Rewterz Threat Alert – Mirai Botnet aka Katana – Active IOCs

Severity

High

Analysis Summary

The Mirai botnet is a type of malware that infects Internet of Things (IoT) devices, such as routers, security cameras, and other smart devices, in order to launch distributed denial-of-service (DDoS) attacks. The botnet was first discovered in August 2016 and quickly gained notoriety for its ability to launch some of the largest DDoS attacks ever recorded, including an attack that took down the DNS provider Dyn.

Mirai works by scanning the internet for devices that use default or easily guessable passwords, such as “admin” or “password”. Once a vulnerable device is identified, the malware infects it and adds it to the botnet, which can then be used to launch DDoS attacks on a target.

Mirai is particularly effective because it is able to exploit the large number of poorly secured IoT devices that are connected to the internet. This makes it difficult to defend against, as many of these devices have limited processing power and memory, and may not receive regular security updates.

Since its discovery, Mirai has continued to evolve and new variants of the malware have been detected. The best defense against Mirai is to ensure that IoT devices are properly secured, with strong passwords and regular security updates. Network administrators can also use tools to monitor for unusual traffic patterns that may indicate a DDoS attack is underway.

Impact

• Server Outage
• Data Loss
• Website Downtime

Indicators of Compromise

Domain Name

• www.tobimar.ro

MD5

• 4b791629962122ef3be9957e17211913
• c3e6907a643bd0a45737377e57de88ce
• 807fe910614ff9f239724847d2df22a2
• d8da675da554880dd349a225e8838734
• c138ab068532b26b79b63de49a678d50
• 5f4090f5f6523f81d473f19e22a91bcc

SHA-256

• 3625e739d139f477dc05e2c99d4a7e1316eea91b207303418a5855d446bfbdab
• b1c9d3924206559c4ba5040df635aa72e923431b74e58a60e3a854b3aa4de071
• af8a29cc3f00e47a025e91316dbec12aeb9067a38a356f6dcc40f31dc6f51c77
• 6e34aef20f0168eb94d71d9785a8526f39ebec67f794149c7fab260f808f2a51
• 46ff4eb57bdf2a87833fd849f5b7ab109e15d3ce228be889d600e702650ba5b2
• 30e687b366bec3948f02197b70be7280795372c4c533c0a6f7809b9b982511a1

SHA-1

• 38da206552ffb6ef246258771f93debe2bf10b27
• fa21555af517fe2021ec490ea54bfb5e7ca6622f
• 3411d4dfc6681f205be867dfe9859105641dac94
• a1bb32cd689c1853cf6cca3070823316ac996629
• 5badf06b4209eafa6d4de1df3b8209c70bdfd093
• cbf7741abf36cfdc46a4ebd00d95fe44bf4eb2d1

Remediation

• Exercise caution when receiving messages from unknown senders.
• Block all threat indicators at your respective controls.
• Keep your software updated to the latest patches.
• Search for IOCs in your environment.