Backdoor.Linux.MIRAI.USELVHB

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• PING
• TELNET
  • - Has additional arguments:
  • "ON"
  • Uses a set of credentials to bruteforce:
  • Username:
  • "telnet"
  • "root"
  • "admin"
  • Password:
  • "telnet"
  • "root"
  • "1234"
  • "12345"
  • "oelinux123"
  • "admin"
  • "vizxv"
  • If connected successfully, it would try to:
  • Send busybox payload
  • Delete temp directories
  • "OFF"
  • Does not bruteforce
  • "FASTLOAD"
  • Same with "ON" but more optimized and can set number of threads and wait time
• MIRAI
  • Has additional arguments:
  • "ON"
  • Uses a set of credentials to bruteforce:
  • Username:
  • "root"
  • "admin"
  • "support"
  • "user"
  • "Administrato"
  • "service"
  • "supervisor"
  • "guest"
  • "admin1"
  • "administrator"
  • "666666"
  • "888888"
  • "ubnt"
  • "klv1234"
  • "Zte521"
  • "hi3518"
  • "jvbzd"
  • "anko"
  • "zlxx"
  • "7ujMko0vizxv"
  • "7ujMko0admin"
  • "system"
  • "ikwb"
  • "dreambox"
  • "realtek"
  • "00000000"
  • "1111111"
  • "1234"
  • "12345"
  • "54321"
  • "123456"
  • "pass"
  • "meinsm"
  • "tech"
  • "fucker"
  • Password:
  • "xc3511"
  • "vizxv"
  • "admin"
  • "admin"
  • "888888"
  • "xmhdipc"
  • "default"
  • "juantech"
  • "123456"
  • "54321"
  • "support"
  • "" root
  • "password"
  • "root"
  • "12345"
  • "user"
  • ""
  • "pass"
  • "admin1234"
  • "1111"
  • "smcadmin"
  • "1111"
  • "666666"
  • "password"
  • "1234"
  • "klv123"
  • "admin"
  • "service"
  • "supervisor"
  • "guest"
  • "12345"
  • "12345"
  • "password"
  • "1234"
  • "666666"
  • "888888"
  • "ubnt"
  • "klv1234"
  • "Zte521"
  • "hi3518"
  • "jvbzd"
  • "anko"
  • "zlxx"
  • "7ujMko0vizxv"
  • "7ujMko0admin"
  • "system"
  • "ikwb"
  • "dreambox"
  • "user"
  • "realtek"
  • "00000000"
  • "1111111"
  • "1234"
  • "12345"
  • "54321"
  • "123456"
  • "7ujMko0admin"
  • "1234"
  • "pass"
  • "meinsm"
  • "tech"
  • "fucker"
  • If connected successfully, it would try to:
  • Send busybox payload
  • Delete temp directories
  • "OFF"
  • Does not bruteforce
  • "FASTLOAD"
  • Same with "ON" but more optimized and can set number of threads and wait time
• PYTHON
  • Has additional arguments:
  • "INSTALL"
  • Installs a python file named scan.py then clears history
  • Connects to the following URL for the installation:
  • http://{BLOCKED}.{BLOCKED}.159]60/scan.py then saves it to the /etc/.../ directory
  • "UPDATE"
  • Updates the file scan.py then clears history
  • "OFF"
  • Terminates python processes
  • "1"
  • Executes the file 'scan.py' with "119.93.x.x" as the parameter where x.x is any of the following values listed below
  • "2"
  • Executes the file 'scan.py' with "91.98.x.x" as the parameter where x.x is any of the following values listed below
  • "3"
  • Executes the file 'scan.py' with "118.173.x.x" as the parameter where x.x is any of the following values listed below
  • "4"
  • Executes the file 'scan.py' with "91.99.x.x" as the parameter where x.x is any of the following values listed below
  • "5"
  • Executes the file 'scan.py' with "92.99.x.x"as the parameter where x.x is any of the following values listed below
  • List of IPs (x.x values)
  • "5.78"
  • "49.150"
  • "91.98"
  • "91.99"
  • "101.108"
  • 101.109"
  • "119.93"
  • "122.3"
  • "122.52"
  • "122.54"
  • "124.104"
  • "124.105"
  • "124.106"
  • "124.107"
  • "125.25"
  • "125.26"
  • "125.27"
  • "125.2"
• HTTP
  • HTTP Flood
• UDP
  • UDP Flood
• TCP
  • TCP Flood
• STD
  • STD Flood
• KILLATTK
  • Terminates the following processes:
  • "mips",
  • "mipsel",
  • "sh4",
  • "x86",
  • "i686",
  • "ppc",
  • "i586",
  • "i586",
  • "jack*",
  • "hack*",
  • "arm*"
  • "tel*"
  • "b1",
  • "b2",
  • "b3",
  • "b4",
  • "b5",
  • "b6",
  • "b7",
  • "b8",
  • "b9",
  • "lol*",
  • "busybox*",
  • "badbox*",
  • "DFhxdhdf",
  • "dvrHelper",
  • "FDFDHFC",
  • "FEUB",
  • "FTUdftui",
  • "GHfjfgvj",
  • "jhUOH",
  • "JIPJIPJj",
  • "JIPJuipjh",
  • "kmyx86_64",
  • "lolmipsel",
  • "mips",
  • "mipsel",
  • "RYrydry",
  • "TwoFace*",
  • "UYyuyioy",
  • "wget",
  • "x86_64",
  • "XDzdfxzf",
  • "xx*",
  • "sh",
  • "1",
  • "2",
  • "3",
  • "4",
  • "5",
  • "6",
  • "7",
  • "8",
  • "9",
  • "10",
  • "11",
  • "12",
  • "13",
  • "14",
  • "15",
  • "16",
  • "17",
  • "18",
  • "19",
  • "20",
  • "busybox",
  • "badbox",
  • "Mirai*",
  • "mirai*",
  • "cunty*",
  • "IoT*"
• LOLNOGTFO
  • Terminates itself
• UPDATE
  • Updates itself to the latest version

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.159.60:2323