Quick summary about the Port 8291 scan
<!--kg-card-begin: markdown--><h2 id="summary">Summary</h2>
<p>This 8291 scan event is caused by a Hajime botnet variant. Compared to the old Hajime,  this one adds two new features:</p>
<ol>
<li>Check port 8291 to determine if the target is a MikroTik device</li>
<li>Use ‘Chimay Red’ Stack Clash Remote Code Execution Loophole vulnerabilities to infect and spread.</li>
</ol>
<p>For more details about the Hajime, please check our previous blog <a href="__GHOST_URL__/hajime-status-report-en/">here</a></p>
<h2 id="thesharpscanincrease">The sharp scan increase</h2>
<p>At around 0:00 on March 25, Beijing time, our <a href="https://scan.netlab.360.com/#/dashboard?tsbeg=1521648000000&amp;tsend=1522252800000&amp;dstport=8291&amp;toplistname=srcip&amp;topn=10&amp;sortby=sum">Scanmon</a> system suggested a large number of scan activity is happening on port 8291 on a global scale.</p>
<p><img src="__GHOST_URL__/content/images/2018/03/image003.jpg" alt="" loading="lazy"></p>
<p>Around 2 pm, our honeypot data indicated this sudden spike was related to Hajime. Our preliminary conclusion based on its UPX_MAGIC_LE32 and some sample features confirmed that the sample is Hajime based. And we found the ‘Chimay Red’ Stack Clash Remote Code Execution” vulnerability related attack code in their atk module.</p>
<blockquote>
<p><a href="https://www.exploit-db.com/exploits/44283/">https://www.exploit-db.com/exploits/44283/</a></p>
</blockquote>
<h2 id="infectionprocess">Infection process</h2>
<p>This Hajime variant adds a support of using “‘Chimay Red’ Stack Clash Remote Code “Execution” to perform worm-like spreading, and its propagation process is roughly divided into two steps:</p>
<ol>
<li>Find a MikroTik device by checking if the target port is open on port 8291, if this port is open,the other common web ports (80,81,82,8080,8081,8082,8089,8181,8880) will be probed next.</li>
<li>Check the version number of the device and send the Exploit which carried the Shellcode. Once the vulnerability is successfully exploited, Hajime will be downloaded and executed.</li>
</ol>
<p><img src="__GHOST_URL__/content/images/2018/03/Hajime_spread_with_8291.jpg" alt="" loading="lazy"></p>
<h2 id="numberofuniqueips">Number of unique ips</h2>
<p>From 2018-03-25 00:00 to 2018-03-27 12:36(GMT+8), We logged a total of 861,131 unique scan source IPs (72 Hours).(Please bear in mind that device may change ip due to device reboot etc and it does not necessary mean all these devices are  MikroTik devices as all the Hajime bots will perform this task as long as they have the most recent version of Hajime code running.  Also naturally there will be some noises such as researcher ips in it)</p>
<h2 id="scansourcedistribution">Scan Source Distribution</h2>
<p><img src="__GHOST_URL__/content/images/2018/03/20180327-8291-----.png" alt="" loading="lazy"></p>
<p>From the above figure, it is not difficult to find the top three sources of the scan source are: Brazil (585k), Iran (51.8k), Russia (26.4k).</p>
<h2 id="mitigation">Mitigation</h2>
<ol>
<li>block unnecessary 8291 port request</li>
<li>Update to the latest version from MikroTik.</li>
</ol>
<p>We will continue to monitor this activity,  if readers have new discoveries, feel free to contact us on our <a href="https://twitter.com/360Netlab">twitter</a>.</p>
<h2 id="ioc">IOC</h2>
<p>06B4D50254C6C112437A3ED893EF40B4  .i.mipseb<br>
93A1A080FCDE07E512E7485C92861B69  atk.mipseb<br>
fc834c015b357c687477cb9116531de7  atk.mipseb.upx.unpack</p>
<h2 id="refer">Refer</h2>
<ol>
<li><a href="https://scan.netlab.360.com/#/dashboard?tsbeg=1521648000000&amp;tsend=1522252800000&amp;dstport=8291&amp;toplistname=srcip&amp;topn=10&amp;sortby=sum">https://scan.netlab.360.com/#/dashboard?tsbeg=1521648000000&amp;tsend=1522252800000&amp;dstport=8291&amp;toplistname=srcip&amp;topn=10&amp;sortby=sum</a></li>
<li><a href="https://forum.mikrotik.com/viewtopic.php?f=2&amp;t=132368&amp;sid=7f731eb96b119d6e9e1a90227270fdd4">https://forum.mikrotik.com/viewtopic.php?f=2&amp;t=132368&amp;sid=7f731eb96b119d6e9e1a90227270fdd4</a></li>
<li><a href="https://www.exploit-db.com/exploits/44283/">https://www.exploit-db.com/exploits/44283/</a></li>
<li><a href="__GHOST_URL__/hajime-status-report/">https://blog.netlab.360.com/hajime-status-report/</a></li>
<li><a href="__GHOST_URL__/hajime-status-report-en/">https://blog.netlab.360.com/hajime-status-report-en/</a></li>
<li>
<pre><code> https://twitter.com/360Netlab
</code></pre>
</li>
</ol>
<!--kg-card-end: markdown-->
Summary


This 8291 scan event is caused by a Hajime botnet variant. Compared to the old Hajime, this one adds two new features:


 1. Check port 8291 to determine if the target is a MikroTik device
 2. Use ‘Chimay Red’ Stack Clash Remote Code Execution Loophole vulnerabilities to infect and spread.


For more details about the Hajime, please check our previous blog here



The sharp scan increase


At around 0:00 on March 25, Beijing time, our Scanmon system suggested a large number of scan activity is happening on port 8291 on a global scale.





Around 2 pm, our honeypot data indicated this sudden spike was related to Hajime. Our preliminary conclusion based on its UPX_MAGIC_LE32 and some sample features confirmed that the sample is Hajime based. And we found the ‘Chimay Red’ Stack Clash Remote Code Execution” vulnerability related attack code in their atk module.





https://www.exploit-db.com/exploits/44283/




Infection process


This Hajime variant adds a support of using “‘Chimay Red’ Stack Clash Remote Code “Execution” to perform worm-like spreading, and its propagation process is roughly divided into two steps:


 1. Find a MikroTik device by checking if the target port is open on port 8291, if this port is open,the other common web ports (80,81,82,8080,8081,8082,8089,8181,8880) will be probed next.
 2. Check the version number of the device and send the Exploit which carried the Shellcode. Once the vulnerability is successfully exploited, Hajime will be downloaded and executed.






Number of unique ips


From 2018-03-25 00:00 to 2018-03-27 12:36(GMT+8), We logged a total of 861,131 unique scan source IPs (72 Hours).(Please bear in mind that device may change ip due to device reboot etc and it does not necessary mean all these devices are MikroTik devices as all the Hajime bots will perform this task as long as they have the most recent version of Hajime code running. Also naturally there will be some noises such as researcher ips in it)



Scan Source Distribution





From the above figure, it is not difficult to find the top three sources of the scan source are: Brazil (585k), Iran (51.8k), Russia (26.4k).



Mitigation


 1. block unnecessary 8291 port request
 2. Update to the latest version from MikroTik.


We will continue to monitor this activity, if readers have new discoveries, feel free to contact us on our twitter.



IOC


06B4D50254C6C112437A3ED893EF40B4 .i.mipseb

93A1A080FCDE07E512E7485C92861B69 atk.mipseb

fc834c015b357c687477cb9116531de7 atk.mipseb.upx.unpack



Refer


 1. https://scan.netlab.360.com/#/dashboard?tsbeg=1521648000000&tsend=1522252800000&dstport=8291&toplistname=srcip&topn=10&sortby=sum
 2. https://forum.mikrotik.com/viewtopic.php?f=2&t=132368&sid=7f731eb96b119d6e9e1a90227270fdd4
 3. https://www.exploit-db.com/exploits/44283/
 4. https://blog.netlab.360.com/hajime-status-report/
 5. https://blog.netlab.360.com/hajime-status-report-en/
 6. 
    
    
     https://twitter.com/360Netlab
    
    

{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"## Summary\n\nThis 8291 scan event is caused by a Hajime botnet variant. Compared to the old Hajime,  this one adds two new features: \n\n1. Check port 8291 to determine if the target is a MikroTik device\n2. Use ‘Chimay Red’ Stack Clash Remote Code Execution Loophole vulnerabilities to infect and spread.\n\nFor more details about the Hajime, please check our previous blog [here](__GHOST_URL__/hajime-status-report-en/)\n\n## The sharp scan increase\n\nAt around 0:00 on March 25, Beijing time, our [Scanmon](https://scan.netlab.360.com/#/dashboard?tsbeg=1521648000000&tsend=1522252800000&dstport=8291&toplistname=srcip&topn=10&sortby=sum) system suggested a large number of scan activity is happening on port 8291 on a global scale.\n\n![](__GHOST_URL__/content/images/2018/03/image003.jpg)\n\nAround 2 pm, our honeypot data indicated this sudden spike was related to Hajime. Our preliminary conclusion based on its UPX\\_MAGIC\\_LE32 and some sample features confirmed that the sample is Hajime based. And we found the ‘Chimay Red’ Stack Clash Remote Code Execution” vulnerability related attack code in their atk module. \n  \n> https://www.exploit-db.com/exploits/44283/\n\n\n## Infection process\n\nThis Hajime variant adds a support of using “‘Chimay Red’ Stack Clash Remote Code “Execution” to perform worm-like spreading, and its propagation process is roughly divided into two steps:\n\n1. Find a MikroTik device by checking if the target port is open on port 8291, if this port is open,the other common web ports (80,81,82,8080,8081,8082,8089,8181,8880) will be probed next.\n2. Check the version number of the device and send the Exploit which carried the Shellcode. Once the vulnerability is successfully exploited, Hajime will be downloaded and executed.\n\n![](__GHOST_URL__/content/images/2018/03/Hajime_spread_with_8291.jpg)\n\n## Number of unique ips\n\nFrom 2018-03-25 00:00 to 2018-03-27 12:36(GMT+8), We logged a total of 861,131 unique scan source IPs (72 Hours).(Please bear in mind that device may change ip due to device reboot etc and it does not necessary mean all these devices are  MikroTik devices as all the Hajime bots will perform this task as long as they have the most recent version of Hajime code running.  Also naturally there will be some noises such as researcher ips in it)\n\n## Scan Source Distribution\n\n![](__GHOST_URL__/content/images/2018/03/20180327-8291-----.png)\n\nFrom the above figure, it is not difficult to find the top three sources of the scan source are: Brazil (585k), Iran (51.8k), Russia (26.4k).\n\n## Mitigation\n\n1. block unnecessary 8291 port request\n2. Update to the latest version from MikroTik.\n\nWe will continue to monitor this activity,  if readers have new discoveries, feel free to contact us on our [twitter](https://twitter.com/360Netlab).\n\n## IOC\n\n06B4D50254C6C112437A3ED893EF40B4  .i.mipseb\n93A1A080FCDE07E512E7485C92861B69  atk.mipseb\nfc834c015b357c687477cb9116531de7  atk.mipseb.upx.unpack\n\n## Refer\n1.\thttps://scan.netlab.360.com/#/dashboard?tsbeg=1521648000000&tsend=1522252800000&dstport=8291&toplistname=srcip&topn=10&sortby=sum\n2.\thttps://forum.mikrotik.com/viewtopic.php?f=2&t=132368&sid=7f731eb96b119d6e9e1a90227270fdd4\n3.\thttps://www.exploit-db.com/exploits/44283/\n4.\t__GHOST_URL__/hajime-status-report/\n5.\t__GHOST_URL__/hajime-status-report-en/\n6.      https://twitter.com/360Netlab\n\n\n\n\n\n\n\n\n\n\n\n"}]],"sections":[[10,0]],"ghostVersion":"3.0"}