# MA-740.082019: MyCERT Alert - Alert on New Echobot Botnet Variant

**Date:** 15 Aug 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-740.082019  
**Advisory ID:** MA-740.082019

---

**1.0 Introduction**
MyCERT is aware of a new variant of Echobot botnet has been spotted to include over 50 exploits leading to remote code execution (RCE) vulnerabilities in various Internet-of-Things devices. Echobot is based on Mirai malware, like hundreds of other botnets that emerged once the source code became publicly available. It was first disclosed by researchers at Palo Alto Networks, who found it contained 18 exploits at the time. The latest Echobot variant was found by security researcher Carlos Brendel Alcañiz, and uses 59 different RCE exploits. The discovery been made after receiving weaponized code that targeted security flaws in Asus devices. The exploits found in this Echobot variant and the products that attacker target include an odd mix of hardware and software solutions: routers, cameras, smart home hubs, network-attached storage systems, servers, database management software, Zeroshell distribution. The malware author seems to have thrown in exploits without targeting a specific category of products. The code incorporated is available from multiple public exploit repositories.
**2.0 Impact**
The malware is one of the hundreds of spin-offs from Mirai botnet, whose code is publicly available, built for distributed denial-of-service attacks. This enables anyone to modify it to their own liking. It is unclear what the author of this variant is trying to achieve, but their endeavour definitely shows how easily one can pick up malicious code and adapt it to their own needs.
**3.0 Affected System and Devices**
|  | --- | --- | Affected System and Devices | CVE/Exploit | /SHARP PN-L703WA/Optoma WPS-Pro/Blackbox HD WPS/InFocus | [CVE-2019-3929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3929) | Alcatel-Lucent OmniPCX Enterprise 7.1 | [CVE-2007-3010](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3010) | ASMAX AR 804 gu Web Management Console | [CVE-2009-5156](https://nvd.nist.gov/vuln/detail/CVE-2009-5156) | ASUS DSL-N12E\_C1 1.1.2.3\_345 | [CVE-2018-15887](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15887) | Asus RT56U 3.0.0.4.360 | [CVE-2013-5948](https://nvd.nist.gov/vuln/detail/CVE-2013-5948) | Asustor ADM 3.1.2RHG1 | [CVE-2018-11510](https://nvd.nist.gov/vuln/detail/CVE-2018-11510) | AWStats 6.0 | [CVE-2005-0116](https://nvd.nist.gov/vuln/detail/CVE-2005-0116) | AWStats Totals 1.14 | [CVE-2008-3922](https://nvd.nist.gov/vuln/detail/CVE-2008-3922) | Barracuda | [CVE-2005-2847](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2847) | Beckhoff CX9020 CPU Module | [CVE-2015-4051](https://www.cvedetails.com/cve/CVE-2015-4051/) | Belkin Wemo UpnP | [CVE-2019-12780](https://nvd.nist.gov/vuln/detail/CVE-2019-12780) | BEWARD N100 H.264 VGA IP Camera M2.1.6 | Remote Code Execution | Citrix SD-WAN Appliance 10.2.2 | [CVE-2019-12989](https://nvd.nist.gov/vuln/detail/CVE-2019-12989) | Crestron AM/Barco wePresent WiPG/Extron ShareLink/Teq AV IT | [CVE-2019-3929](https://nvd.nist.gov/vuln/detail/CVE-2019-3929) | CTEK SkyRouter 4200/4300 | [CVE-2011-5010](https://nvd.nist.gov/vuln/detail/CVE-2011-5010) | Dell KACE Systems Management Appliance (K1000) 6.4.120756 | [CVE-2018-11138](https://nvd.nist.gov/vuln/detail/CVE-2018-11138) | D-Link | [CVE-2013-7471](https://nvd.nist.gov/vuln/detail/CVE-2013-7471) | Dogfood CRM | spell.php’ Remote Command Execution | EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 | Remote Code Execution | EyeLock nano NXT 3.5 | Remote Code Execution | FLIR Thermal Camera FC-S/PT | Command Injection | FreePBX 2.10.0 / Elastix 2.2.0 | [CVE-2012-4869](https://nvd.nist.gov/vuln/detail/CVE-2012-4869) | Fritz!Box Webcm | [CVE-2014-9727](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9727) | Geutebruck 5.02024 G-Cam/EFD-2250 | [CVE-2017-5173](https://nvd.nist.gov/vuln/detail/CVE-2017-5173) | Gitorious | Remote Command Execution | HomeMatic Zentrale CCU2 | [CVE-2018-7297](https://nvd.nist.gov/vuln/detail/CVE-2018-7297) | Hootoo HT-05 | [CVE-2018-20841](https://nvd.nist.gov/vuln/detail/CVE-2018-20841) | HP OpenView Network Node Manager 7.50 | [CVE-2005-2773](https://nvd.nist.gov/vuln/detail/CVE-2005-2773) | Iris ID IrisAccess ICU 7000-2 | Remote Root Command Execution | LG SuperSign EZ CMS 2.5 | [CVE-2018-17173](https://nvd.nist.gov/vuln/detail/CVE-2018-17173) | Linksys WAG54G2 | [CVE-2009-51571](https://nvd.nist.gov/vuln/detail/CVE-2009-3555) | MiCasaVerde VeraLite | [CVE-2016-6255](https://nvd.nist.gov/vuln/detail/CVE-2016-6255) | Mitel AWC | Command Execution | Nagios 3.0.6 | [CVE-2009-2288](https://nvd.nist.gov/vuln/detail/CVE-2009-2288) | NETGEAR R7000 / R6400 | [CVE-2016-6277](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6277) | NETGEAR ReadyNAS Surveillance 1.4.3-16 | [CVE-2017-18377](https://nvd.nist.gov/vuln/detail/CVE-2017-18377) | NUUO NVRmini | [CVE-2018-14933](https://nvd.nist.gov/vuln/detail/CVE-2018-14933) | OP5 5.3.5/5.4.0/5.4.2/5.5.0/5.5.1 | [CVE-2012-0262](https://nvd.nist.gov/vuln/detail/CVE-2012-0262) | op5 7.1.9 | Remote Command Execution | OpenDreamBox 2.0.0 Plugin WebAdmin | [CVE-2017-14135](https://nvd.nist.gov/vuln/detail/CVE-2017-14135) | Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 | [CVE-2019-2725](https://nvd.nist.gov/vuln/detail/CVE-2019-2725) | PHPMoAdmin | [CVE-20180-2208](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2208) | Plone and Zope | [CVE-2011-3587](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3587) | QuickTime Streaming Server | [CVE-2003-0050](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0050) | Realtek SDK | [CVE-2014-8361](https://nvd.nist.gov/vuln/detail/CVE-2014-8361) | Redmine SCM Repository 0.9.x/1.0.x | [CVE-2011-4929](https://www.cvedetails.com/cve/CVE-2011-4929/) | Rocket Servergraph Admin Center | [CVE-2014-3914](https://www.cvedetails.com/cve/CVE-2014-3914/) | SAPIDO RB-1732 | Remote Command Execution | Schneider Electric U.Motion Builder 1.3.4 | [CVE-2018-7841](https://nvd.nist.gov/vuln/detail/CVE-2018-7841) | Seowonintech Devices | [CVE-2016-10760](https://nvd.nist.gov/vuln/detail/CVE-2016-10760) | Spreecommerce 0.60.1 | Arbitrary Command Execution | Ubiquity Nanostation5 (Air OS) | [CVE-2010-5330](https://nvd.nist.gov/vuln/detail/CVE-2010-5330) | Vmware NSX SD-WAN Edge | [CVE-2018-6961](https://nvd.nist.gov/vuln/detail/CVE-2018-6961) | WePresent WiPG-1000 | [CVE-2019-3929](https://nvd.nist.gov/vuln/detail/CVE-2019-3929) | Wireless IP Camera (P2P) WIFICAM | [CVE-2017-18377](https://nvd.nist.gov/vuln/detail/CVE-2017-18377) | Xfinity Gateway | Remote Code Execution | Yealink VoIP Phone SIP-T38G | [CVE-2013-5758](https://nvd.nist.gov/vuln/detail/CVE-2013-5758) | ZeroShell 1.0beta11 | [CVE-2009-0545](https://nvd.nist.gov/vuln/detail/CVE-2009-0545) |
**4.0 Known Indicator of Compromise (IOC)**
SHA256:
- d30f4827ec6a245a1acaaa3b6275c65a899747614fe1d807a9fc127198c700ab
IP address:
- 31.13.195.251
**5.0 Recommendations**
We recommend user and administrator to apply necessary action to secure and manage affected system:
- Ensure anti-virus software and associated files are up to date.
- Search for existing signs of the indicated IOCs in your environment.
- Configure firewalls to block access to known malicious domains and IP addresses.
- Update software and operating systems with the latest patches. Outdated applications and operating systems are the target of most attacks.
- Backup data on a regular basis. Keep it on a separate device and store it offline.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
- <https://www.bleepingcomputer.com/news/security/new-echobot-botnet-variant-uses-over-50-exploits-to-propagate/>
- <https://blogs.akamai.com/sitr/2019/06/latest-echobot-26-infection-vectors.html>
- <https://www.zdnet.com/article/new-echobot-malware-is-a-smorgasbord-of-vulnerabilities/>