value:  Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds. ;; Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites. ;; PlugX uses Pastebin to store C2 addresses. ;; PolyglotDuke can use Twitter Reddit Imgur and other websites to get a C2 URL. ;; Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware. ;; RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. ;; RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain. ;; Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.
name: Web Service: Dead Drop Resolver