S0600 Doki

malwareEnterprise

platformsLinux · Containers

also known asDoki

Doki is a backdoor that uses a unique Dogecoin-based Domain Generation Algorithm and was first observed in July 2020. Doki was used in conjunction with the ngrok Mining Botnet in a campaign that targeted Docker servers in cloud platforms.

techniques used (14)

ATT&CK techniques this enables or maps to.

T1020Automated Exfiltration
T1036.005Match Legitimate Resource Name or Location
T1041Exfiltration Over C2 Channel
T1057Process Discovery
T1059.004Unix Shell
T1071.001Web Protocols
T1083File and Directory Discovery
T1102Web Service
T1105Ingress Tool Transfer
T1133External Remote Services
T1568.002Domain Generation Algorithms
T1573.002Asymmetric Cryptography
T1610Deploy Container
T1611Escape to Host

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan