B1txor20 can be characterized is using DNS Tunnel to establish C2 channel, support direct connection and relay, while using ZLIB compression, RC4 encryption, BASE64 encodingto protect the traffic of the backdoor Trojan, mainly targets ARM, X64 CPU architecture of the Linux platform.
The main features currently supported are shown below.
SHELL
Proxy
Execute arbitrary commands
Install Rootkit
Upload sensitive information