SORA and UNSTABLE: 2 Mirai Variants Target Video Surveillance Storage Systems

February 05, 2020

Trend Micro researchers encountered two variants of the notorious internet of things (IoT) malware, Mirai, employing a new propagation method. The two variants, namely SORA (detected as IoT.Linux.MIRAI.DLEU) and UNSTABLE (detected as IoT.Linux.MIRAI.DLEV), gain entry through Rasilient PixelStor5000 video surveillance storage systems by exploiting CVE-2020-6756.

Mirai is a type of malware that actively searches for IoT devices with vulnerabilities, infects them, and turns them into bots. These bots will then find other devices to infect. Through the years, the malware has given rise to several variants, like those that target routers and smart TVs.

Mirai botnets can be utilized for distributed denial of service (DDoS) attacks. Many cybercriminals capitalize on the malware by offering DDoS-for-hire services, which require a large number of bots. To satisfy this requirement, threat actors need to infect as many devices as they can, incentivizing them to continually find ways to spread the infection.

The variants enter the system by abusing a vulnerability (CVE-2020-6756) in the Rasilient video surveillance storage device. The vulnerability allows remote code execution (RCE) via the lang parameter.

Figure 1. Code showing the exploit for the PixelStor5000 vulnerability (CVE-2020-6756).

Figure 2. Snapshot of a shell script that downloads and executes the Mirai payload.

Similar to past Mirai exploits, the cybercriminals download and execute a shell script from the C&C (Command and Control) server. The shell script will then download and execute the payload that contains either SORA or UNSTABLE.

SORA variant

Typical for a Mirai variant, the SORA samples that the researchers found used credentials for brute-force attacks that are XOR-encrypted with the key DEDEFBAF. The variant exploits CVE-2017-17215 and CVE-2018-10561, resulting in remote code execution (RCE) and unauthorized management of device, respectively.

Figure 3. Snapshots of code embedded in the Mirai variant exploiting a vulnerability in Huawei Router HG532.

Figure 4. Snapshots of code embedded in the Mirai variant exploiting a vulnerability in GPON routers.

UNSTABLE variant

Like the SORA variant, the UNSTABLE samples also employ XOR-encryption to hide its strings (key: DEADDAAD). Some samples that the researchers detected were are also packed using UPX to reduce the size of the executable binary and further evade detection.

Besides CVE-2017-17215 and CVE-2018-10561, UNSTABLE also abuse the ThinkPHP vulnerability. This allows RCE, which leads to the download and execution of the malware.

Figure 5. Snapshot of embedded code that exploits vulnerabilities in ThinkPHP 5.0.23/5.1.31 framework.

Securing IoT Devices

Mirai’s use of a new vulnerability reflects how cybercriminals consistently seek to exploit every unsecured nook and cranny of IoT systems. Users can protect their IoT devices from such threats by following these best practices:

Change the default passwords of routers and other IoT devices.
Properly configure security settings and disable unused device features.
Closely monitor network traffic for increased connection attempts to unfamiliar domains.
Apply patches and updates to protect system vulnerabilities and build protection against old and new threats

Trend Micro™ Home Network Security can help monitor internet traffic between the router and connected devices, and provides protection for several vulnerabilities used by Mirai via the rules below:

1134610 - WEB Dasan GPON Routers Command Injection -1.1 (CVE-2018-10561)
1134611 - WEB Dasan GPON Routers Command Injection -1.2 (CVE-2018-10561)
1134891 - WEB Dasan GPON Routers Command Injection -1.3 (CVE-2018-10561)
1134892 - WEB Dasan GPON Routers Command Injection -1.4 (CVE-2018-10561)
1134287 - WEB Huawei Home Gateway SOAP Command Execution (CVE-2017-17215)
1135215 - WEB ThinkPHP Remote Code Execution

For endpoint level protection, users can install Trend Micro™ Security and Trend Micro™ Internet Security solutions. The Trend Micro™ Deep Discovery™ Inspector network appliance protects enterprises from targeted attacks by monitoring ports and network protocols and spotting advanced threats.

Indicators of Compromise:

SORA (SHA-1)

35b0d5dbcaba3edd0d7b3e7b14b36cb96527148c
4bbe4ec21a148000838b66a334e956944797eeab
8d8b01e3fc145a1f64eed6d39bdf5db2d8fbec60
abaf3640c849a4bc32304a40f9bf0adaeef8c893
bd37f93e284cf2b7d9320808b50ed98cd6d0ffa3
c2809d998c267a1a24660ca7f33becb86f5b02ce
d56d2e59185b19b5a06ae1dc2652c3eb856c005b
f86fe270ff7a1502a3fbce8aa148a13cbe194a92
fa17c4545946027f11c8fb7c5a4f08ff8f26ce75

UNSTABLE (SHA-1) (Some are UX packed)

4f11cca6f909e8bd7b5bf276da983a2a38f6a1d2
81e6c575a4000797d5bdfbd0048a514bb6c05001
a019c886ba3bfa4bb3b976a620c08bb3058e257b
4fd05325244a6d8d0c0fa20ec9f44af9e380b653
a792d58f42caa7ab038702cbf8f2a2de3b327131
ac0bacf92b382de09d7a625e9f380cd2a389bccb
45d644aba5ea368bd366b543663dac00c72aeeee
d7ca3bcad5cba00574f7247562597cdca0d2bead
8d79da230bf64f7e3be18c4d4c2837bdf76be744
4d5452315f5c5a742e17ab1c14e4356fd669b448

Related malicious IP address/URLs:

IP 45.148.10.86
IP 193.70.125.169
hxxp://faygox.duckdns[.]org/thinkphp
hxxp://faygox.duckdns[.]org/gpon443
zxcxffyttygbbgfgf12121bot[.]duckdns.org
cnctomecutie1337[.]mikeysyach[.]xyz
scanthembigbots[.]mikeysyach[.]xyz

Analysis and insights by Raymart Paraiso and Augusto Remillano II.

HIDE

Like it? Add this infographic to your site:
1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V).

Image will appear the same size as you see above.

Posted in Internet of Things, Malware, Botnets, Exploits