February 9, 2017 By Larry Loeb 2 min read

The Mirai bot that runs on the Linux operating system developed a new way to use Windows to further its malicious aims, security researchers found.

According to Bleeping Computer, researchers from Russian cybersecurity firm Dr. Web found a Windows Trojan designed to help spread the Mirai malware. This is an unusual development since Mirai had previously propagated only from Linux systems.

A New Way to Spread Mirai Malware

Even though the actual Mirai bot will not run on a Windows machine, the Trojan can perform some of the work the bot might otherwise have to do on its own to find its victims. The Windows Trojan amplifies the overall Mirai infection with additional processing power.

The Trojan infects Linux-running machines it discovers with the Mirai bot. If it encounters a Windows system, it inserts the Trojan code instead. Both systems can be infected, just with different payloads.

If the Trojan finds a database to infect, such as MS SQL or MySQL, it will try to create a new user that possesses admin privileges. Such a user could exfiltrate the information in that database, putting valuable information directly in the hands of the cybercriminal.

A Brute-Force Attack on the Internet

The classic Mirai botnet starts its quest for worldwide domination by selecting a random IP address. It then attempts to log into that IP address via the Telnet or SSH port using a list of default admin credentials.

In many ways, Mirai’s propagation method alone is a brute-force attack on the internet. The malware authors experience no downside to their incessant pinging of IP addresses — it only enables them to identify more potential victims. This is where the Windows Trojan comes in: It can check IP addresses for the bot and return any positive results to the malware’s command-and-control (C&C) servers for final instructions.

Additionally, Windows version of Mirai uses different ports than the Linux version to self-propagate. It can use ports 22 (Telnet), 23 (SSH), 135 (DCE/RPC), 445 (Active Directory), 1433 (MSSQL), 3306 (MySQL) and 3389 (RDP) in its effort to reproduce, Bleeping Computer noted.

Dr. Web researchers only found the Trojan in the last month, which means security professionals must be on high alert.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today