New Mirai Variant Abuses WebSVN Vulnerability

Making the headlines

• Researchers have disclosed that the malware shares some of its code with Mirai and was being used for launching DDoS attacks.
• Eight types of attacks can be used against different targets (such as OVH or TCP protocol).
• While exploiting the WebSVN vulnerability, hackers may not get some details of the target environment, such as operating system and processor architecture. However, the shell script used in the further step of the attack overcomes this issue.

How it works

• The malware has malicious Linux binaries for 12 different architectures. 
• Rather than identifying which one is correct for the target environment, it attempts brute force technique to run the binaries.
• To limit the size of the executable files, each one is compressed with a modified version of UPX. Moreover, the packer is modified and recurs more effort to examine. 
• Additionally, the malware archives portability by statically connecting all of its dependencies and making system calls inside the code. It tries to connect to its C2 server on port 666.

Conclusion