Vulnerabilityhigh
Realtek SDK Vulnerability Attacks Highlight IoT Supply Chain Threats
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-35394 | Remote Code Execution via Memory Corruption in Realtek Jungle SDK | 9.8 | 100% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | assailant.mpsl | ance, Kenya, United States, 1.7 hxxp://176[.]97[.]210[.]135/assailant[.]mpsl France, United States 1.2 hxxp://198[.]98[.]56[.]129/trc/ |
| domain | billy.sh | tates, Saint Kitts and Nevis, 1.2 hxxp://141[.]98[.]6[.]249/billy[.]sh United States, Kenya, 1.1 hxxp://185[.]216[.]71[.]157/Bin |
| domain | sora.mpsl | Vietnam, Kenya, France 0.7 hxxp://45[.]140[.]141[.]205/bins/sora[.]mpsl United States, Germany, The Netherlands, 0.5 Table 5. Top |
| domain | trc.mpsl | gion # of Attacks (million) hxxp://185[.]205[.]12[.]157/trc/TRC[.]mpsl United States, The Netherlands, Canada, 31.4 hxxp://172[. |
| domain | xd.mpsl | d States, Canada, Germany, 2.0 hxxp://37[.]44[.]238[.]178/d/xd[.]mpsl France, Kenya, United States, 1.7 hxxp://176[.]97[.]210[. |
| ipv4 | 103.149.137.124 | .]190 United States 39.8 172.81.41[.]196 United States 17.2 103.149.137[.]124 Vietnam 10.6 103.149.137[.]138 Vietnam 10.5 46.249.32[.]1 |
| ipv4 | 103.149.137.138 | .41[.]196 United States 17.2 103.149.137[.]124 Vietnam 10.6 103.149.137[.]138 Vietnam 10.5 46.249.32[.]181 The Netherlands 9.9 37.44.23 |
| ipv4 | 103.149.137.192 | 69.67.150[.]36 United States 1.2 37.44.238[.]144 France 1.2 103.149.137[.]192 Vietnam 1.2 185.122.204[.]30 Russia 1.1 Table 4. Top atta |
| ipv4 | 103.207.38.165 | 49[.]5[.]173[.]33 163[.]123[.]143[.]226 45[.]61[.]188[.]148 103[.]207[.]38[.]165 45[.]13[.]227[.]115 176[.]97[.]210[.]147 163[.]123[.] |
| ipv4 | 135.148.104.21 | ]196/trc/TRC[.]mpsl The, United States, Germany 10.6 hxxp://135[.]148[.]104[.]21/mipsel Vietnam, Kenya, France, United States, Singapo |
| ipv4 | 141.98.6.249 | TRC[.]mpsl United States, Saint Kitts and Nevis, 1.2 hxxp://141[.]98[.]6[.]249/billy[.]sh United States, Kenya, 1.1 hxxp://185[.]216 |
| ipv4 | 147.182.132.144 | 163[.]123[.]143[.]200 185[.]44[.]81[.]62 38[.]22[.]109[.]7 147[.]182[.]132[.]144 205[.]185[.]126[.]88 209[.]141[.]51[.]43 198[.]98[.]5 |
| ipv4 | 149.5.173.33 | 5[.]253[.]246[.]67 45[.]61[.]184[.]133 45[.]61[.]184[.]118 149[.]5[.]173[.]33 163[.]123[.]143[.]226 45[.]61[.]188[.]148 103[.]207[. |
| ipv4 | 163.123.143.200 | 3[.]207[.]38[.]165 45[.]13[.]227[.]115 176[.]97[.]210[.]147 163[.]123[.]143[.]200 185[.]44[.]81[.]62 38[.]22[.]109[.]7 147[.]182[.]132[ |
| ipv4 | 163.123.143.226 | 45[.]61[.]184[.]133 45[.]61[.]184[.]118 149[.]5[.]173[.]33 163[.]123[.]143[.]226 45[.]61[.]188[.]148 103[.]207[.]38[.]165 45[.]13[.]22 |
| ipv4 | 172.81.41.196 | # of attacks (million) 199.195.251[.]190 United States 39.8 172.81.41[.]196 United States 17.2 103.149.137[.]124 Vietnam 10.6 103.149 |
| ipv4 | 173.247.227.66 | 9[.]67[.]150[.]36 103[.]149[.]137[.]192 45[.]125[.]236[.]14 173[.]247[.]227[.]66 173[.]247[.]227[.]70 185[.]122[.]204[.]30 45[.]95[.]5 |
| ipv4 | 173.247.227.70 | [.]149[.]137[.]192 45[.]125[.]236[.]14 173[.]247[.]227[.]66 173[.]247[.]227[.]70 185[.]122[.]204[.]30 45[.]95[.]55[.]188 2[.]58[.]113[ |
| ipv4 | 176.97.210.135 | [.]178/d/xd[.]mpsl France, Kenya, United States, 1.7 hxxp://176[.]97[.]210[.]135/assailant[.]mpsl France, United States 1.2 hxxp://198 |
| ipv4 | 176.97.210.147 | 5[.]61[.]188[.]148 103[.]207[.]38[.]165 45[.]13[.]227[.]115 176[.]97[.]210[.]147 163[.]123[.]143[.]200 185[.]44[.]81[.]62 38[.]22[.]10 |
| ipv4 | 185.122.204.30 | .2 37.44.238[.]144 France 1.2 103.149.137[.]192 Vietnam 1.2 185.122.204[.]30 Russia 1.1 Table 4. Top attacker IP addresses. We also an |
| ipv4 | 185.205.12.157 | ack URLs Attack source region # of Attacks (million) hxxp://185[.]205[.]12[.]157/trc/TRC[.]mpsl United States, The Netherlands, Canada |
| ipv4 | 185.216.71.157 | tor tries to deliver a shell script znet.sh downloader from 185.216.71[.]157 utilizing wget . The script downloads the following files |
| ipv4 | 185.246.221.220 | er 2022, when the threat actor switched its malware host to 185.246.221[.]220 . In this campaign, the shell script utilizes wget and cu |
| ipv4 | 185.44.81.62 | .]13[.]227[.]115 176[.]97[.]210[.]147 163[.]123[.]143[.]200 185[.]44[.]81[.]62 38[.]22[.]109[.]7 147[.]182[.]132[.]144 205[.]185[.]1 |
| ipv4 | 193.142.146.35 | ]79 45[.]95[.]55[.]24 45[.]95[.]55[.]218 45[.]95[.]55[.]189 193[.]142[.]146[.]35 37[.]139[.]129[.]11 78[.]135[.]85[.]70 45[.]137[.]21[ |
| ipv4 | 195.133.81.29 | 8[.]135[.]85[.]70 45[.]137[.]21[.]166 195[.]178[.]120[.]183 195[.]133[.]81[.]29 5[.]253[.]246[.]67 45[.]61[.]184[.]133 45[.]61[.]184[ |
| ipv4 | 195.178.120.183 | 37[.]139[.]129[.]11 78[.]135[.]85[.]70 45[.]137[.]21[.]166 195[.]178[.]120[.]183 195[.]133[.]81[.]29 5[.]253[.]246[.]67 45[.]61[.]184[ |
| ipv4 | 198.98.52.213 | [.]182[.]132[.]144 205[.]185[.]126[.]88 209[.]141[.]51[.]43 198[.]98[.]52[.]213 45[.]95[.]55[.]185 20[.]249[.]89[.]181 3[.]235[.]28[. |
| ipv4 | 198.98.56.129 | 210[.]135/assailant[.]mpsl France, United States 1.2 hxxp://198[.]98[.]56[.]129/trc/TRC[.]mpsl United States, Saint Kitts and Nevis, |
| ipv4 | 199.195.251.190 | -2021-35394. IP Attack source region # of attacks (million) 199.195.251[.]190 United States 39.8 172.81.41[.]196 United States 17.2 103 |
| ipv4 | 20.249.89.181 | 209[.]141[.]51[.]43 198[.]98[.]52[.]213 45[.]95[.]55[.]185 20[.]249[.]89[.]181 3[.]235[.]28[.]168 Callback URLs hxxp://185.205.12[.] |
| ipv4 | 205.185.126.88 | 185[.]44[.]81[.]62 38[.]22[.]109[.]7 147[.]182[.]132[.]144 205[.]185[.]126[.]88 209[.]141[.]51[.]43 198[.]98[.]52[.]213 45[.]95[.]55[ |
| ipv4 | 209.141.51.43 | 8[.]22[.]109[.]7 147[.]182[.]132[.]144 205[.]185[.]126[.]88 209[.]141[.]51[.]43 198[.]98[.]52[.]213 45[.]95[.]55[.]185 20[.]249[.]89[ |
| ipv4 | 2.58.113.79 | 73[.]247[.]227[.]70 185[.]122[.]204[.]30 45[.]95[.]55[.]188 2[.]58[.]113[.]79 45[.]95[.]55[.]24 45[.]95[.]55[.]218 45[.]95[.]55[.]1 |
| ipv4 | 3.235.28.168 | 198[.]98[.]52[.]213 45[.]95[.]55[.]185 20[.]249[.]89[.]181 3[.]235[.]28[.]168 Callback URLs hxxp://185.205.12[.]157/trc/TRC[.]mpsl |
| ipv4 | 37.139.129.11 | 45[.]95[.]55[.]218 45[.]95[.]55[.]189 193[.]142[.]146[.]35 37[.]139[.]129[.]11 78[.]135[.]85[.]70 45[.]137[.]21[.]166 195[.]178[.]12 |
| ipv4 | 37.44.238.144 | 37.44.238[.]217 France 1.2 69.67.150[.]36 United States 1.2 37.44.238[.]144 France 1.2 103.149.137[.]192 Vietnam 1.2 185.122.204[.]30 |
| ipv4 | 37.44.238.148 | .137[.]138 Vietnam 10.5 46.249.32[.]181 The Netherlands 9.9 37.44.238[.]148 France 1.7 37.44.238[.]185 France 1.3 37.44.238[.]217 Fra |
| ipv4 | 37.44.238.178 | 0/trc/TRC[.]mpsl United States, Canada, Germany, 2.0 hxxp://37[.]44[.]238[.]178/d/xd[.]mpsl France, Kenya, United States, 1.7 hxxp:// |
| ipv4 | 37.44.238.185 | 249.32[.]181 The Netherlands 9.9 37.44.238[.]148 France 1.7 37.44.238[.]185 France 1.3 37.44.238[.]217 France 1.2 69.67.150[.]36 Unit |
| ipv4 | 37.44.238.217 | s 9.9 37.44.238[.]148 France 1.7 37.44.238[.]185 France 1.3 37.44.238[.]217 France 1.2 69.67.150[.]36 United States 1.2 37.44.238[.]1 |
| ipv4 | 38.22.109.7 | 6[.]97[.]210[.]147 163[.]123[.]143[.]200 185[.]44[.]81[.]62 38[.]22[.]109[.]7 147[.]182[.]132[.]144 205[.]185[.]126[.]88 209[.]141[ |
| ipv4 | 45.125.236.14 | 6[.]249[.]32[.]181 69[.]67[.]150[.]36 103[.]149[.]137[.]192 45[.]125[.]236[.]14 173[.]247[.]227[.]66 173[.]247[.]227[.]70 185[.]122[. |
| ipv4 | 45.13.227.115 | [.]123[.]143[.]226 45[.]61[.]188[.]148 103[.]207[.]38[.]165 45[.]13[.]227[.]115 176[.]97[.]210[.]147 163[.]123[.]143[.]200 185[.]44[. |
| ipv4 | 45.137.21.166 | 193[.]142[.]146[.]35 37[.]139[.]129[.]11 78[.]135[.]85[.]70 45[.]137[.]21[.]166 195[.]178[.]120[.]183 195[.]133[.]81[.]29 5[.]253[.]2 |
| ipv4 | 45.140.141.205 | ore_mipsle United States, Vietnam, Kenya, France 0.7 hxxp://45[.]140[.]141[.]205/bins/sora[.]mpsl United States, Germany, The Netherla |
| ipv4 | 45.61.184.118 | 195[.]133[.]81[.]29 5[.]253[.]246[.]67 45[.]61[.]184[.]133 45[.]61[.]184[.]118 149[.]5[.]173[.]33 163[.]123[.]143[.]226 45[.]61[.]18 |
| ipv4 | 45.61.184.133 | 95[.]178[.]120[.]183 195[.]133[.]81[.]29 5[.]253[.]246[.]67 45[.]61[.]184[.]133 45[.]61[.]184[.]118 149[.]5[.]173[.]33 163[.]123[.]14 |
| ipv4 | 45.61.188.148 | 5[.]61[.]184[.]118 149[.]5[.]173[.]33 163[.]123[.]143[.]226 45[.]61[.]188[.]148 103[.]207[.]38[.]165 45[.]13[.]227[.]115 176[.]97[.]2 |
| ipv4 | 45.95.55.185 | 05[.]185[.]126[.]88 209[.]141[.]51[.]43 198[.]98[.]52[.]213 45[.]95[.]55[.]185 20[.]249[.]89[.]181 3[.]235[.]28[.]168 Callback URLs |
| ipv4 | 45.95.55.188 | [.]247[.]227[.]66 173[.]247[.]227[.]70 185[.]122[.]204[.]30 45[.]95[.]55[.]188 2[.]58[.]113[.]79 45[.]95[.]55[.]24 45[.]95[.]55[.]21 |
| ipv4 | 45.95.55.189 | ]188 2[.]58[.]113[.]79 45[.]95[.]55[.]24 45[.]95[.]55[.]218 45[.]95[.]55[.]189 193[.]142[.]146[.]35 37[.]139[.]129[.]11 78[.]135[.]8 |
| ipv4 | 45.95.55.218 | .]30 45[.]95[.]55[.]188 2[.]58[.]113[.]79 45[.]95[.]55[.]24 45[.]95[.]55[.]218 45[.]95[.]55[.]189 193[.]142[.]146[.]35 37[.]139[.]12 |
| ipv4 | 45.95.55.24 | 0 185[.]122[.]204[.]30 45[.]95[.]55[.]188 2[.]58[.]113[.]79 45[.]95[.]55[.]24 45[.]95[.]55[.]218 45[.]95[.]55[.]189 193[.]142[.]146 |
| ipv4 | 46.249.32.181 | 3.149.137[.]124 Vietnam 10.6 103.149.137[.]138 Vietnam 10.5 46.249.32[.]181 The Netherlands 9.9 37.44.238[.]148 France 1.7 37.44.238[ |
| ipv4 | 5.253.246.67 | [.]137[.]21[.]166 195[.]178[.]120[.]183 195[.]133[.]81[.]29 5[.]253[.]246[.]67 45[.]61[.]184[.]133 45[.]61[.]184[.]118 149[.]5[.]173 |
| ipv4 | 69.67.150.36 | e 1.7 37.44.238[.]185 France 1.3 37.44.238[.]217 France 1.2 69.67.150[.]36 United States 1.2 37.44.238[.]144 France 1.2 103.149.137[ |
| ipv4 | 78.135.85.70 | 45[.]95[.]55[.]189 193[.]142[.]146[.]35 37[.]139[.]129[.]11 78[.]135[.]85[.]70 45[.]137[.]21[.]166 195[.]178[.]120[.]183 195[.]133[. |
| sha256 | 080a64d595ff246d01b920d5010cffcb4ac56f224acdec32ee3eab08099c6a7b | abcd4fa94ffc0f1f43a92f816e6bd08272ec54d748cf004c3ef1323d5d9 080a64d595ff246d01b920d5010cffcb4ac56f224acdec32ee3eab08099c6a7b e1d3adcb85298a08973b7ae6702cc4830d20ebde98e2eac85179c1bbba3 |
| sha256 | 0d2c3120464184610ac939c34e5309968bd7b81255708307d545d742f3468930 | 2a8baf2a46ffe872aedc823ab766b4a9fbab129b2c7dc9513ba8ee712bc 0d2c3120464184610ac939c34e5309968bd7b81255708307d545d742f3468930 f3a3e90ea713215a4d30f0f142d6ef0f1ed72b246ee297b8bba64921dbf |
| sha256 | 1967370203138b9324f11c5cb3fd15ac8d2f0c585373486614600b676a4e2641 | 945ee32199536d4c85124a24c28e853b557eb31f3907d19f08b9798dff4 1967370203138b9324f11c5cb3fd15ac8d2f0c585373486614600b676a4e2641 78953c71318fb93fa90607039bceb48f2746a8abfa3a9a8914c8fdc48eb |
| sha256 | 1a70ceb57768d3e027e307abd09548f151a8d6da72532f1b88e9813eaf0bdad2 | 887ae0ef8b51845bf0f2996c4f9891cdc0724b7d0ccc3dbc1b4cdae11a2 1a70ceb57768d3e027e307abd09548f151a8d6da72532f1b88e9813eaf0bdad2 2ef3040947c9d51317e103457a6613ac9297cb610b3691ef6d440f15cb3 |
| sha256 | 26e96945ee32199536d4c85124a24c28e853b557eb31f3907d19f08b9798dff4 | (DDoS) botnet developed in Golang, called RedGoBot (SHA256: 26e96945ee32199536d4c85124a24c28e853b557eb31f3907d19f08b9798dff4 ) RedGoBot’s first campaign was first observed in early Sep |
| sha256 | 28d6dce95ffb8186ac8c611dee0681cca028bbf93365e4f0c7c67c235d3034a3 | e8d4c2ec0c489e4c5dbb89994c223f29e8d4470825bd488bf1a44e42751 28d6dce95ffb8186ac8c611dee0681cca028bbf93365e4f0c7c67c235d3034a3 97878c28d915e2b56e7c06436d209a9198eb0c50bdfb1fd4602e9e95b5e |
| sha256 | 2ef3040947c9d51317e103457a6613ac9297cb610b3691ef6d440f15cb36a9ed | eb57768d3e027e307abd09548f151a8d6da72532f1b88e9813eaf0bdad2 2ef3040947c9d51317e103457a6613ac9297cb610b3691ef6d440f15cb36a9ed 9b7eb2cf51d806076e1662ca4ad800c1de421234c19fbea44b56eb47cc6 |
| sha256 | 3f8b5887ae0ef8b51845bf0f2996c4f9891cdc0724b7d0ccc3dbc1b4cdae11a2 | 90ea713215a4d30f0f142d6ef0f1ed72b246ee297b8bba64921dbf4300c 3f8b5887ae0ef8b51845bf0f2996c4f9891cdc0724b7d0ccc3dbc1b4cdae11a2 1a70ceb57768d3e027e307abd09548f151a8d6da72532f1b88e9813eaf0 |
| sha256 | 57d39a6a88093c9e1fbc1626105d714be92680bdf666279b7663bcaaf7fa7e6e | c71318fb93fa90607039bceb48f2746a8abfa3a9a8914c8fdc48ebf55df 57d39a6a88093c9e1fbc1626105d714be92680bdf666279b7663bcaaf7fa7e6e 78b55d3f1b34f1154a28ce4fc855252bc3104a07944053facf6acce9195 |
| sha256 | 5967a4889b54b97adbb6b949ffd590fa416599326eb3432f40fa142aab1df795 | 4114737e4a599f0769683de4faf54cefae1cc106d9f475aa23bdbf5a753 5967a4889b54b97adbb6b949ffd590fa416599326eb3432f40fa142aab1df795 ff8a1abcd4fa94ffc0f1f43a92f816e6bd08272ec54d748cf004c3ef132 |
| sha256 | 5e647d4991f9d339e6e83cee6168915e1e2c9fac0cddc53d3083cbc96a278035 | 945ee32199536d4c85124a24c28e853b557eb31f3907d19f08b9798dff4 5e647d4991f9d339e6e83cee6168915e1e2c9fac0cddc53d3083cbc96a278035 6bca8cf5e48e819179f8473e4e600da2c1ef00802bf1744885dcb5ad566 |
| sha256 | 637dc2a8baf2a46ffe872aedc823ab766b4a9fbab129b2c7dc9513ba8ee712bc | c28d915e2b56e7c06436d209a9198eb0c50bdfb1fd4602e9e95b5eb4321 637dc2a8baf2a46ffe872aedc823ab766b4a9fbab129b2c7dc9513ba8ee712bc 0d2c3120464184610ac939c34e5309968bd7b81255708307d545d742f34 |
| sha256 | 67f73e1efa3c3a05e896567dfb2cef56e9b5eb33283a13e5934900030357e7e6 | f5c06a7ff6774688e8d71f6d06e0d402f4f86d5b23969bc53d5eab3e522 67f73e1efa3c3a05e896567dfb2cef56e9b5eb33283a13e5934900030357e7e6 ebfedbcf428215d34d8f876fb9c5658048dbb4c5607f328ae155bf26a29 |
| sha256 | 6bca8cf5e48e819179f8473e4e600da2c1ef00802bf1744885dcb5ad56618943 | d4991f9d339e6e83cee6168915e1e2c9fac0cddc53d3083cbc96a278035 6bca8cf5e48e819179f8473e4e600da2c1ef00802bf1744885dcb5ad56618943 Mirai Samples bc03af5c06a7ff6774688e8d71f6d06e0d402f4f86d5b |
| sha256 | 78953c71318fb93fa90607039bceb48f2746a8abfa3a9a8914c8fdc48ebf55df | 70203138b9324f11c5cb3fd15ac8d2f0c585373486614600b676a4e2641 78953c71318fb93fa90607039bceb48f2746a8abfa3a9a8914c8fdc48ebf55df 57d39a6a88093c9e1fbc1626105d714be92680bdf666279b7663bcaaf7f |
| sha256 | 78b55d3f1b34f1154a28ce4fc855252bc3104a07944053facf6acce9195b2e77 | a6a88093c9e1fbc1626105d714be92680bdf666279b7663bcaaf7fa7e6e 78b55d3f1b34f1154a28ce4fc855252bc3104a07944053facf6acce9195b2e77 81e581ed06515af959c8477442243f20baa77c0e54a1054542900936c6e |
| sha256 | 81e581ed06515af959c8477442243f20baa77c0e54a1054542900936c6e81ff5 | d3f1b34f1154a28ce4fc855252bc3104a07944053facf6acce9195b2e77 81e581ed06515af959c8477442243f20baa77c0e54a1054542900936c6e81ff5 ab3de77616b4d85f032a226da6c3629de4a8f1c1b4d32674c1bed30afb9 |
| sha256 | 97878c28d915e2b56e7c06436d209a9198eb0c50bdfb1fd4602e9e95b5eb4321 | ce95ffb8186ac8c611dee0681cca028bbf93365e4f0c7c67c235d3034a3 97878c28d915e2b56e7c06436d209a9198eb0c50bdfb1fd4602e9e95b5eb4321 637dc2a8baf2a46ffe872aedc823ab766b4a9fbab129b2c7dc9513ba8ee |
| sha256 | 9b7eb2cf51d806076e1662ca4ad800c1de421234c19fbea44b56eb47cc616fd8 | 40947c9d51317e103457a6613ac9297cb610b3691ef6d440f15cb36a9ed 9b7eb2cf51d806076e1662ca4ad800c1de421234c19fbea44b56eb47cc616fd8 |
| sha256 | a877b4e71c8f2f4ab6915cbe8c57c82ac12331e183f7cbda2de4dc3780a50379 | 77616b4d85f032a226da6c3629de4a8f1c1b4d32674c1bed30afb9419e1 a877b4e71c8f2f4ab6915cbe8c57c82ac12331e183f7cbda2de4dc3780a50379 26e96945ee32199536d4c85124a24c28e853b557eb31f3907d19f08b979 |
| sha256 | ab3de77616b4d85f032a226da6c3629de4a8f1c1b4d32674c1bed30afb9419e1 | 1ed06515af959c8477442243f20baa77c0e54a1054542900936c6e81ff5 ab3de77616b4d85f032a226da6c3629de4a8f1c1b4d32674c1bed30afb9419e1 a877b4e71c8f2f4ab6915cbe8c57c82ac12331e183f7cbda2de4dc3780a |
| sha256 | bc03af5c06a7ff6774688e8d71f6d06e0d402f4f86d5b23969bc53d5eab3e522 | 8473e4e600da2c1ef00802bf1744885dcb5ad56618943 Mirai Samples bc03af5c06a7ff6774688e8d71f6d06e0d402f4f86d5b23969bc53d5eab3e522 67f73e1efa3c3a05e896567dfb2cef56e9b5eb33283a13e593490003035 |
| sha256 | e0fd14114737e4a599f0769683de4faf54cefae1cc106d9f475aa23bdbf5a753 | bcf428215d34d8f876fb9c5658048dbb4c5607f328ae155bf26a292b38d e0fd14114737e4a599f0769683de4faf54cefae1cc106d9f475aa23bdbf5a753 5967a4889b54b97adbb6b949ffd590fa416599326eb3432f40fa142aab1 |
| sha256 | e1d3adcb85298a08973b7ae6702cc4830d20ebde98e2eac85179c1bbba3ef7ac | 4d595ff246d01b920d5010cffcb4ac56f224acdec32ee3eab08099c6a7b e1d3adcb85298a08973b7ae6702cc4830d20ebde98e2eac85179c1bbba3ef7ac edec8e8d4c2ec0c489e4c5dbb89994c223f29e8d4470825bd488bf1a44e |
| sha256 | ebfedbcf428215d34d8f876fb9c5658048dbb4c5607f328ae155bf26a292b38d | e1efa3c3a05e896567dfb2cef56e9b5eb33283a13e5934900030357e7e6 ebfedbcf428215d34d8f876fb9c5658048dbb4c5607f328ae155bf26a292b38d e0fd14114737e4a599f0769683de4faf54cefae1cc106d9f475aa23bdbf |
| sha256 | edec8e8d4c2ec0c489e4c5dbb89994c223f29e8d4470825bd488bf1a44e42751 | dcb85298a08973b7ae6702cc4830d20ebde98e2eac85179c1bbba3ef7ac edec8e8d4c2ec0c489e4c5dbb89994c223f29e8d4470825bd488bf1a44e42751 28d6dce95ffb8186ac8c611dee0681cca028bbf93365e4f0c7c67c235d3 |
| sha256 | f3a3e90ea713215a4d30f0f142d6ef0f1ed72b246ee297b8bba64921dbf4300c | 120464184610ac939c34e5309968bd7b81255708307d545d742f3468930 f3a3e90ea713215a4d30f0f142d6ef0f1ed72b246ee297b8bba64921dbf4300c 3f8b5887ae0ef8b51845bf0f2996c4f9891cdc0724b7d0ccc3dbc1b4cda |
| sha256 | ff8a1abcd4fa94ffc0f1f43a92f816e6bd08272ec54d748cf004c3ef1323d5d9 | 4889b54b97adbb6b949ffd590fa416599326eb3432f40fa142aab1df795 ff8a1abcd4fa94ffc0f1f43a92f816e6bd08272ec54d748cf004c3ef1323d5d9 080a64d595ff246d01b920d5010cffcb4ac56f224acdec32ee3eab08099 |
| url | http://135.148.104.21/mipsel | [.]41[.]196/trc/TRC[.]mpsl The, United States, Germany 10.6 hxxp://135[.]148[.]104[.]21/mipsel Vietnam, Kenya, France, United States, Singapore, Ind |
| url | http://141.98.6.249/billy.sh | 29/trc/TRC[.]mpsl United States, Saint Kitts and Nevis, 1.2 hxxp://141[.]98[.]6[.]249/billy[.]sh United States, Kenya, 1.1 hxxp://185[.]216[.]71[.]1 |
| url | http://172.81.41.196/trc/TRC.mpsl | trc/TRC[.]mpsl United States, The Netherlands, Canada, 31.4 hxxp://172[.]81[.]41[.]196/trc/TRC[.]mpsl The, United States, Germany 10.6 hxxp://135[.]148[. |
| url | http://176.97.210.135/assailant.mpsl | 4[.]238[.]178/d/xd[.]mpsl France, Kenya, United States, 1.7 hxxp://176[.]97[.]210[.]135/assailant[.]mpsl France, United States 1.2 hxxp://198[.]98[.]56[.]12 |
| url | http://185.205.12.157/trc/TRC.mpsl | . Callback URLs Attack source region # of Attacks (million) hxxp://185[.]205[.]12[.]157/trc/TRC[.]mpsl United States, The Netherlands, Canada, 31.4 hxxp:/ |
| url | http://185.216.71.157/Bins_Bot_hicore_amd64 | utilizing wget . The script downloads the following files: hxxp://185.216.71[.]157/Bins_Bot_hicore_amd64 hxxp://185.216.71[.]157/Bins_Bot_hicore_arm64 hxxp://185. |
| url | http://185.216.71.157/Bins_Bot_hicore_arm | _hicore_amd64 hxxp://185.216.71[.]157/Bins_Bot_hicore_arm64 hxxp://185.216.71[.]157/Bins_Bot_hicore_arm hxxp://185.216.71[.]157/Bins_Bot_hicore_mips hxxp://185.2 |
| url | http://185.216.71.157/Bins_Bot_hicore_arm64 | lowing files: hxxp://185.216.71[.]157/Bins_Bot_hicore_amd64 hxxp://185.216.71[.]157/Bins_Bot_hicore_arm64 hxxp://185.216.71[.]157/Bins_Bot_hicore_arm hxxp://185.21 |
| url | http://185.216.71.157/Bins_Bot_hicore_mips | ot_hicore_arm64 hxxp://185.216.71[.]157/Bins_Bot_hicore_arm hxxp://185.216.71[.]157/Bins_Bot_hicore_mips hxxp://185.216.71[.]157/Bins_Bot_hicore_mips64 hxxp://185 |
| url | http://185.216.71.157/Bins_Bot_hicore_mips64 | Bot_hicore_arm hxxp://185.216.71[.]157/Bins_Bot_hicore_mips hxxp://185.216.71[.]157/Bins_Bot_hicore_mips64 hxxp://185.216.71[.]157/Bins_Bot_hicore_ppc64 hxxp://185. |
| url | http://185.216.71.157/Bins_Bot_hicore_mips64le | hicore_s390x hxxp://185.216.71[.]157/Bins_Bot_hicore_mipsle hxxp://185.216.71[.]157/Bins_Bot_hicore_mips64le The second wave of the RedGoBot campaign was observed in |
| url | http://185.216.71.157/Bins_Bot_hicore_mipsle | icore_ppc64le hxxp://185.216.71[.]157/Bins_Bot_hicore_s390x hxxp://185.216.71[.]157/Bins_Bot_hicore_mipsle hxxp://185.216.71[.]157/Bins_Bot_hicore_mips64le The seco |
| url | http://185.216.71.157/Bins_Bot_hicore_ppc64 | _hicore_mips hxxp://185.216.71[.]157/Bins_Bot_hicore_mips64 hxxp://185.216.71[.]157/Bins_Bot_hicore_ppc64 hxxp://185.216.71[.]157/Bins_Bot_hicore_ppc64le hxxp://18 |
| url | http://185.216.71.157/Bins_Bot_hicore_ppc64le | hicore_mips64 hxxp://185.216.71[.]157/Bins_Bot_hicore_ppc64 hxxp://185.216.71[.]157/Bins_Bot_hicore_ppc64le hxxp://185.216.71[.]157/Bins_Bot_hicore_s390x hxxp://185. |
| url | http://185.216.71.157/Bins_Bot_hicore_s390x | icore_ppc64 hxxp://185.216.71[.]157/Bins_Bot_hicore_ppc64le hxxp://185.216.71[.]157/Bins_Bot_hicore_s390x hxxp://185.216.71[.]157/Bins_Bot_hicore_mipsle hxxp://185 |
| url | http://185.246.221.220/Bins_Bot_hicore_amd64 | t_hicore_arm64 hxxp://185.246.221[.]220/Bins_Bot_hicore_arm hxxp://185.246.221[.]220/Bins_Bot_hicore_amd64 The botnet client can accept the following command and co |
| url | http://185.246.221.220/Bins_Bot_hicore_arm | _hicore_mips hxxp://185.246.221[.]220/Bins_Bot_hicore_arm64 hxxp://185.246.221[.]220/Bins_Bot_hicore_arm hxxp://185.246.221[.]220/Bins_Bot_hicore_amd64 The botnet |
| url | http://185.246.221.220/Bins_Bot_hicore_arm64 | hicore_mipsle hxxp://185.246.221[.]220/Bins_Bot_hicore_mips hxxp://185.246.221[.]220/Bins_Bot_hicore_arm64 hxxp://185.246.221[.]220/Bins_Bot_hicore_arm hxxp://185.2 |
| url | http://185.246.221.220/Bins_Bot_hicore_mips | icore_ppc64 hxxp://185.246.221[.]220/Bins_Bot_hicore_mipsle hxxp://185.246.221[.]220/Bins_Bot_hicore_mips hxxp://185.246.221[.]220/Bins_Bot_hicore_arm64 hxxp://185 |
| url | http://185.246.221.220/Bins_Bot_hicore_mipsle | core_ppc64le hxxp://185.246.221[.]220/Bins_Bot_hicore_ppc64 hxxp://185.246.221[.]220/Bins_Bot_hicore_mipsle hxxp://185.246.221[.]220/Bins_Bot_hicore_mips hxxp://185. |
| url | http://185.246.221.220/Bins_Bot_hicore_ppc64 | core_s390x hxxp://185.246.221[.]220/Bins_Bot_hicore_ppc64le hxxp://185.246.221[.]220/Bins_Bot_hicore_ppc64 hxxp://185.246.221[.]220/Bins_Bot_hicore_mipsle hxxp://18 |
| url | http://185.246.221.220/Bins_Bot_hicore_ppc64le | chitectures: hxxp://185.246.221[.]220/Bins_Bot_hicore_s390x hxxp://185.246.221[.]220/Bins_Bot_hicore_ppc64le hxxp://185.246.221[.]220/Bins_Bot_hicore_ppc64 hxxp://185 |
| url | http://185.246.221.220/Bins_Bot_hicore_s390x | t clients to accommodate different processor architectures: hxxp://185.246.221[.]220/Bins_Bot_hicore_s390x hxxp://185.246.221[.]220/Bins_Bot_hicore_ppc64le hxxp://1 |
| url | http://198.98.56.129/trc/TRC.mpsl | .]97[.]210[.]135/assailant[.]mpsl France, United States 1.2 hxxp://198[.]98[.]56[.]129/trc/TRC[.]mpsl United States, Saint Kitts and Nevis, 1.2 hxxp://14 |
| url | http://199.195.251.190/trc/TRC.mpsl | Vietnam, Kenya, France, United States, Singapore, India 8.1 hxxp://199[.]195[.]251[.]190/trc/TRC[.]mpsl United States, Canada, Germany, 2.0 hxxp://37[.]44[ |
| url | http://37.44.238.178/d/xd.mpsl | 51[.]190/trc/TRC[.]mpsl United States, Canada, Germany, 2.0 hxxp://37[.]44[.]238[.]178/d/xd[.]mpsl France, Kenya, United States, 1.7 hxxp://176[.]97[. |
| url | http://45.140.141.205/bins/sora.mpsl | Bot_hicore_mipsle United States, Vietnam, Kenya, France 0.7 hxxp://45[.]140[.]141[.]205/bins/sora[.]mpsl United States, Germany, The Netherlands, 0.5 Table |
From the original article
9 min read at unit42.paloaltonetworks.com
Unit 42 researchers review tens of millions of attack records every month, and most months, attacks targeting a single vulnerability do not exceed 10% of the total number of attacks.
By Yiheng An, Chao Lei, Adam Robbie, Aveek Das, Zhibin Zhang, Shehroze Farooqi · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.