I wrote this after one of my own systems got popped by RapperBot.
Instead of just wiping, I decided to collect samples, pull some PCAPs, and see how it actually works.
From infrastructure breakdown to encrypt C2 in TXT DNS records, binary reversing to exploit analysis, I've tried to dissect as much as I could to understand how everything connects together and share with the community.
Happy to answer any questions too.
So some friends and I are working on this. I know it is a recurring topic from time to time, usually people discuss for a while and forget about it again. Is anyone else actively working one this problem space?