Masjescu malware aimed at tackling IoT devices

Masjescu malware aimed at tackling IoT devices while bypassing detection from state networks.

Malware types turn the victim's machine into a larger network, or Botnet, can be called many, but it is often difficult to detect because it often penetrates devices that cannot be monitored by common tools, such as IoT devices (Internet-of-Things), as in this news.

According to a report by the website Security Affair, it has mentioned the detection of Masjesu malware, a Botnet malware. As a result, it has been found to be very malicious from the outbreak and secretly embedded in various systems since 2023. 2566) Because it has always been able to drift in the system. This malware has a very high persistence within the system. It disguises the system file, such as / usr / lib / ld-unix.so 2, and installs the cron job, so that the malware can run again every 15 minutes. It can also turn off the necessary processes, such as wget, curl, sshd, and then lock the / tmp folder to complete control the machine.

Not only does the malware have the ability to reach a wide range of victims through the use of Createchildrenreplic () functions to scan for IP numbers of IoT devices, brands with random security vulnerabilities, covering D-Link, GPON, and Netgear, etc., but it also avoids accessing high-profile networks to evade detection. For example, the malware will evade access to government networks by evading entry into the IP Range of the United States Department of Defense, etc., by listing them on a blocking list, in addition to detecting them. During the more difficult to access the system, the method of concealing itself is also used with the XOR encryption of strings, settings, and malware files.

After the malware can be fully embedded on the system, it will contact the C2 or Command and Control server to receive a DDoS (Distributed Denial-of-Service) attack with Flood through protocols such as TCP, UDP, and HTTP. According to the commands received through the C2 server, the malware also has the ability to use the domain of many C2 servers with a Fallback IP number system, and also has the ability to download other payloads. The campaign in which this malware mobilizes victims' machines to attack large systems is very violent, capable of firing up to 290 Gbps. Traffic has found that this network of malware-infected machines is distributed in a variety of countries - Vietnam, Ukraine, Iran, Brazil, Kenya, and India. The attack targets game servers and networks of companies.

This malware was released as Rent or MaaS (Malware-as-a-Service), but it was advertised as a DDoS-for-Hire launch service. This malware was rented through the "Masjesu Botnet /" channel of hackers on the famous chat service Telegram. It is advertised as being embedded in a variety of IoT tools, such as routers and gateways. It also supports a variety of architectures, such as 386, MIPS, ARM, SPARC, PPC, 68K, and AMD64, etc.

# Trending # Lemon 8 Howtoo # lemon 8 diary # masjesu # freedomhack