While doing some background research into recent reporting by Dr Web on a newly identified version of Mirai, we made an interesting discovery. VirusTotal behavioural analyses for the Windows Mirai hashes provided by Dr Web indicated that each sample used HTTP GET requests to download text files from three subdomains on what appeared to be a threat actor controlled site (f4321y[.]com). Each sample also used HTTP GET requests to request the infected hosts IP from pubyun[.]com and, significantly, to download an image file from a Chinese social media site. Interest piqued, we took a look at the file and discovered that it was an image of Taylor Swift carrying an embedded portable executable (PE) file. Examination of the PE indicated that it was a malicious executable named WPD.exe, which was found to be classified as a remote access trojan (RAT).
Figure 1 – Image downloaded by Windows Mirai malware samples.
We decided to dig a little further and examine the passive DNS data for the C2 domain identified by Dr Web. This indicated that it was hosted on and IP address which also hosts another domain (mykings[.]pw) with three subdomains named identically to those on the Windows Mirai C2 domain. Further examination turned up 25 further malware samples which were found to behave very similarly to those identified by Dr Web. All sent HTTP GET request to request host IPs from pubyun[.]com and to download text files from subdomains of mykings[.]pw. Several of these samples were also found to be sending DNS requests to f4321y[.]com. In addition to these behaviors, many of these samples also pulled identical images of Taylor Swift carrying a second malicious PE file from another Chinese social media site. The chart below provides a graphical representation of these connections.
Figure 2 – Link chart of entities involved in malware delivery campaign.
Based on the information we’ve been able to assemble, it appeared likely that whoever was responsible for the Windows Mirai operation identified by Dr Web has also been using linked infrastructure (and pictures of Taylor Swift) to distribute and operate a RAT and at least 25 other malware samples. The scale of this distribution operation was not known at the time of writing, but compilation and signature signing timestamps on many of the malicious files indicated that many of the malicious executables identified were created in February 2017, suggesting that at the time of writing, this element of the distribution operation was relatively recent. It remains to be seen whether any further information on this campaign will Swiftly emerge.
IOC appendix
Windows Mirai samples identified by Dr Web
9575d5edb955e8e57d5886e1cf93f54f52912238
f97e8145e1e818f17779a8b136370c24da67a6a5
42c9686dade9a7f346efa8fdbe5dbf6fa1a7028e
938715263e1e24f3e3d82d72b4e1d2b60ab187b8
Image files
1a606f84d7d9cb247a733db0d1f970436064da512603a207d17b7b79dd1af538
9e416e2412e70fdb599b80af5d4a73b762b7d771fcdef32ed3ff280813b58d9b
PE files
4554f2e9c3f1e25186716e597a29d2b7ae141c228dc851200839a4e6c149c5ba
115b8d3f908c01c185e2b1b9b3389bc6501860de97b4f232b848445a3e48cc85
4856706c088f66965d714fe09af22ee56d84483278582ff3dd8f98bc3c5862ab
bdad4a77b678fda8328b2fae290e525a553c490214d43df377dbeb3132879673
93bf864cfc6540e7fa4dd416373e3173ef613f5a7680bd395ba362e3bbff3d1c
2de4851dcaaa4b5ed8421a0c72ceed64497c147d85cbfb1928d6baf7760c0c46
301ef54e284864b246010bd085fb5d12ca8e6fd92daaa362e60f64af2d9c194a
2d8cd23e33e56ab396960a0d426c232f6d8905e2ac5833f37c412b699135f6ce
C2 infrastructure
f4321y[.]com
mykings[.]pw
60[.]250[.]76[.]52
Malware linked to identified C2
210986d3d18f6cebba30d85e3d89d559
62270a12707a4dcf1865ba766aeda9bc
3ee9f93e1f8515c44411530d6d902dbf
93ccd8225c8695cade5535726b0dd0b6
5707f1e71da33a1ab9fe2796dbe3fc74
10164584800228de0003a37be3a61c4d
481aa11eb5504ab70dc02d5c829b9199
bce5c1569b6f44dac35d14cd2c5e44f8
1713d083aafbf7e8408e6cedfed42524
2d411f5f92984a95d4c93c5873d9ae00
8008aa6cc33086f0c5f055f0a2ff6e4e
55d860d8d21dd7ab051084beb61abd45
43e7580e15152b67112d3dad71c247ec
9098e520c4c1255299a2512e5e1135ba
e7761db0f63bc09cf5e4193fd6926c5e
297d1980ce171ddaeb7002bc020fe6b6
c88ece9a379f4a714afaf5b8615fc66c
c289c15d0f7e694382a7e0a2dc8bdfd8
a3c09c2c3216a3a24dce18fd60a5ffc2
fb7b79e9337565965303c159f399f41b
91a12a4cf437589ba70b1687f5acad19
104917a5a5671daec0bcc73f884d8ba3
ad0496f544762a95af11f9314e434e94
9fd02ee6c10fef2dcc365a6d9077f614
7fa0227ff6f5d077b11d7eba8fa8e398