# MA-1137.092024: MyCERT Advisory - Mirai Botnet Exploits Zero-Day Vulnerability in AVTECH IP Cameras

**Date:** 07 Sep 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1137.092024  
**Advisory ID:** MA-1137.092024

---

**1.0 Introduction**
Recently, there is a widespread Mirai botnet campaign exploiting a recent disclosed zero-day vulnerability in AVTECH IP cameras.
**2.0 Impact**
This vulnerability allows malicious actors to execute command injections remotely, granting them elevated privileges on the target system. Exploiting this vulnerability, attackers can deploy a variant of the notorious Mirai botnet, spreading malware with alarming efficiency.
**3.0 Affected Products**
- AVM1203: firmware version FuIIImg-1023-1007-1011-1009 and prior
**4.0 Indicators of Compromised (IOCs)IPv4 addresses**
93.123.39[.]72
93.123.39[.]87
93.123.39[.]111
147.78.103[.]177
185.216.70[.]37
94.156.8[.]185
93.123.39[.]173
74.50.81[.]158
94.156.71[.]74
93.123.85[.]213
185.216.70[.]142
45.66.231[.]148
185.216.70[.]79
**SHA256 hashes**
15a1d52c529d314bb2b5fa8b8bd6c6a496609a283dd0e78e595c929e720d1b5b (“r”)
c0ae1eb249705f61d45ca747c91c02a411557a28792f4064c1d647abb580bc10 (“x86”)
b0f7ef937d77061515907c54967a44da3701e0d2af143164bbf44bb4fc6f26af  (“sh”)
e82192fbe00bc7205abe786155bbfc0548f5c6ee9819a581e965526674f3cc57  (“mips”)
9e9e481bb448438572c2695469c85f773ddcd952025e45bee33bbfce2531c656  (“r”)
f4bf61fc335db4f3e7d7d89b534bc1e6ead66a51938e119ea340fe95039935e3  (“mips”)
22553be649f76a060ebbdfd410e295b66803e9c49d23369a726be2c5a25733ab  (“sh”
135264de24d499877e95673b9cca737e488042813f41fef7817728a704323fe2  (“r”)
6ad5984bc9af7af6962a080bbb1a35bb56e8671c4b9c1d44e88da5a3f6b9aa82  (“r”)
947f517d3b833cc046b2ea0540aad199b7777fb03057122fb0b618828abdc212  (“r”)
8ac82a770cffbbc8fba73554d7caa117ef6d37ffee468665b95bc406449f91b5 (“r”)
5e264cb009c4d84b6180e47b9ceda3af8897b17b88fccc9c2914706d66abd1d1  (“r”)
372eefdc4bf9f4a4382db2762fcf9a9db559c9d4fff2ee5f5cf5362418caaa92  (“r”)
3995a7e7eb8eeafb0b6da2c3813e61d11993a820d478c87809136de79d8f8280  (“sh”)
40d8f662c187b53fd6fdeb70db9eb262b707e557d3fa4e5e4eacaeaa03ac45f2  (“r”)
4826b0194fbd924aa57b9c4ab1e017f0f45f547189374b0ea761d415fa4285ff  (“x86”)
25945c4fe38ed2008f027bd1484b89867b23528c738812d317ddf57f48666b91  (“r”)
cfcae524309a220a48327c50bf32bf5ed3aed5698855b5da9f1ae932fb2df90c  (“x86”)
774947944ea370592a30478bb3f26081799f7d7df975a6735e620d3442e7803b  (“x86”)
06b1f09a62204472581e6aec381f96014bb6cc3fc1a9cef38bbcfe88bd82e499  (“r”)
4f50d318688c80f08eb7fad6f8788cae459c3420b3b9eb566f936edd7a780ae1  (“sh”)
c15bbfb85bfd8305fad8cc0e0d06cbe825e1e6fc6d8dbe5a8d1ac4243bd77d0c  (“x86”)
0a566c39ecbc4107f954cb3e5e240ccaf0018dfac9b5062b4db7971fb3d9f413 (“x86”)
2d7351aa765bb2feed9536cc392b2013361c193e99841c5b56591d988bd4b582  (“x86”)
5d58f0fa54784e9c90825cba9e2052f691cdcfe85b0796a6379982832563090d (“x86”)
**5.0 Recommendations**
CyberSecurity Malaysia urgers users and organization to review referrals, follow the Mitigation steps and apply the necessary updates. 
Kindly refer to the URL for more information: 
- <https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-07>
Generally, we advise users of this device to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999 through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17.30 MYT 
Web:[https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0    References**
- <https://www.cloudflare.com/learning/ddos/glossary/mirai-botnet/>
- <https://www.heise.de/en/news/Support-expired-Attacks-on-Avtech-IP-camera-observed-9852235.html>
- <https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-07>
- <https://www.bleepingcomputer.com/news/security/malware-exploits-5-year-old-zero-day-to-infect-end-of-life-ip-cameras/>
- <https://www.akamai.com/blog/security-research/2024/aug/2024-corona-mirai-botnet-infects-zero-day-sirt>