{"id":11208,"date":"2017-02-16T18:37:24","date_gmt":"2017-02-16T18:37:24","guid":{"rendered":"https:\/\/evosec.eu\/?p=11208"},"modified":"2017-02-16T18:37:24","modified_gmt":"2017-02-16T18:37:24","slug":"iot-malware-advances","status":"publish","type":"post","link":"https:\/\/evosec.eu\/nl\/iot-malware-advances\/","title":{"rendered":"IoT Malware advances"},"content":{"rendered":"

A new strain (as long as December 2016 can be called new) has been spotted on GitHub that combines both a standard telnet scanner and also MIRAI. <\/p>\n

It has been uploaded here:https:\/\/github.com\/geo93033\/u<\/a>.<\/p>\n

In the header(s) you can find some credentials:<\/p>\n

Xmpp: b1nary@nigge.rs
\nTwitter: @P2PBOTNET
\nInstragram: @Rebirth.c
\nSkype: b1narythag0d<\/p><\/blockquote>\n

and<\/p>\n

\nSkype: uriede
\nXMPP: Crypt@nigge.rs
\nChanges:
\nMade Date: 7-30-16<\/p><\/blockquote>\n

And also a “nice” notice:<\/p>\n

\/*
\nRebirth Is an ongoing project, that will have many builds, and updates.
\nThis Client is being constantly worked on.
\nAnyone that bought Rebirth Legitly will have access to the builds, and updates.
\nFor anyone that leeches, or leaks, well fuck you.
\n*\/<\/p><\/blockquote>\n

\n

Besides that, you can also find several names of the ELF binaries used by this (or other) infections, as well as the architectures they are designed for:<\/p>\n

\t“jackmymips”,
\n\t“jackmymips64”,
\n\t“jackmymipsel”,
\n\t“jackmysh2eb”,
\n\t“jackmysh2elf”,
\n\t“jackmysh4”,
\n\t“jackmyx86”,
\n\t“jackmyarmv5”,
\n\t“jackmyarmv4tl”,
\n\t“jackmyarmv4”,
\n\t“jackmyarmv6”,
\n\t“jackmyi686”,
\n\t“jackmypowerpc”,
\n\t“jackmypowerpc440fp”,
\n\t“jackmyi586”,
\n\t“jackmym68k”,
\n\t“jackmysparc”,<\/p><\/blockquote>\n

\t“hackmymips”,
\n\t“hackmymipsel”,
\n\t“hackmysh4”,
\n\t“hackmyx86”,
\n\t“hackmyarmv6”,
\n\t“hackmyi686”,
\n\t“hackmypowerpc”,
\n\t“hackmyi586”,
\n\t“hackmym68k”,
\n\t“hackmysparc”,<\/p><\/blockquote>\n

\t“busyboxterrorist”,
\n\t“DFhxdhdf”,
\n\t“dvrHelper”,
\n\t“FDFDHFC”,
\n\t“FEUB”,
\n\t“FTUdftui”,
\n\t“GHfjfgvj”,<\/p><\/blockquote>\n

\t“jhUOH”,
\n\t“JIPJIPJj”,
\n\t“JIPJuipjh”,
\n\t“kmyx86_64”, \/\/<- Kami?<\/p><\/blockquote>\n

\t“TwoFacearmv61”,
\n\t“TwoFacei586”,
\n\t“TwoFacei686”,
\n\t“TwoFacem86k”,
\n\t“TwoFacemips”,
\n\t“TwoFacemipsel”,
\n\t“TwoFacepowerpc”,
\n\t“TwoFacesh4”,
\n\t“TwoFacesparc”,
\n\t“TwoFacex86_64”,<\/p><\/blockquote>\n

and others…<\/p>\n","protected":false},"excerpt":{"rendered":"

A new strain (as long as December 2016 can be called new) has been spotted on GitHub that combines both a standard telnet scanner and also MIRAI. It has been uploaded here:https:\/\/github.com\/geo93033\/u. In the header(s) you can find some credentials: Xmpp: b1nary@nigge.rs Twitter: @P2PBOTNET Instragram: @Rebirth.c Skype: b1narythag0d and Skype: …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[98,932,947,99],"tags":[74,60,981],"class_list":["post-11208","post","type-post","status-publish","format-standard","hentry","category-iot-newsupdates","category-iot-security","category-it-security","category-it-security-newsupdates","tag-iot","tag-malware","tag-mirai"],"translation":{"provider":"WPGlobus","version":"3.0.2","language":"nl","enabled_languages":["en","da","de","es","fi","fr","it","hu","nl","no","pl","pt","ru","sv"],"languages":{"en":{"title":true,"content":true,"excerpt":false},"da":{"title":false,"content":false,"excerpt":false},"de":{"title":false,"content":false,"excerpt":false},"es":{"title":false,"content":false,"excerpt":false},"fi":{"title":false,"content":false,"excerpt":false},"fr":{"title":false,"content":false,"excerpt":false},"it":{"title":false,"content":false,"excerpt":false},"hu":{"title":false,"content":false,"excerpt":false},"nl":{"title":false,"content":false,"excerpt":false},"no":{"title":false,"content":false,"excerpt":false},"pl":{"title":false,"content":false,"excerpt":false},"pt":{"title":false,"content":false,"excerpt":false},"ru":{"title":false,"content":false,"excerpt":false},"sv":{"title":false,"content":false,"excerpt":false}}},"_links":{"self":[{"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/posts\/11208","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/comments?post=11208"}],"version-history":[{"count":1,"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/posts\/11208\/revisions"}],"predecessor-version":[{"id":11209,"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/posts\/11208\/revisions\/11209"}],"wp:attachment":[{"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/media?parent=11208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/categories?post=11208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/evosec.eu\/nl\/wp-json\/wp\/v2\/tags?post=11208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}