Monday, July 15, 2024

Hajime Worm wrestle with Mirai Botnet to Control of your IoT Devices

[jpshare] Hajime Worm First Discovered on  October  2016 and it used to spreads via unsecured devices with self-replication module that have open Telnet ports and use default passwords.

Hajime Worm Battle with Mirai Botnet indicate that ,Hajime was specifically created to protect against Mirai .

According to Symantec  ,Unlike Mirai, which uses hardcoded addresses for its command and control (C&C) server, Hajime is built on a peer-to-peer network.

“There isn’t a single C&C server address, instead the controller pushes command modules to the peer network and the message propagates to all the peers over time”

After contacts  C&C server address , it returns a cryptographically-signed message every ten minutes. The message, which is displayed on the device’s terminal .

Just a white hat, securing some systems.
Important messages will be signed like this!
Hajime Author.
Contact CLOSED
Stay sharp!

The malware’s Author didn’t include a DDoS highlight, didn’t utilize his botnet to malicious traffic activity, or some other nosy operation.

Hajime is also stealthier and more advanced in comparison to Mirai. Once on an infected device, it takes multiple steps to conceal its running processes and hide its files on the file system.

Hajime Replicating  Quickly:

According to the Symantec  Tracking Report, past Few month it spreading very fast and Target the DVRs, CCTV systems, and other poorly-protected Internet of Things (IoT) devices.

                                           Image Credits: Symantec

Symantec Researcher ,Waylon Grange said, ,once Hajime infects a device it blocks access to ports 23, 7547, 5555, and 5358, which are all ports that have been exploited in the past by IoT malware.

Once Hajime Hide its file in infected systems,The author can open a shell script to any infected machine in the network at any time, and the code is modular, so new capabilities can be added .

Doesn’t have (DDoS) capabilities :

Reason Behind of the worm, it does not have any distributed denial of service capabilities .

For the past six months, Hajime has been using its self-replication module to fight with Mirai and other IoT botnet for control over IoT devices.

Hajime is an enemy of  Mirai Botnet:

Hajime was specifically created to protect against Mirai ,All pieces of information indicate the conclusion that Hajime was made to specifically attack Mirai, and  reduce the number of devices Mirai can infect.

Hajime Act as White Hat and powerful than Mirai .These white worms is that they usually turn out to have a short lifespan.

Symantec Said ,”To have a lasting effect, the firmware would need to be updated. It is extremely difficult to update the firmware on a large scale because the process is unique to each device and in some cases is not possible without physical access.”

Also Read:


Latest articles

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...

ViperSoftX Weaponizing AutoIt & CLR For Stealthy PowerShell Execution

ViperSoftX is an advanced malware that has become more complicated since its recognition in...

Malicious NuGet Campaign Tricking Developers To Inject Malicious Code

Hackers often target NuGet as it's a popular package manager for .NET, which developers...

Akira Ransomware Attacking Airline Industry With Legitimate Tools

Airlines often become the target of hackers as they contain sensitive personal and financial...

DarkGate Malware Exploiting Excel Files And SMB File Shares

DarkGate, a Malware-as-a-Service (MaaS) platform, experienced a surge in activity since September 2023, employing...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles