Mirai Variant V3G4 Targets IoT Devices
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.
From July to December 2022, Unit 42 observed three campaigns spreading V3G4, a Mirai botnet variant, by exploiting 13 vulnerabilities, including CVE-2022-26134 in Atlassian Confluence and CVE-2019-15107 in Webmin. The campaigns shared the same C2 domains containing the string 8xl9, nearly identical shell script downloaders, and the same XOR keys, suggesting a single threat actor. The malware brute-forces telnet and SSH credentials, terminates rival botnet processes via a stop list, and receives DDoS commands from its C2. Compromised servers and networking devices are absorbed into the botnet for further attacks.
Key facts
- 13 exploited vulnerabilities spanning FreePBX, FRITZ!Box, Geutebruck, DrayTek, and Confluence.
- Three campaigns linked by shared C2 domains, downloaders, and XOR keys.
- V3G4 uses four rounds of XOR decryption for execution-related strings.
- Brute-forces telnet/SSH credentials embedded in the malware, encrypted with XOR key 0x37.
- Stop list terminates processes of other botnet families and Mirai variants.
- CVEs
- CVE-2012-4869CVE-2014-9727CVE-2017-5173CVE-2019-15107CVE-2020-8515CVE-2020-15415CVE-2022-26134CVE-2022-36267CVE-2022-4257
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110.001 Password GuessingT1105 Ingress Tool TransferT1027 Obfuscated Files or InformationT1498 Network Denial of Service
- Organizations
- Palo Alto NetworksUnit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-4869 | — | 70% | — | ||
| CVE-2014-9727 | — | 72% | — | ||
| CVE-2017-5173 | An Improper Neutralization of Special Elements (in an OS command) issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12 | 9.8 | 30% | PoC | |
| CVE-2019-15107 | Unauthenticated Command Injection RCE in Webmin <= 1.920 | 9.8 | 100% | KEVRansomwarePoC ×5 | KEV |
| CVE-2020-15415 | Unauthenticated OS Command Injection in DrayTek Vigor3900/2960/300B Routers | 9.8 | 84% | KEVPoC | KEV |
| CVE-2020-8515 | Unauthenticated Command Injection RCE in DrayTek Vigor3900/2960/300B Routers | 9.8 | 100% | KEVPoC | KEV |
| CVE-2022-26134 | Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-36267 | In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability | 9.8 | 54% | PoC ×2 | |
| CVE-2022-4257 | C-DATA Web Management System: It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET… | 9.8 | 44% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 8x19.com | icators of Compromise Infrastructure Malware C2 comeanalyze.8x19[.]com Malware Host 176.123.9[.]238 198.98.49[.]79 104.244.72[.] |
| ipv4 | 104.244.72.64 | lyze.8x19[.]com Malware Host 176.123.9[.]238 198.98.49[.]79 104.244.72[.]64 Artifacts Shell Script Downloader 0837de91aa6bd52ef79d744 |
| ipv4 | 176.123.9.238 | frastructure Malware C2 comeanalyze.8x19[.]com Malware Host 176.123.9[.]238 198.98.49[.]79 104.244.72[.]64 Artifacts Shell Script Dow |
| ipv4 | 198.98.49.79 | ware C2 comeanalyze.8x19[.]com Malware Host 176.123.9[.]238 198.98.49[.]79 104.244.72[.]64 Artifacts Shell Script Downloader 0837de9 |
| sha256 | 0837de91aa6bd52ef79d744daba4238a5a48a79eb91cb1a727da3e97d5b36329 | 8.49[.]79 104.244.72[.]64 Artifacts Shell Script Downloader 0837de91aa6bd52ef79d744daba4238a5a48a79eb91cb1a727da3e97d5b36329 c32f8df3cb019e83e0ac49ab0462c59ec70733c3d516ade011727408751 |
| sha256 | 1218da43a62da76927484bca73a3eee53425c54625147f8d01149bcef2f09d1e | 0acc478bf09658a679a4689f34598fe6e92086efe82900242f3cc5b7aec 1218da43a62da76927484bca73a3eee53425c54625147f8d01149bcef2f09d1e 2944db28e4505fc439599dae15b10bf57b7cf6c2597f618f41b99bfc654 |
| sha256 | 1cf3879d9e93d1ff30ce5ec0f64ff15b1db7d8237160c83efed688d800e5ef12 | 589A53BDEC49C624F3CB2FC8319218DF721F486E2F15F3C07ABED97AAE6 1cf3879d9e93d1ff30ce5ec0f64ff15b1db7d8237160c83efed688d800e5ef12 c5be50880e2b5a8a8d43a5f1fd6f5d36fc665ab9b4031a9b6a4d5222200 |
| sha256 | 1dc4777dac6dc4e8c650241e211311c4a418a35ebded72fcdd6bcb965ccf918b | 41985c466c131e48b9ba0d1bb80bdb7556c941ee84aa461fe2efbf1e853 1dc4777dac6dc4e8c650241e211311c4a418a35ebded72fcdd6bcb965ccf918b 3e69e8ed741ab39b0914f7e95bf13b2f0ae9f3c1227dcffdea3369e03e8 |
| sha256 | 210f3f1ffd2ec66a5076a7fea5d83caa8bbcdb0f3bc3bd030c77eded6f4b5d90 | 90f6e4d92b511fcde9a712b1a8405c5333e0ad78a4c676a64b22412e149 210f3f1ffd2ec66a5076a7fea5d83caa8bbcdb0f3bc3bd030c77eded6f4b5d90 73cc00acc478bf09658a679a4689f34598fe6e92086efe82900242f3cc5 |
| sha256 | 2944db28e4505fc439599dae15b10bf57b7cf6c2597f618f41b99bfc65443c61 | a43a62da76927484bca73a3eee53425c54625147f8d01149bcef2f09d1e 2944db28e4505fc439599dae15b10bf57b7cf6c2597f618f41b99bfc65443c61 4bffc171c0748cc9e3398b1ce8135b125f54f46752768c981c45d3390e8 |
| sha256 | 31926da5ca004a11c1f46947edb220afe3a53f81cf245b3afae7ea1abaec7c38 | f1be47233b358889d0594c14409309818d86347d September Campaign 31926da5ca004a11c1f46947edb220afe3a53f81cf245b3afae7ea1abaec7c38 eed4690f6e4d92b511fcde9a712b1a8405c5333e0ad78a4c676a64b2241 |
| sha256 | 3e69e8ed741ab39b0914f7e95bf13b2f0ae9f3c1227dcffdea3369e03e8bb792 | 77dac6dc4e8c650241e211311c4a418a35ebded72fcdd6bcb965ccf918b 3e69e8ed741ab39b0914f7e95bf13b2f0ae9f3c1227dcffdea3369e03e8bb792 b2e4ee94783062658ddf2c41e9acafb401d0f93e3848c027383a5ca1928 |
| sha256 | 3f3fb70e16d65f5f4b21777b87c9aae6072022c3dfbefd177f37c8aef4a6aeee | a88de9b566ce980a8188674319039d2fbe13b049859f8fe4821c92f9200 3f3fb70e16d65f5f4b21777b87c9aae6072022c3dfbefd177f37c8aef4a6aeee 67379740ed15e8da8604cc1f0ea715c8641674de66e553c461b3ae782a5 |
| sha256 | 4bffc171c0748cc9e3398b1ce8135b125f54f46752768c981c45d3390e8359a1 | b28e4505fc439599dae15b10bf57b7cf6c2597f618f41b99bfc65443c61 4bffc171c0748cc9e3398b1ce8135b125f54f46752768c981c45d3390e8359a1 b3a17934f6f72941b9a60097ab09228d873a2f8737ee0ea93b08e5f1cc3 |
| sha256 | 6229041985c466c131e48b9ba0d1bb80bdb7556c941ee84aa461fe2efbf1e853 | 9320f07d7eade9af523297b4bcfd0e0af187272e368e889c988a55ed78e 6229041985c466c131e48b9ba0d1bb80bdb7556c941ee84aa461fe2efbf1e853 1dc4777dac6dc4e8c650241e211311c4a418a35ebded72fcdd6bcb965cc |
| sha256 | 63acd589a53bdec49c624f3cb2fc8319218df721f486e2f15f3c07abed97aae6 | b3b7cb2d57ca1e89999b0b1da80fb9658dff6e44 December Campaign: 63ACD589A53BDEC49C624F3CB2FC8319218DF721F486E2F15F3C07ABED97AAE6 1cf3879d9e93d1ff30ce5ec0f64ff15b1db7d8237160c83efed688d800e |
| sha256 | 64545e94daafba191669333e1dd0c6e1190df47e0742bd515911cce0cdbd4fd1 | 9a8c4f9bb28582c485549b328d6123e8aea33009ce7657f7fc0ef829e03 64545e94daafba191669333e1dd0c6e1190df47e0742bd515911cce0cdbd4fd1 69bb44736817dabe88e3014c6207ba702f644fb43f6feaec23091af0b52 |
| sha256 | 67379740ed15e8da8604cc1f0ea715c8641674de66e553c461b3ae782a5d0cbe | 70e16d65f5f4b21777b87c9aae6072022c3dfbefd177f37c8aef4a6aeee 67379740ed15e8da8604cc1f0ea715c8641674de66e553c461b3ae782a5d0cbe ab3d61a76197003822252124e89987d061d6a4a33b9891cea778d3708cd |
| sha256 | 69bb44736817dabe88e3014c6207ba702f644fb43f6feaec23091af0b5224bc6 | e94daafba191669333e1dd0c6e1190df47e0742bd515911cce0cdbd4fd1 69bb44736817dabe88e3014c6207ba702f644fb43f6feaec23091af0b5224bc6 eaa387fcc12f2d8a7d42f12d27e7dccb4f3e11492a7d3a3a1ce830a11b5 |
| sha256 | 6f654198e8efd5aff1c7a903353967d0e96aeff0402cb0a79fabbc10d18c63d2 | 1a76197003822252124e89987d061d6a4a33b9891cea778d3708cd50447 6f654198e8efd5aff1c7a903353967d0e96aeff0402cb0a79fabbc10d18c63d2 c288c200cf7bbebe7a81fd42ca1bd4c6cb6080f28f2cec297a0d3e6aff7 |
| sha256 | 73cc00acc478bf09658a679a4689f34598fe6e92086efe82900242f3cc5b7aec | f1ffd2ec66a5076a7fea5d83caa8bbcdb0f3bc3bd030c77eded6f4b5d90 73cc00acc478bf09658a679a4689f34598fe6e92086efe82900242f3cc5b7aec 1218da43a62da76927484bca73a3eee53425c54625147f8d01149bcef2f |
| sha256 | 7bc99c87a1e0582b5f15f40141226862fbe726b496e1e77c7f95993e8e945733 | 420a978434e2b6a9e9b85b688a44593fa V3G4 Sample July Campaign 7bc99c87a1e0582b5f15f40141226862fbe726b496e1e77c7f95993e8e945733 88f7b9a8c4f9bb28582c485549b328d6123e8aea33009ce7657f7fc0ef8 |
| sha256 | 7d9cdf3afb1d52f49d82b1ffe28a3da08c6aeeaa8c5047ba37c73802d2cd9ec2 | 6cabbb90dfe9cd75f12c01fb64766dd1ec0f4247dbf8f4477dd64407fbf 7d9cdf3afb1d52f49d82b1ffe28a3da08c6aeeaa8c5047ba37c73802d2cd9ec2 9a0d39265b53e1959df49dbc8727ad344abc12a8bc0bd8d8b76f8b15052 |
| sha256 | 7dea8dac3f455f3a57fecfa5a047439126556858c239e73cd8feec2dc13bae2c | 0391279b014e53d73c2216a84bd528e18f1f633ba0101288aa963f77c5b 7dea8dac3f455f3a57fecfa5a047439126556858c239e73cd8feec2dc13bae2c a10ce475f64f3821ab32c88f6b013effd40843dd575ceaab46a57f134c2 |
| sha256 | 88f7b9a8c4f9bb28582c485549b328d6123e8aea33009ce7657f7fc0ef829e03 | c87a1e0582b5f15f40141226862fbe726b496e1e77c7f95993e8e945733 88f7b9a8c4f9bb28582c485549b328d6123e8aea33009ce7657f7fc0ef829e03 64545e94daafba191669333e1dd0c6e1190df47e0742bd515911cce0cdb |
| sha256 | 916e00391279b014e53d73c2216a84bd528e18f1f633ba0101288aa963f77c5b | 934f6f72941b9a60097ab09228d873a2f8737ee0ea93b08e5f1cc3916d1 916e00391279b014e53d73c2216a84bd528e18f1f633ba0101288aa963f77c5b 7dea8dac3f455f3a57fecfa5a047439126556858c239e73cd8feec2dc13 |
| sha256 | 9a0d39265b53e1959df49dbc8727ad344abc12a8bc0bd8d8b76f8b150525dca6 | f3afb1d52f49d82b1ffe28a3da08c6aeeaa8c5047ba37c73802d2cd9ec2 9a0d39265b53e1959df49dbc8727ad344abc12a8bc0bd8d8b76f8b150525dca6 d00fbfc439cb9c5c850690134b0d51f262021c0d04d9934df464980c346 |
| sha256 | 9b7f36cabbb90dfe9cd75f12c01fb64766dd1ec0f4247dbf8f4477dd64407fbf | 0880e2b5a8a8d43a5f1fd6f5d36fc665ab9b4031a9b6a4d52222004c2c1 9b7f36cabbb90dfe9cd75f12c01fb64766dd1ec0f4247dbf8f4477dd64407fbf 7d9cdf3afb1d52f49d82b1ffe28a3da08c6aeeaa8c5047ba37c73802d2c |
| sha256 | a10ce475f64f3821ab32c88f6b013effd40843dd575ceaab46a57f134c2478b6 | dac3f455f3a57fecfa5a047439126556858c239e73cd8feec2dc13bae2c a10ce475f64f3821ab32c88f6b013effd40843dd575ceaab46a57f134c2478b6 d9b5199f36fc416d8a87d798926e0d9dcbb2fe97610cf08d6887dae1355 |
| sha256 | a93d999dc0515066c5c2a261f1be47233b358889d0594c14409309818d86347d | 43b0d453ace3b19779c88da19c9a386dd3e9d2322c85a4cdcf84a22c663 a93d999dc0515066c5c2a261f1be47233b358889d0594c14409309818d86347d September Campaign 31926da5ca004a11c1f46947edb220afe3a53f81 |
| sha256 | a987d1e113b858d21596bb2dfffe79721d5149bfa782e693aafc0cf47aa8c6dc | 7fcc12f2d8a7d42f12d27e7dccb4f3e11492a7d3a3a1ce830a11b539d28 a987d1e113b858d21596bb2dfffe79721d5149bfa782e693aafc0cf47aa8c6dc afca95eb143e0180f1594517a44b2d226a2e44de5cbd2cd49b8c6cdb2a0 |
| sha256 | ab3d61a76197003822252124e89987d061d6a4a33b9891cea778d3708cd50447 | 740ed15e8da8604cc1f0ea715c8641674de66e553c461b3ae782a5d0cbe ab3d61a76197003822252124e89987d061d6a4a33b9891cea778d3708cd50447 6f654198e8efd5aff1c7a903353967d0e96aeff0402cb0a79fabbc10d18 |
| sha256 | afca95eb143e0180f1594517a44b2d226a2e44de5cbd2cd49b8c6cdb2a0b61ee | 1e113b858d21596bb2dfffe79721d5149bfa782e693aafc0cf47aa8c6dc afca95eb143e0180f1594517a44b2d226a2e44de5cbd2cd49b8c6cdb2a0b61ee b651f9320f07d7eade9af523297b4bcfd0e0af187272e368e889c988a55 |
| sha256 | b2e4ee94783062658ddf2c41e9acafb401d0f93e3848c027383a5ca19289b786 | 8ed741ab39b0914f7e95bf13b2f0ae9f3c1227dcffdea3369e03e8bb792 b2e4ee94783062658ddf2c41e9acafb401d0f93e3848c027383a5ca19289b786 dd91943b0d453ace3b19779c88da19c9a386dd3e9d2322c85a4cdcf84a2 |
| sha256 | b3a17934f6f72941b9a60097ab09228d873a2f8737ee0ea93b08e5f1cc3916d1 | 171c0748cc9e3398b1ce8135b125f54f46752768c981c45d3390e8359a1 b3a17934f6f72941b9a60097ab09228d873a2f8737ee0ea93b08e5f1cc3916d1 916e00391279b014e53d73c2216a84bd528e18f1f633ba0101288aa963f |
| sha256 | b4f23a88de9b566ce980a8188674319039d2fbe13b049859f8fe4821c92f9200 | fc439cb9c5c850690134b0d51f262021c0d04d9934df464980c346c1dc5 b4f23a88de9b566ce980a8188674319039d2fbe13b049859f8fe4821c92f9200 3f3fb70e16d65f5f4b21777b87c9aae6072022c3dfbefd177f37c8aef4a |
| sha256 | b651f9320f07d7eade9af523297b4bcfd0e0af187272e368e889c988a55ed78e | 5eb143e0180f1594517a44b2d226a2e44de5cbd2cd49b8c6cdb2a0b61ee b651f9320f07d7eade9af523297b4bcfd0e0af187272e368e889c988a55ed78e 6229041985c466c131e48b9ba0d1bb80bdb7556c941ee84aa461fe2efbf |
| sha256 | c288c200cf7bbebe7a81fd42ca1bd4c6cb6080f28f2cec297a0d3e6aff7876fe | 198e8efd5aff1c7a903353967d0e96aeff0402cb0a79fabbc10d18c63d2 c288c200cf7bbebe7a81fd42ca1bd4c6cb6080f28f2cec297a0d3e6aff7876fe Additional Resources New Mirai Variant Targeting Network Se |
| sha256 | c32f8df3cb019e83e0ac49ab0462c59ec70733c3d516ade011727408751c9d42 | e91aa6bd52ef79d744daba4238a5a48a79eb91cb1a727da3e97d5b36329 c32f8df3cb019e83e0ac49ab0462c59ec70733c3d516ade011727408751c9d42 f295904d966889afb0f6b3625e504a1420a978434e2b6a9e9b85b688a44 |
| sha256 | c5be50880e2b5a8a8d43a5f1fd6f5d36fc665ab9b4031a9b6a4d52222004c2c1 | 79d9e93d1ff30ce5ec0f64ff15b1db7d8237160c83efed688d800e5ef12 c5be50880e2b5a8a8d43a5f1fd6f5d36fc665ab9b4031a9b6a4d52222004c2c1 9b7f36cabbb90dfe9cd75f12c01fb64766dd1ec0f4247dbf8f4477dd644 |
| sha256 | d00fbfc439cb9c5c850690134b0d51f262021c0d04d9934df464980c346c1dc5 | 9265b53e1959df49dbc8727ad344abc12a8bc0bd8d8b76f8b150525dca6 d00fbfc439cb9c5c850690134b0d51f262021c0d04d9934df464980c346c1dc5 b4f23a88de9b566ce980a8188674319039d2fbe13b049859f8fe4821c92 |
| sha256 | d9b5199f36fc416d8a87d798926e0d9dcbb2fe97610cf08d6887dae1355e9439 | 475f64f3821ab32c88f6b013effd40843dd575ceaab46a57f134c2478b6 d9b5199f36fc416d8a87d798926e0d9dcbb2fe97610cf08d6887dae1355e9439 feda096ed8ddf4206365d326b3b7cb2d57ca1e89999b0b1da80fb9658df |
| sha256 | dd91943b0d453ace3b19779c88da19c9a386dd3e9d2322c85a4cdcf84a22c663 | e94783062658ddf2c41e9acafb401d0f93e3848c027383a5ca19289b786 dd91943b0d453ace3b19779c88da19c9a386dd3e9d2322c85a4cdcf84a22c663 a93d999dc0515066c5c2a261f1be47233b358889d0594c14409309818d8 |
| sha256 | eaa387fcc12f2d8a7d42f12d27e7dccb4f3e11492a7d3a3a1ce830a11b539d28 | 4736817dabe88e3014c6207ba702f644fb43f6feaec23091af0b5224bc6 eaa387fcc12f2d8a7d42f12d27e7dccb4f3e11492a7d3a3a1ce830a11b539d28 a987d1e113b858d21596bb2dfffe79721d5149bfa782e693aafc0cf47aa |
| sha256 | eed4690f6e4d92b511fcde9a712b1a8405c5333e0ad78a4c676a64b22412e149 | da5ca004a11c1f46947edb220afe3a53f81cf245b3afae7ea1abaec7c38 eed4690f6e4d92b511fcde9a712b1a8405c5333e0ad78a4c676a64b22412e149 210f3f1ffd2ec66a5076a7fea5d83caa8bbcdb0f3bc3bd030c77eded6f4 |
| sha256 | f295904d966889afb0f6b3625e504a1420a978434e2b6a9e9b85b688a44593fa | df3cb019e83e0ac49ab0462c59ec70733c3d516ade011727408751c9d42 f295904d966889afb0f6b3625e504a1420a978434e2b6a9e9b85b688a44593fa V3G4 Sample July Campaign 7bc99c87a1e0582b5f15f40141226862f |
| sha256 | feda096ed8ddf4206365d326b3b7cb2d57ca1e89999b0b1da80fb9658dff6e44 | 99f36fc416d8a87d798926e0d9dcbb2fe97610cf08d6887dae1355e9439 feda096ed8ddf4206365d326b3b7cb2d57ca1e89999b0b1da80fb9658dff6e44 December Campaign: 63ACD589A53BDEC49C624F3CB2FC8319218DF721 |
From the original article
9 min read at unit42.paloaltonetworks.com
We are providing a content warning because the following contains usage of a racial slur by a threat actor, which is not condoned in any instance by Unit 42. Unit 42 has partially redacted the racial slur to provide researchers with the ability to identify it and check IoCs as needed.
By Chao Lei, Zhibin Zhang, Aveek Das, Cecilia Hu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.