Early Warning: A New Mirai Variant is Spreading Quickly on Port 23 and 2323
<!--kg-card-begin: markdown--><p>[Updates on 2017-11-28]</p>
<ul>
<li>Both C2s have been sink-holed now by security community.</li>
<li>admin/CentryL1nk is a typo for admin/CenturyL1nk.</li>
</ul>
<p>About 60 hours ago, since 2017-11-22 11:00, we noticed big upticks on port 2323 and 23 scan traffic, with almost 100k unique scanner IP came from Argentina. After investigation, we are quite confident to tell this is a <strong>new mirai variant</strong>.</p>
<h4 id="rootcauseanalysis">Root Cause Analysis</h4>
<p>In our honeypot traffic, two new credentials <strong>admin/CentryL1nk</strong> and <strong>admin/QwestM0dem</strong> are now actively being used. Note the credential admin/CentryL1nk was first appeared in an exploit about ZyXEL PK5001Z modem in  <a href="https://www.exploit-db.com/exploits/43105/">exploit-db </a> less than a month ago.</p>
<p>The abuse of these two credentials began at around 2017-11-22 11:00, and reached its peak during 2017-11-23 daytime. This is a good time span match with this 2323/23 port scanning on <a href="http://scan.netlab.360.com/#/dashboard?tsbeg=1510934400000&amp;tsend=1511539200000&amp;dstport=2323&amp;toplistname=srcas&amp;topn=30"><strong>Scanmon</strong></a>.</p>
<p>Quite a lot of IP abusing these two credential also appear in ScanMon radar.</p>
<ul>
<li>admin/CentryL1nk : 748 (66.5%) out of 1125</li>
<li>admin/QwestM0dem : 1175 (69.4%) out of 1694</li>
</ul>
<p>The <strong>IP overlap</strong> together with the <strong>time span match</strong>, make us believe this is the root cause.</p>
<p><img src="__GHOST_URL__/content/images/2017/11/1_time_curve_of_two_new_credential_in_honeypot.png" alt="" loading="lazy"><br>
Figure-1 two new credentials being actively abused</p>
<p><img src="__GHOST_URL__/content/images/2017/11/2_time_curve_of_port_2323_scanning-1.png" alt="" loading="lazy"><br>
Figure-2 scanning uptick on port 2323</p>
<h4 id="malwaresampleandc2">Malware Sample and C2</h4>
<p>The corresponding malware samples are:</p>
<ul>
<li>0ee0fc76a8d8ad37374f4ac3553d8937</li>
<li>018a9569f559bfafbc433dc81caf3ec0</li>
<li>be6165a3e131cc92d3f7d51284cf70bb</li>
</ul>
<p>The C2 represents in the samples is:</p>
<ul>
<li>bigboatreps.pw:23</li>
<li>blacklister.nl:23</li>
</ul>
<h4 id="mostinfectioninargentinatillnow">Most Infection in Argentina till Now</h4>
<p>We noticed that most of the scanner IP came from Argentina: about 65.7k unique scanners from Argentina in less than a single day, almost 100k in last 60 hours.</p>
<p><img src="__GHOST_URL__/content/images/2017/11/3_most_scanner_come_from_telefonica_de_argentina-2.png" alt="" loading="lazy"><br>
Figure-3 most of the scanner IP came from Argentina</p>
<p>This make us wondering it is an attack focus on several specific types of IoT device, and these devices are widely deployed in Argentina, just as what happened in last year <a href="__GHOST_URL__/a-mirai-botnet-evolvement-new-variant-and-old-c2/">Telekom event</a>.</p>
<h4 id="ioc">IoC</h4>
<h6 id="c2">C2</h6>
<p>bigboatreps.pw:23<br>
blacklister.nl:23</p>
<h6 id="samplemd5anddownloadurllist">Sample md5 and download URL list</h6>
<p><a href="http://80.211.173.20:80/amnyu.arm">http://80.211.173.20:80/amnyu.arm</a>	0255c6d7b88947c7bc82c9b06169e69d<br>
<a href="http://80.211.173.20:80/amnyu.arm">http://80.211.173.20:80/amnyu.arm</a>	3e72bbab07516010ab537d7236c48a2c<br>
<a href="http://80.211.173.20:80/amnyu.arm">http://80.211.173.20:80/amnyu.arm</a>	6c5cadcc9dbcac55b42d1347f4b51df1<br>
<a href="http://80.211.173.20:80/amnyu.arm7">http://80.211.173.20:80/amnyu.arm7</a>	2e5ec99ef2cf8878dc588edd8031b249<br>
<a href="http://80.211.173.20:80/amnyu.arm7">http://80.211.173.20:80/amnyu.arm7</a>	359527251c09f4ec8b0ad65ab202f1bb<br>
<a href="http://80.211.173.20:80/amnyu.arm7">http://80.211.173.20:80/amnyu.arm7</a>	4c21d1f6acfb0155eb877418bb15001d<br>
<a href="http://80.211.173.20:80/amnyu.arm7">http://80.211.173.20:80/amnyu.arm7</a>	5cd69f7c5cd6aef4f4b8e08181028314<br>
<a href="http://80.211.173.20:80/amnyu.arm7">http://80.211.173.20:80/amnyu.arm7</a>	794f01740878252e8df257b0511c65df<br>
<a href="http://80.211.173.20:80/amnyu.arm7">http://80.211.173.20:80/amnyu.arm7</a>	b0791270cc6b180ff798440f416f6271<br>
<a href="http://80.211.173.20:80/amnyu.arm7">http://80.211.173.20:80/amnyu.arm7</a>	eee4ff0e2c9482acea3251c9c2ce6daf<br>
<a href="http://80.211.173.20:80/amnyu.arm">http://80.211.173.20:80/amnyu.arm</a>	a6f11eba76debd49ee248b6539c4d83c<br>
<a href="http://80.211.173.20:80/amnyu.arm">http://80.211.173.20:80/amnyu.arm</a>	ccc8761335b2d829dff739aece435eac<br>
<a href="http://80.211.173.20:80/amnyu.arm">http://80.211.173.20:80/amnyu.arm</a>	dd10fb3ed22a05e27bca3008c0558001<br>
<a href="http://80.211.173.20:80/amnyu.arm">http://80.211.173.20:80/amnyu.arm</a>	e090660bbc7c673bf81680648718e39e<br>
<a href="http://80.211.173.20:80/amnyu.m68k">http://80.211.173.20:80/amnyu.m68k</a>	1782f07f02d746c13ede8388329921e4<br>
<a href="http://80.211.173.20:80/amnyu.m68k">http://80.211.173.20:80/amnyu.m68k</a>	4ccd3036cadcbe2a0c4b28ce4ad77b7b<br>
<a href="http://80.211.173.20:80/amnyu.m68k">http://80.211.173.20:80/amnyu.m68k</a>	84d737bc5a1821c2f21489695c2c3a71<br>
<a href="http://80.211.173.20:80/amnyu.m68k">http://80.211.173.20:80/amnyu.m68k</a>	8f347206f06b05ea8d2e8ea03f4f92d4<br>
<a href="http://80.211.173.20:80/amnyu.m68k">http://80.211.173.20:80/amnyu.m68k</a>	94353157ddcd3cb40a75a5ecc1044115<br>
<a href="http://80.211.173.20:80/amnyu.m68k">http://80.211.173.20:80/amnyu.m68k</a>	b1c66e2a2ed68087df706262b12ca059<br>
<a href="http://80.211.173.20:80/amnyu.m68k">http://80.211.173.20:80/amnyu.m68k</a>	b8aedf6ee75e4d6b6beeafc51b809732<br>
<a href="http://80.211.173.20:80/amnyu.mips">http://80.211.173.20:80/amnyu.mips</a>	0ee0fc76a8d8ad37374f4ac3553d8937<br>
<a href="http://80.211.173.20:80/amnyu.mips">http://80.211.173.20:80/amnyu.mips</a>	2aa0c53d7d405fa6ffb7ccb895fb895f<br>
<a href="http://80.211.173.20:80/amnyu.mips">http://80.211.173.20:80/amnyu.mips</a>	56b74e34ddf0111700a89592b5a8b010<br>
<a href="http://80.211.173.20:80/amnyu.mips">http://80.211.173.20:80/amnyu.mips</a>	62fa57f007a32f857a7e1d9fb5e064eb<br>
<a href="http://80.211.173.20:80/amnyu.mips">http://80.211.173.20:80/amnyu.mips</a>	633df071ac6f1d55193fc4c5c8747f2a<br>
<a href="http://80.211.173.20:80/amnyu.mips">http://80.211.173.20:80/amnyu.mips</a>	6eed6b55c5cd893aa584894a07eec32f<br>
<a href="http://80.211.173.20:80/amnyu.mips">http://80.211.173.20:80/amnyu.mips</a>	97c314a2a100ea4987e73e008225d3be<br>
<a href="http://80.211.173.20:80/amnyu.mpsl">http://80.211.173.20:80/amnyu.mpsl</a>	09d98cbaa9794184841450221d410f15<br>
<a href="http://80.211.173.20:80/amnyu.mpsl">http://80.211.173.20:80/amnyu.mpsl</a>	21f1ab847a9b27f8aaabcafd9cf59756<br>
<a href="http://80.211.173.20:80/amnyu.mpsl">http://80.211.173.20:80/amnyu.mpsl</a>	33e1e2803bb70cd0d66911175782c6a1<br>
<a href="http://80.211.173.20:80/amnyu.mpsl">http://80.211.173.20:80/amnyu.mpsl</a>	4e63eccca00b01b66162fa5258d03956<br>
<a href="http://80.211.173.20:80/amnyu.mpsl">http://80.211.173.20:80/amnyu.mpsl</a>	7d2c1f3d81a2df7beea99552d0704c2d<br>
<a href="http://80.211.173.20:80/amnyu.mpsl">http://80.211.173.20:80/amnyu.mpsl</a>	7e0f883f239c922a151aab2500400880<br>
<a href="http://80.211.173.20:80/amnyu.mpsl">http://80.211.173.20:80/amnyu.mpsl</a>	e46cbc10309e970ec267afee496832c9<br>
<a href="http://80.211.173.20:80/amnyu.ppc">http://80.211.173.20:80/amnyu.ppc</a>	3dadafe1cc9639a7d374682dafab954c<br>
<a href="http://80.211.173.20:80/amnyu.ppc">http://80.211.173.20:80/amnyu.ppc</a>	49e4b3e5d7302c2faf08c1ed585a89ca<br>
<a href="http://80.211.173.20:80/amnyu.ppc">http://80.211.173.20:80/amnyu.ppc</a>	80bcea07b752ae4306da5f24f6693bea<br>
<a href="http://80.211.173.20:80/amnyu.ppc">http://80.211.173.20:80/amnyu.ppc</a>	9e4caeada13676ddc5b7be44e03fe396<br>
<a href="http://80.211.173.20:80/amnyu.ppc">http://80.211.173.20:80/amnyu.ppc</a>	a40852f9895d956fe198cb2f2f702ebf<br>
<a href="http://80.211.173.20:80/amnyu.ppc">http://80.211.173.20:80/amnyu.ppc</a>	a8bde89d2fe98268801b58f42214cdca<br>
<a href="http://80.211.173.20:80/amnyu.ppc">http://80.211.173.20:80/amnyu.ppc</a>	e968bf902db104c91d3aaa0bb363f1bd<br>
<a href="http://80.211.173.20:80/amnyu.sh4">http://80.211.173.20:80/amnyu.sh4</a>	141930ed206ef5f076b2a233b390ea65<br>
<a href="http://80.211.173.20:80/amnyu.sh4">http://80.211.173.20:80/amnyu.sh4</a>	1bdaf4cd21fb9cb42d971a25fb183d04<br>
<a href="http://80.211.173.20:80/amnyu.sh4">http://80.211.173.20:80/amnyu.sh4</a>	25d3ddb85bf392c273dd93922199628c<br>
<a href="http://80.211.173.20:80/amnyu.sh4">http://80.211.173.20:80/amnyu.sh4</a>	39eddba755333e22841b2627a2a19e59<br>
<a href="http://80.211.173.20:80/amnyu.sh4">http://80.211.173.20:80/amnyu.sh4</a>	485f2b2a684865ead274bba6931c95c9<br>
<a href="http://80.211.173.20:80/amnyu.sh4">http://80.211.173.20:80/amnyu.sh4</a>	56afda94860e8d1ca8a7b9960769020d<br>
<a href="http://80.211.173.20:80/amnyu.sh4">http://80.211.173.20:80/amnyu.sh4</a>	9dc0c166e30922d1ea8da06ba46996dc<br>
<a href="http://80.211.173.20:80/amnyu.spc">http://80.211.173.20:80/amnyu.spc</a>	3f0322c0b7379e492a17d3cb4fa2c82e<br>
<a href="http://80.211.173.20:80/amnyu.spc">http://80.211.173.20:80/amnyu.spc</a>	53c60f58ce576071c71ede7df656e823<br>
<a href="http://80.211.173.20:80/amnyu.spc">http://80.211.173.20:80/amnyu.spc</a>	5db44876c3acc0b589c8d696c41b6413<br>
<a href="http://80.211.173.20:80/amnyu.spc">http://80.211.173.20:80/amnyu.spc</a>	651b186b04583f0067d4cc2d95565a95<br>
<a href="http://80.211.173.20:80/amnyu.spc">http://80.211.173.20:80/amnyu.spc</a>	a18b4a6250f51c1f350b37e1187292fb<br>
<a href="http://80.211.173.20:80/amnyu.spc">http://80.211.173.20:80/amnyu.spc</a>	c5e1a57671dab607b8fa7363ab6582ab<br>
<a href="http://80.211.173.20:80/amnyu.spc">http://80.211.173.20:80/amnyu.spc</a>	e6cd9197d443fb9fa79ab103232e2b67<br>
<a href="http://80.211.173.20:80/amnyu.x86">http://80.211.173.20:80/amnyu.x86</a>	018a9569f559bfafbc433dc81caf3ec0<br>
<a href="http://80.211.173.20:80/amnyu.x86">http://80.211.173.20:80/amnyu.x86</a>	1663952daca0c49326fb8fa5585d8eec<br>
<a href="http://80.211.173.20:80/amnyu.x86">http://80.211.173.20:80/amnyu.x86</a>	243d2c8ba1c30fa81043a82eaa7756e7<br>
<a href="http://80.211.173.20:80/amnyu.x86">http://80.211.173.20:80/amnyu.x86</a>	4b375509896e111ef4c3eb003d38077f<br>
<a href="http://80.211.173.20:80/amnyu.x86">http://80.211.173.20:80/amnyu.x86</a>	6371b6b1d030ac7d2cb1b0011230f97f<br>
<a href="http://80.211.173.20:80/amnyu.x86">http://80.211.173.20:80/amnyu.x86</a>	64bda230a3b31a115a29e0afd8df5d8a<br>
<a href="http://80.211.173.20:80/amnyu.x86">http://80.211.173.20:80/amnyu.x86</a>	ed825b8aadee560e5c70ffaa5b441438<br>
<a href="http://80.211.173.20/amnyu.arm7">http://80.211.173.20/amnyu.arm7</a>	b0791270cc6b180ff798440f416f6271<br>
<a href="http://80.211.173.20/amnyu.arm">http://80.211.173.20/amnyu.arm</a>	e090660bbc7c673bf81680648718e39e<br>
<a href="http://80.211.173.20/amnyu.m68k">http://80.211.173.20/amnyu.m68k</a>	4ccd3036cadcbe2a0c4b28ce4ad77b7b<br>
<a href="http://80.211.173.20/amnyu.mips">http://80.211.173.20/amnyu.mips</a>	97c314a2a100ea4987e73e008225d3be<br>
<a href="http://80.211.173.20/amnyu.mpsl">http://80.211.173.20/amnyu.mpsl</a>	7d2c1f3d81a2df7beea99552d0704c2d<br>
<a href="http://80.211.173.20/amnyu.ppc">http://80.211.173.20/amnyu.ppc</a>	e968bf902db104c91d3aaa0bb363f1bd<br>
<a href="http://80.211.173.20/amnyu.sh4">http://80.211.173.20/amnyu.sh4</a>	485f2b2a684865ead274bba6931c95c9<br>
<a href="http://80.211.173.20/amnyu.spc">http://80.211.173.20/amnyu.spc</a>	5db44876c3acc0b589c8d696c41b6413<br>
<a href="http://80.211.173.20/amnyu.x86">http://80.211.173.20/amnyu.x86</a>	4b375509896e111ef4c3eb003d38077f<br>
<a href="http://blacklister.nl/bins/mirai.arm">http://blacklister.nl/bins/mirai.arm</a>	be6165a3e131cc92d3f7d51284cf70bb<br>
<a href="http://blacklister.nl/bins/mirai.arm5n">http://blacklister.nl/bins/mirai.arm5n</a>	c639bc6b50ab0be250147572956a9d6b<br>
<a href="http://blacklister.nl/bins/mirai.arm6">http://blacklister.nl/bins/mirai.arm6</a>	8f9c5099e3749d0199262289c9deaa3d<br>
<a href="http://blacklister.nl/bins/mirai.arm7">http://blacklister.nl/bins/mirai.arm7</a>	e508956188f2cb71605ae0e8fbdf4a64<br>
<a href="http://blacklister.nl/bins/mirai.i486">http://blacklister.nl/bins/mirai.i486</a>	25846ce769f0bd5b204f440127d51f21<br>
<a href="http://blacklister.nl/bins/mirai.i686">http://blacklister.nl/bins/mirai.i686</a>	d3c82dd5d512304efc6a42018f0bf2a7<br>
<a href="http://blacklister.nl/bins/mirai.m68k">http://blacklister.nl/bins/mirai.m68k</a>	3ef657efcfe16ad869a587d30480306f<br>
<a href="http://blacklister.nl/bins/mirai.mips">http://blacklister.nl/bins/mirai.mips</a>	b4af22c2b3b1af68f323528ee0bc6637<br>
<a href="http://blacklister.nl/bins/mirai.mips64">http://blacklister.nl/bins/mirai.mips64</a>	1e1d6b41a13c97ad3754815021dd0891<br>
<a href="http://blacklister.nl/bins/mirai.mpsl">http://blacklister.nl/bins/mirai.mpsl</a>	6adb31781db797712d759f564b9761b6<br>
<a href="http://blacklister.nl/bins/mirai.ppc">http://blacklister.nl/bins/mirai.ppc</a>	7936cc1d021664892c48408ec1c9143c<br>
<a href="http://blacklister.nl/bins/mirai.ppc440fp">http://blacklister.nl/bins/mirai.ppc440fp</a>	fd6235e4e1cf4a0f6c2d609a7b1ffc55<br>
<a href="http://blacklister.nl/bins/mirai.sh4">http://blacklister.nl/bins/mirai.sh4</a>	5c8ef7f23f26e0e48ab527ef83874213<br>
<a href="http://blacklister.nl/bins/mirai.spc">http://blacklister.nl/bins/mirai.spc</a>	7ce73df7fb50beda2f549f9695a23538<br>
<a href="http://blacklister.nl/bins/mirai.x86">http://blacklister.nl/bins/mirai.x86</a>	539e9bf8c81bd3e9ae520fd74218a6b8<br>
<a href="http://blacklister.nl/bins/mirai.x86_64">http://blacklister.nl/bins/mirai.x86_64</a>	d69e501480f03f06e4579fa13e47d04a</p>
<!--kg-card-end: markdown-->
[Updates on 2017-11-28]


 * Both C2s have been sink-holed now by security community.
 * admin/CentryL1nk is a typo for admin/CenturyL1nk.


About 60 hours ago, since 2017-11-22 11:00, we noticed big upticks on port 2323 and 23 scan traffic, with almost 100k unique scanner IP came from Argentina. After investigation, we are quite confident to tell this is a new mirai variant.


Root Cause Analysis


In our honeypot traffic, two new credentials admin/CentryL1nk and admin/QwestM0dem are now actively being used. Note the credential admin/CentryL1nk was first appeared in an exploit about ZyXEL PK5001Z modem in exploit-db less than a month ago.


The abuse of these two credentials began at around 2017-11-22 11:00, and reached its peak during 2017-11-23 daytime. This is a good time span match with this 2323/23 port scanning on Scanmon.


Quite a lot of IP abusing these two credential also appear in ScanMon radar.


 * admin/CentryL1nk : 748 (66.5%) out of 1125
 * admin/QwestM0dem : 1175 (69.4%) out of 1694


The IP overlap together with the time span match, make us believe this is the root cause.




Figure-1 two new credentials being actively abused




Figure-2 scanning uptick on port 2323


Malware Sample and C2


The corresponding malware samples are:


 * 0ee0fc76a8d8ad37374f4ac3553d8937
 * 018a9569f559bfafbc433dc81caf3ec0
 * be6165a3e131cc92d3f7d51284cf70bb


The C2 represents in the samples is:


 * bigboatreps.pw:23
 * blacklister.nl:23


Most Infection in Argentina till Now


We noticed that most of the scanner IP came from Argentina: about 65.7k unique scanners from Argentina in less than a single day, almost 100k in last 60 hours.




Figure-3 most of the scanner IP came from Argentina


This make us wondering it is an attack focus on several specific types of IoT device, and these devices are widely deployed in Argentina, just as what happened in last year Telekom event.


IoC


C2


bigboatreps.pw:23

blacklister.nl:23


Sample md5 and download URL list


http://80.211.173.20:80/amnyu.arm 0255c6d7b88947c7bc82c9b06169e69d

http://80.211.173.20:80/amnyu.arm 3e72bbab07516010ab537d7236c48a2c

http://80.211.173.20:80/amnyu.arm 6c5cadcc9dbcac55b42d1347f4b51df1

http://80.211.173.20:80/amnyu.arm7 2e5ec99ef2cf8878dc588edd8031b249

http://80.211.173.20:80/amnyu.arm7 359527251c09f4ec8b0ad65ab202f1bb

http://80.211.173.20:80/amnyu.arm7 4c21d1f6acfb0155eb877418bb15001d

http://80.211.173.20:80/amnyu.arm7 5cd69f7c5cd6aef4f4b8e08181028314

http://80.211.173.20:80/amnyu.arm7 794f01740878252e8df257b0511c65df

http://80.211.173.20:80/amnyu.arm7 b0791270cc6b180ff798440f416f6271

http://80.211.173.20:80/amnyu.arm7 eee4ff0e2c9482acea3251c9c2ce6daf

http://80.211.173.20:80/amnyu.arm a6f11eba76debd49ee248b6539c4d83c

http://80.211.173.20:80/amnyu.arm ccc8761335b2d829dff739aece435eac

http://80.211.173.20:80/amnyu.arm dd10fb3ed22a05e27bca3008c0558001

http://80.211.173.20:80/amnyu.arm e090660bbc7c673bf81680648718e39e

http://80.211.173.20:80/amnyu.m68k 1782f07f02d746c13ede8388329921e4

http://80.211.173.20:80/amnyu.m68k 4ccd3036cadcbe2a0c4b28ce4ad77b7b

http://80.211.173.20:80/amnyu.m68k 84d737bc5a1821c2f21489695c2c3a71

http://80.211.173.20:80/amnyu.m68k 8f347206f06b05ea8d2e8ea03f4f92d4

http://80.211.173.20:80/amnyu.m68k 94353157ddcd3cb40a75a5ecc1044115

http://80.211.173.20:80/amnyu.m68k b1c66e2a2ed68087df706262b12ca059

http://80.211.173.20:80/amnyu.m68k b8aedf6ee75e4d6b6beeafc51b809732

http://80.211.173.20:80/amnyu.mips 0ee0fc76a8d8ad37374f4ac3553d8937

http://80.211.173.20:80/amnyu.mips 2aa0c53d7d405fa6ffb7ccb895fb895f

http://80.211.173.20:80/amnyu.mips 56b74e34ddf0111700a89592b5a8b010

http://80.211.173.20:80/amnyu.mips 62fa57f007a32f857a7e1d9fb5e064eb

http://80.211.173.20:80/amnyu.mips 633df071ac6f1d55193fc4c5c8747f2a

http://80.211.173.20:80/amnyu.mips 6eed6b55c5cd893aa584894a07eec32f

http://80.211.173.20:80/amnyu.mips 97c314a2a100ea4987e73e008225d3be

http://80.211.173.20:80/amnyu.mpsl 09d98cbaa9794184841450221d410f15

http://80.211.173.20:80/amnyu.mpsl 21f1ab847a9b27f8aaabcafd9cf59756

http://80.211.173.20:80/amnyu.mpsl 33e1e2803bb70cd0d66911175782c6a1

http://80.211.173.20:80/amnyu.mpsl 4e63eccca00b01b66162fa5258d03956

http://80.211.173.20:80/amnyu.mpsl 7d2c1f3d81a2df7beea99552d0704c2d

http://80.211.173.20:80/amnyu.mpsl 7e0f883f239c922a151aab2500400880

http://80.211.173.20:80/amnyu.mpsl e46cbc10309e970ec267afee496832c9

http://80.211.173.20:80/amnyu.ppc 3dadafe1cc9639a7d374682dafab954c

http://80.211.173.20:80/amnyu.ppc 49e4b3e5d7302c2faf08c1ed585a89ca

http://80.211.173.20:80/amnyu.ppc 80bcea07b752ae4306da5f24f6693bea

http://80.211.173.20:80/amnyu.ppc 9e4caeada13676ddc5b7be44e03fe396

http://80.211.173.20:80/amnyu.ppc a40852f9895d956fe198cb2f2f702ebf

http://80.211.173.20:80/amnyu.ppc a8bde89d2fe98268801b58f42214cdca

http://80.211.173.20:80/amnyu.ppc e968bf902db104c91d3aaa0bb363f1bd

http://80.211.173.20:80/amnyu.sh4 141930ed206ef5f076b2a233b390ea65

http://80.211.173.20:80/amnyu.sh4 1bdaf4cd21fb9cb42d971a25fb183d04

http://80.211.173.20:80/amnyu.sh4 25d3ddb85bf392c273dd93922199628c

http://80.211.173.20:80/amnyu.sh4 39eddba755333e22841b2627a2a19e59

http://80.211.173.20:80/amnyu.sh4 485f2b2a684865ead274bba6931c95c9

http://80.211.173.20:80/amnyu.sh4 56afda94860e8d1ca8a7b9960769020d

http://80.211.173.20:80/amnyu.sh4 9dc0c166e30922d1ea8da06ba46996dc

http://80.211.173.20:80/amnyu.spc 3f0322c0b7379e492a17d3cb4fa2c82e

http://80.211.173.20:80/amnyu.spc 53c60f58ce576071c71ede7df656e823

http://80.211.173.20:80/amnyu.spc 5db44876c3acc0b589c8d696c41b6413

http://80.211.173.20:80/amnyu.spc 651b186b04583f0067d4cc2d95565a95

http://80.211.173.20:80/amnyu.spc a18b4a6250f51c1f350b37e1187292fb

http://80.211.173.20:80/amnyu.spc c5e1a57671dab607b8fa7363ab6582ab

http://80.211.173.20:80/amnyu.spc e6cd9197d443fb9fa79ab103232e2b67

http://80.211.173.20:80/amnyu.x86 018a9569f559bfafbc433dc81caf3ec0

http://80.211.173.20:80/amnyu.x86 1663952daca0c49326fb8fa5585d8eec

http://80.211.173.20:80/amnyu.x86 243d2c8ba1c30fa81043a82eaa7756e7

http://80.211.173.20:80/amnyu.x86 4b375509896e111ef4c3eb003d38077f

http://80.211.173.20:80/amnyu.x86 6371b6b1d030ac7d2cb1b0011230f97f

http://80.211.173.20:80/amnyu.x86 64bda230a3b31a115a29e0afd8df5d8a

http://80.211.173.20:80/amnyu.x86 ed825b8aadee560e5c70ffaa5b441438

http://80.211.173.20/amnyu.arm7 b0791270cc6b180ff798440f416f6271

http://80.211.173.20/amnyu.arm e090660bbc7c673bf81680648718e39e

http://80.211.173.20/amnyu.m68k 4ccd3036cadcbe2a0c4b28ce4ad77b7b

http://80.211.173.20/amnyu.mips 97c314a2a100ea4987e73e008225d3be

http://80.211.173.20/amnyu.mpsl 7d2c1f3d81a2df7beea99552d0704c2d

http://80.211.173.20/amnyu.ppc e968bf902db104c91d3aaa0bb363f1bd

http://80.211.173.20/amnyu.sh4 485f2b2a684865ead274bba6931c95c9

http://80.211.173.20/amnyu.spc 5db44876c3acc0b589c8d696c41b6413

http://80.211.173.20/amnyu.x86 4b375509896e111ef4c3eb003d38077f

http://blacklister.nl/bins/mirai.arm be6165a3e131cc92d3f7d51284cf70bb

http://blacklister.nl/bins/mirai.arm5n c639bc6b50ab0be250147572956a9d6b

http://blacklister.nl/bins/mirai.arm6 8f9c5099e3749d0199262289c9deaa3d

http://blacklister.nl/bins/mirai.arm7 e508956188f2cb71605ae0e8fbdf4a64

http://blacklister.nl/bins/mirai.i486 25846ce769f0bd5b204f440127d51f21

http://blacklister.nl/bins/mirai.i686 d3c82dd5d512304efc6a42018f0bf2a7

http://blacklister.nl/bins/mirai.m68k 3ef657efcfe16ad869a587d30480306f

http://blacklister.nl/bins/mirai.mips b4af22c2b3b1af68f323528ee0bc6637

http://blacklister.nl/bins/mirai.mips64 1e1d6b41a13c97ad3754815021dd0891

http://blacklister.nl/bins/mirai.mpsl 6adb31781db797712d759f564b9761b6

http://blacklister.nl/bins/mirai.ppc 7936cc1d021664892c48408ec1c9143c

http://blacklister.nl/bins/mirai.ppc440fp fd6235e4e1cf4a0f6c2d609a7b1ffc55

http://blacklister.nl/bins/mirai.sh4 5c8ef7f23f26e0e48ab527ef83874213

http://blacklister.nl/bins/mirai.spc 7ce73df7fb50beda2f549f9695a23538

http://blacklister.nl/bins/mirai.x86 539e9bf8c81bd3e9ae520fd74218a6b8

http://blacklister.nl/bins/mirai.x86_64 d69e501480f03f06e4579fa13e47d04a

{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"[Updates on 2017-11-28]\n\n* Both C2s have been sink-holed now by security community.\n* admin/CentryL1nk is a typo for admin/CenturyL1nk.\n\n\n\nAbout 60 hours ago, since 2017-11-22 11:00, we noticed big upticks on port 2323 and 23 scan traffic, with almost 100k unique scanner IP came from Argentina. After investigation, we are quite confident to tell this is a **new mirai variant**.\n\n####Root Cause Analysis\nIn our honeypot traffic, two new credentials **admin/CentryL1nk** and **admin/QwestM0dem** are now actively being used. Note the credential admin/CentryL1nk was first appeared in an exploit about ZyXEL PK5001Z modem in  [exploit-db ](https://www.exploit-db.com/exploits/43105/) less than a month ago.\n\nThe abuse of these two credentials began at around 2017-11-22 11:00, and reached its peak during 2017-11-23 daytime. This is a good time span match with this 2323/23 port scanning on [**Scanmon**](http://scan.netlab.360.com/#/dashboard?tsbeg=1510934400000&tsend=1511539200000&dstport=2323&toplistname=srcas&topn=30).\n\nQuite a lot of IP abusing these two credential also appear in ScanMon radar.\n\n * admin/CentryL1nk : 748 (66.5%) out of 1125\n * admin/QwestM0dem : 1175 (69.4%) out of 1694\n\nThe **IP overlap** together with the **time span match**, make us believe this is the root cause.\n\n![](__GHOST_URL__/content/images/2017/11/1_time_curve_of_two_new_credential_in_honeypot.png)\n  Figure-1 two new credentials being actively abused\n\n![](__GHOST_URL__/content/images/2017/11/2_time_curve_of_port_2323_scanning-1.png)\n  Figure-2 scanning uptick on port 2323\n\n####Malware Sample and C2\nThe corresponding malware samples are:\n\n* 0ee0fc76a8d8ad37374f4ac3553d8937\n* 018a9569f559bfafbc433dc81caf3ec0\n* be6165a3e131cc92d3f7d51284cf70bb\n\nThe C2 represents in the samples is:\n\n* bigboatreps.pw:23\n* blacklister.nl:23\n\n\n####Most Infection in Argentina till Now\nWe noticed that most of the scanner IP came from Argentina: about 65.7k unique scanners from Argentina in less than a single day, almost 100k in last 60 hours.\n\n![](__GHOST_URL__/content/images/2017/11/3_most_scanner_come_from_telefonica_de_argentina-2.png)\n  Figure-3 most of the scanner IP came from Argentina\n\nThis make us wondering it is an attack focus on several specific types of IoT device, and these devices are widely deployed in Argentina, just as what happened in last year [Telekom event](__GHOST_URL__/a-mirai-botnet-evolvement-new-variant-and-old-c2/).\n\n####IoC\n######C2 \nbigboatreps.pw:23\nblacklister.nl:23\n\n\n######Sample md5 and download URL list\n\nhttp://80.211.173.20:80/amnyu.arm\t0255c6d7b88947c7bc82c9b06169e69d\nhttp://80.211.173.20:80/amnyu.arm\t3e72bbab07516010ab537d7236c48a2c\nhttp://80.211.173.20:80/amnyu.arm\t6c5cadcc9dbcac55b42d1347f4b51df1\nhttp://80.211.173.20:80/amnyu.arm7\t2e5ec99ef2cf8878dc588edd8031b249\nhttp://80.211.173.20:80/amnyu.arm7\t359527251c09f4ec8b0ad65ab202f1bb\nhttp://80.211.173.20:80/amnyu.arm7\t4c21d1f6acfb0155eb877418bb15001d\nhttp://80.211.173.20:80/amnyu.arm7\t5cd69f7c5cd6aef4f4b8e08181028314\nhttp://80.211.173.20:80/amnyu.arm7\t794f01740878252e8df257b0511c65df\nhttp://80.211.173.20:80/amnyu.arm7\tb0791270cc6b180ff798440f416f6271\nhttp://80.211.173.20:80/amnyu.arm7\teee4ff0e2c9482acea3251c9c2ce6daf\nhttp://80.211.173.20:80/amnyu.arm\ta6f11eba76debd49ee248b6539c4d83c\nhttp://80.211.173.20:80/amnyu.arm\tccc8761335b2d829dff739aece435eac\nhttp://80.211.173.20:80/amnyu.arm\tdd10fb3ed22a05e27bca3008c0558001\nhttp://80.211.173.20:80/amnyu.arm\te090660bbc7c673bf81680648718e39e\nhttp://80.211.173.20:80/amnyu.m68k\t1782f07f02d746c13ede8388329921e4\nhttp://80.211.173.20:80/amnyu.m68k\t4ccd3036cadcbe2a0c4b28ce4ad77b7b\nhttp://80.211.173.20:80/amnyu.m68k\t84d737bc5a1821c2f21489695c2c3a71\nhttp://80.211.173.20:80/amnyu.m68k\t8f347206f06b05ea8d2e8ea03f4f92d4\nhttp://80.211.173.20:80/amnyu.m68k\t94353157ddcd3cb40a75a5ecc1044115\nhttp://80.211.173.20:80/amnyu.m68k\tb1c66e2a2ed68087df706262b12ca059\nhttp://80.211.173.20:80/amnyu.m68k\tb8aedf6ee75e4d6b6beeafc51b809732\nhttp://80.211.173.20:80/amnyu.mips\t0ee0fc76a8d8ad37374f4ac3553d8937\nhttp://80.211.173.20:80/amnyu.mips\t2aa0c53d7d405fa6ffb7ccb895fb895f\nhttp://80.211.173.20:80/amnyu.mips\t56b74e34ddf0111700a89592b5a8b010\nhttp://80.211.173.20:80/amnyu.mips\t62fa57f007a32f857a7e1d9fb5e064eb\nhttp://80.211.173.20:80/amnyu.mips\t633df071ac6f1d55193fc4c5c8747f2a\nhttp://80.211.173.20:80/amnyu.mips\t6eed6b55c5cd893aa584894a07eec32f\nhttp://80.211.173.20:80/amnyu.mips\t97c314a2a100ea4987e73e008225d3be\nhttp://80.211.173.20:80/amnyu.mpsl\t09d98cbaa9794184841450221d410f15\nhttp://80.211.173.20:80/amnyu.mpsl\t21f1ab847a9b27f8aaabcafd9cf59756\nhttp://80.211.173.20:80/amnyu.mpsl\t33e1e2803bb70cd0d66911175782c6a1\nhttp://80.211.173.20:80/amnyu.mpsl\t4e63eccca00b01b66162fa5258d03956\nhttp://80.211.173.20:80/amnyu.mpsl\t7d2c1f3d81a2df7beea99552d0704c2d\nhttp://80.211.173.20:80/amnyu.mpsl\t7e0f883f239c922a151aab2500400880\nhttp://80.211.173.20:80/amnyu.mpsl\te46cbc10309e970ec267afee496832c9\nhttp://80.211.173.20:80/amnyu.ppc\t3dadafe1cc9639a7d374682dafab954c\nhttp://80.211.173.20:80/amnyu.ppc\t49e4b3e5d7302c2faf08c1ed585a89ca\nhttp://80.211.173.20:80/amnyu.ppc\t80bcea07b752ae4306da5f24f6693bea\nhttp://80.211.173.20:80/amnyu.ppc\t9e4caeada13676ddc5b7be44e03fe396\nhttp://80.211.173.20:80/amnyu.ppc\ta40852f9895d956fe198cb2f2f702ebf\nhttp://80.211.173.20:80/amnyu.ppc\ta8bde89d2fe98268801b58f42214cdca\nhttp://80.211.173.20:80/amnyu.ppc\te968bf902db104c91d3aaa0bb363f1bd\nhttp://80.211.173.20:80/amnyu.sh4\t141930ed206ef5f076b2a233b390ea65\nhttp://80.211.173.20:80/amnyu.sh4\t1bdaf4cd21fb9cb42d971a25fb183d04\nhttp://80.211.173.20:80/amnyu.sh4\t25d3ddb85bf392c273dd93922199628c\nhttp://80.211.173.20:80/amnyu.sh4\t39eddba755333e22841b2627a2a19e59\nhttp://80.211.173.20:80/amnyu.sh4\t485f2b2a684865ead274bba6931c95c9\nhttp://80.211.173.20:80/amnyu.sh4\t56afda94860e8d1ca8a7b9960769020d\nhttp://80.211.173.20:80/amnyu.sh4\t9dc0c166e30922d1ea8da06ba46996dc\nhttp://80.211.173.20:80/amnyu.spc\t3f0322c0b7379e492a17d3cb4fa2c82e\nhttp://80.211.173.20:80/amnyu.spc\t53c60f58ce576071c71ede7df656e823\nhttp://80.211.173.20:80/amnyu.spc\t5db44876c3acc0b589c8d696c41b6413\nhttp://80.211.173.20:80/amnyu.spc\t651b186b04583f0067d4cc2d95565a95\nhttp://80.211.173.20:80/amnyu.spc\ta18b4a6250f51c1f350b37e1187292fb\nhttp://80.211.173.20:80/amnyu.spc\tc5e1a57671dab607b8fa7363ab6582ab\nhttp://80.211.173.20:80/amnyu.spc\te6cd9197d443fb9fa79ab103232e2b67\nhttp://80.211.173.20:80/amnyu.x86\t018a9569f559bfafbc433dc81caf3ec0\nhttp://80.211.173.20:80/amnyu.x86\t1663952daca0c49326fb8fa5585d8eec\nhttp://80.211.173.20:80/amnyu.x86\t243d2c8ba1c30fa81043a82eaa7756e7\nhttp://80.211.173.20:80/amnyu.x86\t4b375509896e111ef4c3eb003d38077f\nhttp://80.211.173.20:80/amnyu.x86\t6371b6b1d030ac7d2cb1b0011230f97f\nhttp://80.211.173.20:80/amnyu.x86\t64bda230a3b31a115a29e0afd8df5d8a\nhttp://80.211.173.20:80/amnyu.x86\ted825b8aadee560e5c70ffaa5b441438\nhttp://80.211.173.20/amnyu.arm7\tb0791270cc6b180ff798440f416f6271\nhttp://80.211.173.20/amnyu.arm\te090660bbc7c673bf81680648718e39e\nhttp://80.211.173.20/amnyu.m68k\t4ccd3036cadcbe2a0c4b28ce4ad77b7b\nhttp://80.211.173.20/amnyu.mips\t97c314a2a100ea4987e73e008225d3be\nhttp://80.211.173.20/amnyu.mpsl\t7d2c1f3d81a2df7beea99552d0704c2d\nhttp://80.211.173.20/amnyu.ppc\te968bf902db104c91d3aaa0bb363f1bd\nhttp://80.211.173.20/amnyu.sh4\t485f2b2a684865ead274bba6931c95c9\nhttp://80.211.173.20/amnyu.spc\t5db44876c3acc0b589c8d696c41b6413\nhttp://80.211.173.20/amnyu.x86\t4b375509896e111ef4c3eb003d38077f\nhttp://blacklister.nl/bins/mirai.arm\tbe6165a3e131cc92d3f7d51284cf70bb\nhttp://blacklister.nl/bins/mirai.arm5n\tc639bc6b50ab0be250147572956a9d6b\nhttp://blacklister.nl/bins/mirai.arm6\t8f9c5099e3749d0199262289c9deaa3d\nhttp://blacklister.nl/bins/mirai.arm7\te508956188f2cb71605ae0e8fbdf4a64\nhttp://blacklister.nl/bins/mirai.i486\t25846ce769f0bd5b204f440127d51f21\nhttp://blacklister.nl/bins/mirai.i686\td3c82dd5d512304efc6a42018f0bf2a7\nhttp://blacklister.nl/bins/mirai.m68k\t3ef657efcfe16ad869a587d30480306f\nhttp://blacklister.nl/bins/mirai.mips\tb4af22c2b3b1af68f323528ee0bc6637\nhttp://blacklister.nl/bins/mirai.mips64\t1e1d6b41a13c97ad3754815021dd0891\nhttp://blacklister.nl/bins/mirai.mpsl\t6adb31781db797712d759f564b9761b6\nhttp://blacklister.nl/bins/mirai.ppc\t7936cc1d021664892c48408ec1c9143c\nhttp://blacklister.nl/bins/mirai.ppc440fp\tfd6235e4e1cf4a0f6c2d609a7b1ffc55\nhttp://blacklister.nl/bins/mirai.sh4\t5c8ef7f23f26e0e48ab527ef83874213\nhttp://blacklister.nl/bins/mirai.spc\t7ce73df7fb50beda2f549f9695a23538\nhttp://blacklister.nl/bins/mirai.x86\t539e9bf8c81bd3e9ae520fd74218a6b8\nhttp://blacklister.nl/bins/mirai.x86_64\td69e501480f03f06e4579fa13e47d04a"}]],"sections":[[10,0]],"ghostVersion":"3.0"}