Mirai Variant MooBot Targeting D
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 observed the MooBot Mirai variant exploiting four D-Link vulnerabilities to compromise unpatched routers for use in DDoS attacks.
Unit 42 captured attacks exploiting four D-Link remote code execution vulnerabilities: CVE-2015-2051, CVE-2018-6530, CVE-2022-26258, and CVE-2022-28958, with three rated critical at CVSS 9.8. The exploits download the MooBot malware, a Mirai botnet variant, from infrastructure at 159.203.15.179 via wget. Compromised devices fall under full attacker control and can be used for distributed denial-of-service attacks. D-Link has published bulletins for all four flaws, but unpatched devices remain exposed.
Key facts
- Four D-Link vulnerabilities exploited; three rated CVSS 9.8 critical.
- MooBot identified as a Mirai variant by the string w5q6he3dbrsgmclkiu4to18npavj702f.
- Malware spawns randomly named processes and deletes its own executable.
- Compromised devices can be used for DDoS attacks; patching strongly recommended.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1105 Ingress Tool TransferT1498 Network Denial of Service
- Vendors
- D-Link
- Products
- D-Link routers
- Organizations
- Palo Alto NetworksUnit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2051 | Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router | — | 97% | KEV | — KEV |
| CVE-2018-6530 | Unauthenticated OS Command Injection in D-Link DIR-860L/865L/868L/880L Routers | 9.8 | 97% | KEVRansomwarePoC | KEV |
| CVE-2022-26258 | Unauthenticated Remote Command Execution in D-Link DIR-820L Router | 9.8 | 92% | KEVPoC ×2 | KEV |
| CVE-2022-28958 | Rejected reason: DO NOT USE THIS CVE RECORD | — | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | komaru.today | iguration decode function. After decoding its C2 server vpn.komaru[.]today from configuration, MooBot will send out a message to inf |
| domain | wget.sh | ompromised system and renames the binary files to Realtek . wget[.]sh 46BB6E2F80B6CB96FF7D0F78B3BDBC496B69EB7F22CE15EFCAA275F07 |
| ipv4 | 159.203.15.179 | e code execution and download a MooBot downloader from host 159.203.15[.]179 . 1. CVE-2015-2051: D-Link HNAP SOAPAction Header Command |
| sha256 | 06fc99956bd2afceebbcd157c71908f8ce9ddc81a830cbe86a2a3f4ff79da5f4 | A226EE541D7A0027C31FF05578E2 MooBot executable file. mipsel 06FC99956BD2AFCEEBBCD157C71908F8CE9DDC81A830CBE86A2A3F4FF79DA5F4 MooBot executable file. sh4 4BFF052C7FBF3F7AD025D7DBAB8BD98 |
| sha256 | 188bce5483a9bdc618e0ee9f3c961ff5356009572738ab703057857e8477a36b | 103F74397C46A21697B7D9C0448BE6 MooBot executable file. i686 188BCE5483A9BDC618E0EE9F3C961FF5356009572738AB703057857E8477A36B MooBot executable file. mips 4567979788B37FBED6EEDA02B3C15F |
| sha256 | 36dcaf547c212b6228ca5a45a3f3a778271fbaf8e198ede305d801bc98893d5a | mised system, and renames the binary files to Android . arc 36DCAF547C212B6228CA5A45A3F3A778271FBAF8E198EDE305D801BC98893D5A MooBot executable file. arm 88B858B1411992509B0F2997877402D |
| sha256 | 3b12aba8c92a15ef2a917f7c03a5216342e7d2626b025523c62308fc799b0737 | 3F7AD025D7DBAB8BD985B6CAC79381EB3F8616BEF98FCB01D871 x86_64 3B12ABA8C92A15EF2A917F7C03A5216342E7D2626B025523C62308FC799B0737 Table 4. MooBot samples. Additional Resources New Mirai Var |
| sha256 | 4567979788b37fbed6eeda02b3c15fafe3e0a226ee541d7a0027c31ff05578e2 | 6009572738AB703057857E8477A36B MooBot executable file. mips 4567979788B37FBED6EEDA02B3C15FAFE3E0A226EE541D7A0027C31FF05578E2 MooBot executable file. mipsel 06FC99956BD2AFCEEBBCD157C719 |
| sha256 | 46bb6e2f80b6cb96ff7d0f78b3bdbc496b69eb7f22ce15efcaa275f07cfae075 | system and renames the binary files to Realtek . wget[.]sh 46BB6E2F80B6CB96FF7D0F78B3BDBC496B69EB7F22CE15EFCAA275F07CFAE075 The script downloader. It downloads MooBot onto the comprom |
| sha256 | 4bff052c7fbf3f7ad025d7dbab8bd985b6cac79381eb3f8616bef98fcb01d871 | E9DDC81A830CBE86A2A3F4FF79DA5F4 MooBot executable file. sh4 4BFF052C7FBF3F7AD025D7DBAB8BD985B6CAC79381EB3F8616BEF98FCB01D871 MooBot executable file. x86_64 4BFF052C7FBF3F7AD025D7DBAB8B |
| sha256 | 7123b2de979d85615c35fca99fa40e0b5fbca25f2c7654b083808653c9e4d616 | 82902E538C2F7146C8666192893258 MooBot executable file. arm7 7123B2DE979D85615C35FCA99FA40E0B5FBCA25F2C7654B083808653C9E4D616 MooBot executable file. i586 CC3E92C52BBCF56CCFFB6F6E2942A6 |
| sha256 | 72153e51ea461452263dbb8f658bddc8fb82902e538c2f7146c8666192893258 | 49D3014776C1FB527C3B2E3086EBAB MooBot executable file. arm6 72153E51EA461452263DBB8F658BDDC8FB82902E538C2F7146C8666192893258 MooBot executable file. arm7 7123B2DE979D85615C35FCA99FA40E |
| sha256 | 88b858b1411992509b0f2997877402d8bd9e378e4e21efe024d61e25b29daa08 | 71FBAF8E198EDE305D801BC98893D5A MooBot executable file. arm 88B858B1411992509B0F2997877402D8BD9E378E4E21EFE024D61E25B29DAA08 MooBot executable file. arm5 D7564C7E6F606EC3A04BE3AC63FDEF |
| sha256 | b7ee57a42c6a4545ac6d6c29e1075fa1628e1d09b8c1572c848a70112d4c90a1 | own in the following table: File Name SHA256 Description rt B7EE57A42C6A4545AC6D6C29E1075FA1628E1D09B8C1572C848A70112D4C90A1 A script downloader. It downloads MooBot onto the compromis |
| sha256 | cc3e92c52bbcf56ccffb6f6e2942a676b3103f74397c46a21697b7d9c0448be6 | BCA25F2C7654B083808653C9E4D616 MooBot executable file. i586 CC3E92C52BBCF56CCFFB6F6E2942A676B3103F74397C46A21697B7D9C0448BE6 MooBot executable file. i686 188BCE5483A9BDC618E0EE9F3C961F |
| sha256 | d7564c7e6f606ec3a04be3ac63fdef2fde49d3014776c1fb527c3b2e3086ebab | 9E378E4E21EFE024D61E25B29DAA08 MooBot executable file. arm5 D7564C7E6F606EC3A04BE3AC63FDEF2FDE49D3014776C1FB527C3B2E3086EBAB MooBot executable file. arm6 72153E51EA461452263DBB8F658BDD |
From the original article
5 min read at unit42.paloaltonetworks.com
In early August, Unit 42 researchers discovered attacks leveraging several vulnerabilities in devices made by D-Link, a company that specializes in network and connectivity products. The vulnerabilities exploited include: CVE-2015-2051 : D-Link HNAP SOAPAction Header Command Execution Vulnerability CVE-2018-6530 : D-Link SOAP Interface Remote Code Execution Vulnerability
By Chao Lei, Zhibin Zhang, Aveek Das, Cecilia Hu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.