Active IoT botnets 10/04/2020

URL: http://142.93.197.100:80/bins/Hilix.x86TCP scanning: 23, 37215, 52869CNC: TCP: 142.93.197.100:45https://www.virustotal.com/gui/file/a89335c965355e33e10c8f779a00a7d5/detection URL: http://45.14.224.22:80/bins/Solstice.x86TCP scanning: 80, 52869, 37215CNC: TCP: 45.14.224.22:21795https://www.virustotal.com/gui/file/f53749eaeea48dc1720cfca6f5b4e932/detection URL: http://104.238.235.186:80/bins/911.x86TCP scanning: 37215CNC: TCP: 104.238.235.186:5034https://www.virustotal.com/gui/file/06a6abf63963606a28d5fb1e4bedc72d/detection URL: http://165.227.51.77:80/SBIDIOT/arm7TCP scanning: 23CNC: TCP: 165.227.51.77:666https://www.virustotal.com/gui/file/c6dcbd3557fe11841599427da833d63c/detection

Active IoT botnets 10/04/2020 Read More »

Active IoT Botnets 25/03/2020

URL: http://80.211.230.27:80/a.arm7 TCP scanning: 26 CNC: TCP: 172.86.75.173:6909 https://www.virustotal.com/gui/file/bd658214918e4228f4ed07875d4830f3/detection URL: http://80.211.230.27:80/a.x86 TCP scanning: 26 CNC: TCP: 172.86.75.173:6909 https://www.virustotal.com/gui/file/8a7dafd2218ccdfa511e94f3e6dc9a59/detection URL: http://185.172.110.232:80/nope/daddyscum.x86 TCP scanning: 23, 37215 CNC: TCP: 192.236.155.159:7498 https://www.virustotal.com/gui/file/2398c7305b819ef61411eac52463f862/detection URL: http://134.122.112.236:80/bins/Hilix.arm7 TCP scanning: 37215, 23, 52869 CNC: TCP: 134.122.112.236:45 https://www.virustotal.com/gui/file/8b8e4fb04a87013b153f683b1149dd3c/detection URL: http://134.122.112.236:80/bins/Hilix.x86 TCP scanning: 37215, 23, 52869 CNC: TCP: 134.122.112.236:45 https://www.virustotal.com/gui/file/26a9dce3e8d3a6fa963e1cc101b60a36/detection URL: http://67.207.93.206:80/GraveDigger/rapethemipcams.arm7 TCP scanning: 23

Active IoT Botnets 25/03/2020 Read More »

URL-less IoT botnet propagation

In this post I’ll cover an evasion technique used to perform URL-less binary transfer to vulnerable IoT devices.  The technique is not new and has been used by various IoT botnets in the past years, but for a different purpose, namely, to ensure the binary payload is delivered to the vulnerable IoT devices that lack wget/curl/tftp

URL-less IoT botnet propagation Read More »