Malwarecritical
IoT Malware Evolves to Harvest Bots by Exploiting a Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-8361 | Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE | — | 100% | KEV | — KEV |
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 176.123.30.27 | .62[.]133:8716 185.101.98[.]128:4312 185.130.104[.]171:7723 176.123.30[.]27:7723, 7645, 6651 SHA256 c0057bcae877e08ffc187e97cad5b7926 |
| ipv4 | 185.101.98.128 | vity with the Satori tag. Appendix C2s 185.47.62[.]133:8716 185.101.98[.]128:4312 185.130.104[.]171:7723 176.123.30[.]27:7723, 7645, 6 |
| ipv4 | 185.130.104.171 | ag. Appendix C2s 185.47.62[.]133:8716 185.101.98[.]128:4312 185.130.104[.]171:7723 176.123.30[.]27:7723, 7645, 6651 SHA256 c0057bcae877 |
| ipv4 | 185.47.62.133 | investigate this activity with the Satori tag. Appendix C2s 185.47.62[.]133:8716 185.101.98[.]128:4312 185.130.104[.]171:7723 176.123 |
| sha256 | 014e48d29ebf6c52fcd6493ad03d168d420a5086c4d8b561327414e2598b67c7 | 3105b2f712630499e0a7b01e6fb1b55fbec6f02c542653ae53a9c77c1aa 014e48d29ebf6c52fcd6493ad03d168d420a5086c4d8b561327414e2598b67c7 62d89390cc20f74b2be235ccd0952234ec18077061a58894adcf045a042 |
| sha256 | 06a3137e5fc8e00d9a29d7df92b550eb0954ea0dc4979a26fb39689769df258a | 390cc20f74b2be235ccd0952234ec18077061a58894adcf045a042a4966 06a3137e5fc8e00d9a29d7df92b550eb0954ea0dc4979a26fb39689769df258a 3bccd6d88e79225f93efa9494da1255b9b9e426d89d40765af9ea836975 |
| sha256 | 1412d0af18e936d5561428d357de2453160fab7a3e91da1dc048881e1dd3be42 | 79b88d1cd71ae4f77f82ea6816b92c915d8e59cdc4b3c3d015a4ad028d3 1412d0af18e936d5561428d357de2453160fab7a3e91da1dc048881e1dd3be42 14c294b3acb095e786fbed8964002a3b9a7a2a92ed7bc06ec5dde9f3f2a |
| sha256 | 14c294b3acb095e786fbed8964002a3b9a7a2a92ed7bc06ec5dde9f3f2ace328 | 0af18e936d5561428d357de2453160fab7a3e91da1dc048881e1dd3be42 14c294b3acb095e786fbed8964002a3b9a7a2a92ed7bc06ec5dde9f3f2ace328 c46c4495877837f062894c746dca141f96884c1a0145ce762417be04178 |
| sha256 | 15bdb51d40bd8f764a87598c97f88ed2c30ccc08215bc9aa2a4558e86bcfd164 | 6d88e79225f93efa9494da1255b9b9e426d89d40765af9ea83697557d75 15bdb51d40bd8f764a87598c97f88ed2c30ccc08215bc9aa2a4558e86bcfd164 3ae71ec80857687a842753ea278865e137f2ed2ba234aa1ebc2dc4d0189 |
| sha256 | 184ba48be43f13e9a85c26e6ae19363317e5e7b770e8010d04302913b224737a | 350c6f6392865bb550106ba5b3c39f7e2afc3d8683e4d8676b4e284adc2 184ba48be43f13e9a85c26e6ae19363317e5e7b770e8010d04302913b224737a 18c62166a0ced40f36294953ec3b71f7574f186d68cf62e55b6298cd3d1 |
| sha256 | 18c62166a0ced40f36294953ec3b71f7574f186d68cf62e55b6298cd3d1d2a15 | 48be43f13e9a85c26e6ae19363317e5e7b770e8010d04302913b224737a 18c62166a0ced40f36294953ec3b71f7574f186d68cf62e55b6298cd3d1d2a15 340b579b88d1cd71ae4f77f82ea6816b92c915d8e59cdc4b3c3d015a4ad |
| sha256 | 233d6fa6c2769347fb8ce6f59ce761b25a1a44923e5bd9774779b8b495607cd8 | 20eaa4480d971acf6b53e56d638366049b3af7fae63f148cb3a4ad0f9a6 233d6fa6c2769347fb8ce6f59ce761b25a1a44923e5bd9774779b8b495607cd8 5450a6b94fa94561d4869ce42689d04377b823d9243adf0ead7bb5f1eac |
| sha256 | 246337c0e850ad3ab88141a756c698c2088ebb52ff8bede7c785a97204cb4e29 | d8b3dc48194079ecbaf1f464ae6bf73b733945b6e2c39d30dd63cdb380c 246337c0e850ad3ab88141a756c698c2088ebb52ff8bede7c785a97204cb4e29 ebcd46c888eebfb173932ba9cf03afde10493d0d61fa4b99874427512f4 |
| sha256 | 2d706350c6f6392865bb550106ba5b3c39f7e2afc3d8683e4d8676b4e284adc2 | 6c888eebfb173932ba9cf03afde10493d0d61fa4b99874427512f410c49 2d706350c6f6392865bb550106ba5b3c39f7e2afc3d8683e4d8676b4e284adc2 184ba48be43f13e9a85c26e6ae19363317e5e7b770e8010d04302913b22 |
| sha256 | 340b579b88d1cd71ae4f77f82ea6816b92c915d8e59cdc4b3c3d015a4ad028d3 | 166a0ced40f36294953ec3b71f7574f186d68cf62e55b6298cd3d1d2a15 340b579b88d1cd71ae4f77f82ea6816b92c915d8e59cdc4b3c3d015a4ad028d3 1412d0af18e936d5561428d357de2453160fab7a3e91da1dc048881e1dd |
| sha256 | 358d87eb325f9d4c5e546969b2dac99a1207ab91b3d050780ff5da9a203d3b89 | 0f9a6f3e555df646dae4decb95636af26b0da4e9f9173420bae26860b38 358d87eb325f9d4c5e546969b2dac99a1207ab91b3d050780ff5da9a203d3b89 4d4d94ca2a6490b255bc2453e56d332923d253cc514de449b6c48316e15 |
| sha256 | 3ae71ec80857687a842753ea278865e137f2ed2ba234aa1ebc2dc4d01896c098 | 51d40bd8f764a87598c97f88ed2c30ccc08215bc9aa2a4558e86bcfd164 3ae71ec80857687a842753ea278865e137f2ed2ba234aa1ebc2dc4d01896c098 |
| sha256 | 3bccd6d88e79225f93efa9494da1255b9b9e426d89d40765af9ea83697557d75 | 37e5fc8e00d9a29d7df92b550eb0954ea0dc4979a26fb39689769df258a 3bccd6d88e79225f93efa9494da1255b9b9e426d89d40765af9ea83697557d75 15bdb51d40bd8f764a87598c97f88ed2c30ccc08215bc9aa2a4558e86bc |
| sha256 | 3ce224d060acfb7b6ded32a5d482b816b13e085ebebabd78b535759cc929e592 | deec7b67544b22527cd72308b8bf59bda8a9c668aed9c13399c97402981 3ce224d060acfb7b6ded32a5d482b816b13e085ebebabd78b535759cc929e592 5256d20eaa4480d971acf6b53e56d638366049b3af7fae63f148cb3a4ad |
| sha256 | 49969ff2f0005d1635a62be5961db43b299d1e58564dd8a95b2b1a0a707f3e15 | 53909977bb4f0663c731fb8a1c4020a80f11cc528ee97a522ad7a588655 49969ff2f0005d1635a62be5961db43b299d1e58564dd8a95b2b1a0a707f3e15 56b91deec7b67544b22527cd72308b8bf59bda8a9c668aed9c13399c974 |
| sha256 | 4d4d94ca2a6490b255bc2453e56d332923d253cc514de449b6c48316e15883a3 | 7eb325f9d4c5e546969b2dac99a1207ab91b3d050780ff5da9a203d3b89 4d4d94ca2a6490b255bc2453e56d332923d253cc514de449b6c48316e15883a3 86d78298007d3fe09bffef30af233492fe99e4cf355b7c122083e65da68 |
| sha256 | 5256d20eaa4480d971acf6b53e56d638366049b3af7fae63f148cb3a4ad0f9a6 | 4d060acfb7b6ded32a5d482b816b13e085ebebabd78b535759cc929e592 5256d20eaa4480d971acf6b53e56d638366049b3af7fae63f148cb3a4ad0f9a6 233d6fa6c2769347fb8ce6f59ce761b25a1a44923e5bd9774779b8b4956 |
| sha256 | 532b0a6983dcd0aed47fa4df2a8408de4c4a3722302acfe63a4920389406740a | 6deb21a64303e65313082c8e4a4fb4a4e70d502e5d27c73c68531063adb 532b0a6983dcd0aed47fa4df2a8408de4c4a3722302acfe63a4920389406740a b550d5c6cb398706e52c4c765a6729bb276b72816559e18c6c82c99960e |
| sha256 | 5450a6b94fa94561d4869ce42689d04377b823d9243adf0ead7bb5f1eac73422 | fa6c2769347fb8ce6f59ce761b25a1a44923e5bd9774779b8b495607cd8 5450a6b94fa94561d4869ce42689d04377b823d9243adf0ead7bb5f1eac73422 dc466d8b3dc48194079ecbaf1f464ae6bf73b733945b6e2c39d30dd63cd |
| sha256 | 56b91deec7b67544b22527cd72308b8bf59bda8a9c668aed9c13399c97402981 | ff2f0005d1635a62be5961db43b299d1e58564dd8a95b2b1a0a707f3e15 56b91deec7b67544b22527cd72308b8bf59bda8a9c668aed9c13399c97402981 3ce224d060acfb7b6ded32a5d482b816b13e085ebebabd78b535759cc92 |
| sha256 | 58a1253909977bb4f0663c731fb8a1c4020a80f11cc528ee97a522ad7a588655 | 67756a18b617a8879e6a3a75359881054debc1312a14920604f13791b94 58a1253909977bb4f0663c731fb8a1c4020a80f11cc528ee97a522ad7a588655 49969ff2f0005d1635a62be5961db43b299d1e58564dd8a95b2b1a0a707 |
| sha256 | 5f1a03105b2f712630499e0a7b01e6fb1b55fbec6f02c542653ae53a9c77c1aa | 298007d3fe09bffef30af233492fe99e4cf355b7c122083e65da68d0bd1 5f1a03105b2f712630499e0a7b01e6fb1b55fbec6f02c542653ae53a9c77c1aa 014e48d29ebf6c52fcd6493ad03d168d420a5086c4d8b561327414e2598 |
| sha256 | 62d89390cc20f74b2be235ccd0952234ec18077061a58894adcf045a042a4966 | 8d29ebf6c52fcd6493ad03d168d420a5086c4d8b561327414e2598b67c7 62d89390cc20f74b2be235ccd0952234ec18077061a58894adcf045a042a4966 06a3137e5fc8e00d9a29d7df92b550eb0954ea0dc4979a26fb39689769d |
| sha256 | 86d78298007d3fe09bffef30af233492fe99e4cf355b7c122083e65da68d0bd1 | 4ca2a6490b255bc2453e56d332923d253cc514de449b6c48316e15883a3 86d78298007d3fe09bffef30af233492fe99e4cf355b7c122083e65da68d0bd1 5f1a03105b2f712630499e0a7b01e6fb1b55fbec6f02c542653ae53a9c7 |
| sha256 | b0fba3aac1b434ba096502287249d59e63632e03a8b13d1d3927a5701e91cd7d | 7616c9b7c088ad9fa0651f14a3d4760add1f9f93019bca9bb08e8936f2a b0fba3aac1b434ba096502287249d59e63632e03a8b13d1d3927a5701e91cd7d d765067756a18b617a8879e6a3a75359881054debc1312a14920604f137 |
| sha256 | b2d7c864c6d5a6b06258fde41380dfa2753b67713db5cf82c15059b2490ea332 | bcae877e08ffc187e97cad5b7926c4dba965526766857c2dc71dcfca003 b2d7c864c6d5a6b06258fde41380dfa2753b67713db5cf82c15059b2490ea332 e65827616c9b7c088ad9fa0651f14a3d4760add1f9f93019bca9bb08e89 |
| sha256 | b550d5c6cb398706e52c4c765a6729bb276b72816559e18c6c82c99960ed7b8c | a6983dcd0aed47fa4df2a8408de4c4a3722302acfe63a4920389406740a b550d5c6cb398706e52c4c765a6729bb276b72816559e18c6c82c99960ed7b8c ed6f6f7d3a2a189ce7d246b44e0e74dbf9d1e6e39f5d7a0a3666c2e65c4 |
| sha256 | c0057bcae877e08ffc187e97cad5b7926c4dba965526766857c2dc71dcfca003 | .130.104[.]171:7723 176.123.30[.]27:7723, 7645, 6651 SHA256 c0057bcae877e08ffc187e97cad5b7926c4dba965526766857c2dc71dcfca003 b2d7c864c6d5a6b06258fde41380dfa2753b67713db5cf82c15059b2490 |
| sha256 | c46c4495877837f062894c746dca141f96884c1a0145ce762417be04178ca3ca | 4b3acb095e786fbed8964002a3b9a7a2a92ed7bc06ec5dde9f3f2ace328 c46c4495877837f062894c746dca141f96884c1a0145ce762417be04178ca3ca da4646deb21a64303e65313082c8e4a4fb4a4e70d502e5d27c73c685310 |
| sha256 | cfed40f9a6f3e555df646dae4decb95636af26b0da4e9f9173420bae26860b38 | f7d3a2a189ce7d246b44e0e74dbf9d1e6e39f5d7a0a3666c2e65c4a1f0f cfed40f9a6f3e555df646dae4decb95636af26b0da4e9f9173420bae26860b38 358d87eb325f9d4c5e546969b2dac99a1207ab91b3d050780ff5da9a203 |
| sha256 | d765067756a18b617a8879e6a3a75359881054debc1312a14920604f13791b94 | 3aac1b434ba096502287249d59e63632e03a8b13d1d3927a5701e91cd7d d765067756a18b617a8879e6a3a75359881054debc1312a14920604f13791b94 58a1253909977bb4f0663c731fb8a1c4020a80f11cc528ee97a522ad7a5 |
| sha256 | da4646deb21a64303e65313082c8e4a4fb4a4e70d502e5d27c73c68531063adb | 495877837f062894c746dca141f96884c1a0145ce762417be04178ca3ca da4646deb21a64303e65313082c8e4a4fb4a4e70d502e5d27c73c68531063adb 532b0a6983dcd0aed47fa4df2a8408de4c4a3722302acfe63a492038940 |
| sha256 | dc466d8b3dc48194079ecbaf1f464ae6bf73b733945b6e2c39d30dd63cdb380c | 6b94fa94561d4869ce42689d04377b823d9243adf0ead7bb5f1eac73422 dc466d8b3dc48194079ecbaf1f464ae6bf73b733945b6e2c39d30dd63cdb380c 246337c0e850ad3ab88141a756c698c2088ebb52ff8bede7c785a97204c |
| sha256 | e65827616c9b7c088ad9fa0651f14a3d4760add1f9f93019bca9bb08e8936f2a | 864c6d5a6b06258fde41380dfa2753b67713db5cf82c15059b2490ea332 e65827616c9b7c088ad9fa0651f14a3d4760add1f9f93019bca9bb08e8936f2a b0fba3aac1b434ba096502287249d59e63632e03a8b13d1d3927a5701e9 |
| sha256 | ebcd46c888eebfb173932ba9cf03afde10493d0d61fa4b99874427512f410c49 | 7c0e850ad3ab88141a756c698c2088ebb52ff8bede7c785a97204cb4e29 ebcd46c888eebfb173932ba9cf03afde10493d0d61fa4b99874427512f410c49 2d706350c6f6392865bb550106ba5b3c39f7e2afc3d8683e4d8676b4e28 |
| sha256 | ed6f6f7d3a2a189ce7d246b44e0e74dbf9d1e6e39f5d7a0a3666c2e65c4a1f0f | 5c6cb398706e52c4c765a6729bb276b72816559e18c6c82c99960ed7b8c ed6f6f7d3a2a189ce7d246b44e0e74dbf9d1e6e39f5d7a0a3666c2e65c4a1f0f cfed40f9a6f3e555df646dae4decb95636af26b0da4e9f9173420bae268 |
From the original article
5 min read at unit42.paloaltonetworks.com
In early December 2017, 360 Netlab discovered a new malware family which they named Satori . Satori is a derivative of Mirai and exploits two vulnerabilities: CVE-2014-8361 a code execution vulnerability in the miniigd SOAP service in Realtek SDK, and CVE 2017-17215 a newly discovered vulnerability in Huawei’s HG532e home gateway patched in early December 2017.
By Cong Zheng, Claud Xiao, Yanhui Jia · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.