a35e-145ffdfb5ac5)	Tool	3
Mirai (dcbf1aaa-1fdd-4bfc-a35e-145ffdfb5ac5)	Tool	Mirai (ELF) (17e12216-a303-4a00-8283-d3fe92d0934c)	Malpedia	3