XONER Dropper Download via wget/curl/tftp (165.232.165.152:8080)

Denise Kim@Ducky

•updated Feb 8, 2026•1•1•87

Let's create a detection rule for "XONER dropper (multi-key download/execution)" based on xoner.sh. The key IOCs are as follows: - C2/Hosting: 165.232.165.152:8080 - Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.) - Drop file name: xoner - Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file Reported by Team_D4rkn3ttz Detected by @bishop0218