Rewterz Threat Alert – Mirai Botnet aka Katana – Active IOCs

Severity

High

Analysis Summary

Mirai botnet is a type of malware that infects Internet of Things (IoT) devices, such as routers, security cameras, and other smart devices, in order to launch distributed denial-of-service (DDoS) attacks. The botnet was first discovered in August 2016 and quickly gained notoriety for its ability to launch some of the largest DDoS attacks ever recorded, including an attack that took down the DNS provider Dyn.

Mirai works by scanning the internet for devices that use default or easily guessable passwords, such as “admin” or “password”. Once a vulnerable device is identified, the malware infects it and adds it to the botnet, which can then be used to launch DDoS attacks on a target.

Mirai is particularly effective because it is able to exploit the large number of poorly secured IoT devices that are connected to the internet. This makes it difficult to defend against, as many of these devices have limited processing power and memory, and may not receive regular security updates.

Since its discovery, Mirai has continued to evolve and new variants of the malware have been detected. The best defense against Mirai is to ensure that IoT devices are properly secured, with strong passwor

Impact

• Server Outage
• Data Loss
• Website Downtime

Indicators of Compromise

MD5

• 38cbc7f6a883fb3c35e16ff09b9774b5
• 4d5d9964e9dde257ef3fe0ae9808cac0
• bf2b1c4e18a94d4200377842ecff9ceb
• 2ef9bdad18708c68ed96bb939a11e791
• 5ea597463771012e833dca5617d4b3c2
• d7b3cba2e8853a9a9f085154b4ade14e
• cb0738a9806ae1557eaa90a2dba8a205

SHA-256

• 4c2cab01758928161a46477cdf34025d67ecefe62190d4ea427085d409c62b2c
• 3e41464ea1173f2b87ca1440e08b1dc7238d1a512d080eae23161fcf33d215f1
• 01502257528510bd7a790913bbe692393ab4f6c0f4fb3c35ae1cbc9aeeae90b6
• 1e83e76c17d0268b970cdf3754d3360b451489b6dcae26c2f9daf35a8837b969
• 1acda35e098b4579ea0056cce9ca6a085186ce0bf978dc439d5060c91b33dd66
• 3c548d7b7ef9245ebc95ab31b1885808607ed503b8721b7f62021de8fb90c8bd
• f0f2091d2d138821d30f1d7fe29a28e4d50e420c9f9e68688a503d3cd35edf18

SHA-1

• ee5add4e5431838093bbdcd39eab1843450fbd73
• c8ea4927ff1b890ac924615522f4844254202b23
• f990d823eb083a0bf0683c4fcf13da090cfce615
• 05926a459e049769f10d45938561d213264c0799
• e9387bf0776e683c4dd5dba8c6193b076929591e
• 79b3fc6ce32153d2a80723f8a487ba5ebe173023
• ea63d0862e9b8471a967b7247349c042a9d5efac

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets