Malwarehigh
Unit 42 Finds New Mirai and Gafgyt IoT/Linux Botnet Campaigns
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-8361 | Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE | — | 100% | KEV | — KEV |
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
CVE-2018-10562+1 related CVE | Unauthenticated RCE in Dasan GPON Routers (CVE-2018-10562) | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gpon.party | e in samples The encrypted strings also reference a website gpon[.]party that was down at the time of this writing. Figure 3: gpon |
| domain | hakaiboatnet.pw | on exploit. The payload source for this campaign was hxxp://hakaiboatnet[.]pw/m and the C2 server was 178[.]128.185.250. Samples make u |
| ipv4 | 142.129.169.83 | All exploits in Table 1 Mirai hxxp://46[.]243.189.101/gang/ 142[.]129.169.83:5888 0xDEACFBEF Yes 3: Hakai All exploits in Table 1, exc |
| ipv4 | 178.128.185.250 | amples above, however they source their payload from hxxp://178[.]128.185.250/e. Figure 7: Exploit targeting D-Link DSL-2750B devices u |
| ipv4 | 213.183.53.120 | attempts via certain ports The campaign makes use of the IP 213[.]183.53.120 both for serving payloads, and as a Command and Control ( |
| ipv4 | 46.243.189.101 | Figure 4: Screenshot from open directory at payload server 46[.]243.189.101 The payload source in this attack was located at hxxp://4 |
| sha256 | 000b018848e7fd947e87f1d3b8432faccb3418e0029bde7db8abf82c552bbc63 | tion and PANDB. Indicators of Compromise Campaign 1 samples 000b018848e7fd947e87f1d3b8432faccb3418e0029bde7db8abf82c552bbc63 37e3a07a17a82175c60992f18eaf169e4014915eb90fac5b4704060572c |
| sha256 | 320ed65d955bdde8fb17a35024f7bd978d26c041de1ddcf8a592974f77d82401 | w DDoS methods, extracted from the following sample. SHA256 320ed65d955bdde8fb17a35024f7bd978d26c041de1ddcf8a592974f77d82401 attack_method_tcpxmas: involves sending TCP packets with al |
| sha256 | 37e3a07a17a82175c60992f18eaf169e4014915eb90fac5b4704060572cfa60b | 18848e7fd947e87f1d3b8432faccb3418e0029bde7db8abf82c552bbc63 37e3a07a17a82175c60992f18eaf169e4014915eb90fac5b4704060572cfa60b 3908cc1d8001f926031fbe55ce104448dbc20c9795b7c3cfbd9abe7b789 |
| sha256 | 3908cc1d8001f926031fbe55ce104448dbc20c9795b7c3cfbd9abe7b789f899d | n Table 1. I used the sample below for this analysis SHA256 3908cc1d8001f926031fbe55ce104448dbc20c9795b7c3cfbd9abe7b789f899d VULNERABILITY AFFECTED DEVICES EXPLOIT FORMAT CVE-2018-1056 |
| sha256 | 3b3a66c2c27f5821d5304e22a2a34b044027ffaac327df5263674b4aa25bc901 | c1d8001f926031fbe55ce104448dbc20c9795b7c3cfbd9abe7b789f899d 3b3a66c2c27f5821d5304e22a2a34b044027ffaac327df5263674b4aa25bc901 4c07af1041e0d83437d4b14226204652574b428cd1dbd4bfc7047c13dff |
| sha256 | 4c07af1041e0d83437d4b14226204652574b428cd1dbd4bfc7047c13dffc4700 | 6c2c27f5821d5304e22a2a34b044027ffaac327df5263674b4aa25bc901 4c07af1041e0d83437d4b14226204652574b428cd1dbd4bfc7047c13dffc4700 Campaign 1 related URLs/IPs 213[.]183.53.120 Okane Multi-ex |
| sha256 | be1d722af56ba8a660218a8311c0482c5b2d096ba91485e7d9dfc12a2b8e00b3 | is analysis I used a sample with the following hash. SHA256 be1d722af56ba8a660218a8311c0482c5b2d096ba91485e7d9dfc12a2b8e00b3 attack_method_udpgame : UDP DDoS using SOCK_RAW from a rand |
| url | http://178.128.185.250/e | s the samples above, however they source their payload from hxxp://178[.]128.185.250/e. Figure 7: Exploit targeting D-Link DSL-2750B devices use |
| url | http://213.183.53.120 | entials? 1: Evolution of OMNI All exploits in Table 1 Mirai hxxp://213[.]183.53.120 213[.]183.53.120 Two different keys used – 0xBAADF00D, 0x |
| url | http://46.243.189.101/gang/ | 43.189.101 The payload source in this attack was located at hxxp://46[.]243.189.101/gang/. The downloaded payload is a shell script that attempts t |
| url | http://hakaiboatnet.pw/m | Execution exploit. The payload source for this campaign was hxxp://hakaiboatnet[.]pw/m and the C2 server was 178[.]128.185.250. Samples make use |
From the original article
9 min read at unit42.paloaltonetworks.com
The end of May 2018 has marked the emergence of three malware campaigns built on publicly available source code for the Mirai and Gafgyt malware families that incorporate multiple known exploits affecting Internet of Things (IoT) devices.
By Ruchna Nigam · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.