Analysis Details Kamasers DDoS Botnet’s Resilient C2 and Payload Delivery

Mar 25, 2026 · Original article ↗

Summary

ANY.RUN’s analysis describes Kamasers as a multi-vector DDoS botnet that retrieves C2 addresses through public-service Dead Drop Resolver channels and can download and execute additional payloads; it details the malware’s commands, infrastructure and detection.

Key points

ANY.RUN reports that Kamasers supports application- and transport-layer DDoS methods, including HTTP, TLS, UDP, TCP and GraphQL attacks.
The analysis found that Kamasers retrieves C2 addresses through Dead Drop Resolver channels using GitHub Gist, Telegram, Dropbox and Bitbucket, with fallback domains if those channels fail.
The bot’s !download and !descargar commands can fetch and execute additional payloads, according to observed sandbox sessions and sample analysis.
Reverse engineering found that the !udppro command supports UDP floods with IP spoofing and NTP/DNS amplification.
ANY.RUN observed Kamasers distributed through GCleaner and Amadey, and connections to IP address space associated with Railnet LLC’s ASN.
ANY.RUN’s submission data showed activity across multiple countries and sectors, with Germany and the United States prominent; education, telecommunications and technology were among the reported sectors.
The article recommends monitoring suspicious outbound connections, behavior-based sandbox analysis and infrastructure pivoting, and provides a YARA rule.

Article Details

Attack Vectors: Kamasers issues multi-vector application- and transport-layer DDoS attacks, including HTTP, TLS, UDP, TCP, GraphQL, Slowloris, and HULK methods.
The bot can download and execute additional payloads in response to C2 commands such as !download and !descargar.
Kamasers retrieves C2 addresses through Dead Drop Resolver resources hosted on public services, then connects to the resolved C2 server.
The !udppro command supports source IP spoofing and NTP/DNS reflection and amplification attacks.
Defensive Notes: Monitor suspicious outbound connections to public services, newly observed infrastructure, and repeated communication with known malicious hosting.
Use behavior-based sandbox analysis to check for Dead Drop Resolver activity, C2 connections, DDoS commands, and download-and-execute behavior.
After confirming Kamasers, pivot from the sample to related infrastructure and sessions, including activity associated with Railnet ASN.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`boskuh[.]com`	Fallback C2 domain used by Kamasers if its Dead Drop Resolver channels are unavailable.
DOMAIN	`pitybux[.]com`	Fallback C2 domain used by Kamasers if its Dead Drop Resolver channels are unavailable.
DOMAIN	`ryxuz[.]com`	Fallback C2 domain used by Kamasers if its Dead Drop Resolver channels are unavailable.
DOMAIN	`toksm[.]com`	Fallback C2 domain used by Kamasers if its Dead Drop Resolver channels are unavailable.
SHA256	`071a1960fbd7114ca87d9da138908722d7f1c02af90ea2db1963915fbe234c52`	File hash listed among Kamasers sample binaries and payloads observed.
SHA256	`dd305f7f1131898c736c97f43c6729bf57d3980fc269400d23412a282ee71a9a`	File hash listed among Kamasers sample binaries and payloads observed.
SHA256	`f6c6e16a392be4dbf9a3cf1085b4ffc005b0931fc8eeb5fedf1c7561b2e5ad6b`	File hash listed among Kamasers sample binaries and payloads observed.
URL	`hxxp[:]//178[.]16[.]54[.]87/uda/ph[.]php`	Malicious dropper or C2 endpoint observed in the article's IOC list.
URL	`hxxp[:]//45[.]151[.]91[.]187/pa[.]php`	Malicious dropper or C2 endpoint observed in the article's IOC list.
URL	`hxxp[:]//91[.]92[.]240[.]50/pit/wp[.]php`	Malicious dropper or C2 endpoint observed in the article's IOC list.