March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – NJRAT – Active IOCs
July 24, 2023
Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs
July 25, 2023
Rewterz Threat Alert – NJRAT – Active IOCs
July 24, 2023
Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs
July 25, 2023
Severity
High
Analysis Summary
Mirai botnet is a type of malware that infects Internet of Things (IoT) devices, such as routers, security cameras, and other smart devices, in order to launch distributed denial-of-service (DDoS) attacks. The botnet was first discovered in August 2016 and quickly gained notoriety for its ability to launch some of the largest DDoS attacks ever recorded, including an attack that took down the DNS provider Dyn.
Mirai works by scanning the internet for devices that use default or easily guessable passwords, such as “admin” or “password”. Once a vulnerable device is identified, the malware infects it and adds it to the botnet, which can then be used to launch DDoS attacks on a target.
Mirai is particularly effective because it is able to exploit the large number of poorly secured IoT devices that are connected to the internet. This makes it difficult to defend against, as many of these devices have limited processing power and memory, and may not receive regular security updates.
Since its discovery, Mirai has continued to evolve and new variants of the malware have been detected. The best defense against Mirai is to ensure that IoT devices are properly secured, with strong passwor
Impact
- Server Outage
- Data Loss
- Website Downtime
Indicators of Compromise
MD5
- a7f7feb202977febc7186edb51c0acab
- 93e55013fe43b9b2f50e8dcc1641fad6
- fe7ba45fab02b74cc1fad6f7125556df
SHA-256
- 66b99e7b530241eea679464d121e51afe18890f262098a07a2210a888e34d16d
- 79db0e3cf4fc5fdbf2785a3a59db53e9be61889103ba4372f9b7eec7c54134cf
- 9f7cf27d29b0f86df72bf96bcdedaca4bea33df7652c526152f6cc19bcad42df
SHA-1
- af339d523c16fae0cf4fe923d801a8c3da0beef3
- 8e0b0e978251512844b247e49b7230227f362be3
- 47f88d855ea99b16de77125800dc434eca11c2e7
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Never trust or open links and attachments received from unknown sources/senders.
- Upgrade your operating system.
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets