PocoDown (Malware Family)
By Fraunhofer FKIE
Archived: 2026-04-05 23:20:40 UTC
uses POCO C++ cross-platform library, Xor-based string obfuscation, SSL library code and string overlap with
Xtunnel, infrastructure overlap with X-Agent, probably in use since mid-2018
[TLP:WHITE] win_pocodown_auto (20251219 | Detects win.pocodown.)
Source: https://malpedia.caad.fkie.fraunhofer.de/details/win.pocodown
https://malpedia.caad.fkie.fraunhofer.de/details/win.pocodown
Page 1 of 1