[xors]

Samples from:
https://blog.talosintelligence.com/2018 ... ilter.html

[badwarehunter]

thanks for the samples, gonna take a look

here is an analysis of kaspersky on the way the first stage retrieve the IPs of the C2 (without using DND) :
hXXps://securelist.com/vpnfilter-exif-to-c2-mechanism-analysed/85721/

Regards

[maddog4012]

anther sample