Madi

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Madi
Alias	Mahdi
Group	Spying
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target	Microsoft Windows
Origin
Distribution vector
UserAgent
CCProtocol
Activity	2011 / Unknown
Status	Unknown
Language
Programming language
Operation/Working group

Introduction

• According to Seculert, almost 1000 victims identified
• The beginning of this botnet dates at least back to dec 2011

Features

• File theft

• Keylogger

• Screen capture

• Email surveillance

• IM surveillance

Publications

	Author	Editor	Year
Kaspersky Lab et Seculert annoncent la récente découverte de « Madi », une nouvelle attaque de cyberespionnage au Moyen‑Orient	Kaspersky Lab	Global Security Mag	2012
Madi is back - New Tricks and a new Command&Control server	Nicolas Brulez	Kaspersky lab	2012
Mahdi malware finds 150 new targets including U.S. and Germany, gets more evasive	Mike Lennon	Wired Business Media	2012
The Madi campaign - Part II	Nicolas Brulez	Kaspersky lab	2012
The ‘Madi’ infostealers - a detailed analysis	Nicolas Brulez	Kaspersky lab	2012