● Malware

Doki

Doki is a backdoor that uses a unique Dogecoin-based Domain Generation Algorithm and was first observed in July 2020. Doki was used in conjunction with the ngrok Mining Botnet in a campaign that targeted Docker servers in cloud platforms.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

14 relationships

T1133: External Remote Services

source

T1568.002: Domain Generation Algorithms

source

T1036.005: Match Legitimate Resource Name or Location

source

T1611: Escape to Host

source

T1610: Deploy Container

source

T1020: Automated Exfiltration

source

T1083: File and Directory Discovery

source

T1102: Web Service

source

T1057: Process Discovery

source

T1041: Exfiltration Over C2 Channel

source

T1059.004: Unix Shell

source

T1573.002: Asymmetric Cryptography

source

T1071.001: Web Protocols

source

T1105: Ingress Tool Transfer

source