Severity
Medium
Analysis Summary
A new variant of Mirai exploiting a large number of vulnerabilities. This variant leveraged 13 different vulnerabilities targeting routers, surveillance products, and other IoT devices. Though all of these vulnerabilities have been seen in various Mirai variants, this is the first variant containing exploits for all 13. Once exploited, a victim device connects to both its C2 and a few downloader/dropper URLs. It then spreads to other devices on the network by scanning for and exploiting detected vulnerabilities or performing brute force attacks.
Indicators of Compromise
URLs
- http[:]//32[.]235[.]102[.]123
- http[:]//ililililililililil[.]hopto[.]org/love[.]sh
- http[:]//ililililililililil[.]hopto[.]org/shiina/tmp[.]arm7
- http[:]//ililililililililil[.]hopto[.]org/shiina/tmp[.]mips
Malware Hash (MD5/SHA1/SH256)
- c15382bc81e1bff4cf03d769275b7c4d2d586a21e81ad4138464d808e3bb464c
Remediation
- Block all threat indicators at your respective controls.