Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Vizio Palevo/BFBot/Mariposa Alarm SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Vizio Palevo/BFBot/Mariposa Alarm
Vizio television model E550i_A0 V2.19.6.0608 creating regular (monthly) "ET TROJAN Palevo/BFBot/Mariposa client join attempt" alarms. Other Vizio models are on network and do not cause same alarms. Only Internet communication noted is *.amazonaws.com and time-a.timefreq.bldrdoc.gov

Destination IP 255.255.255.255
UDP Source Port:7776 Dest Port:7776
Data: 614c3b5e254046

Anyone else seen this behavior from a Vizio device?
Anonymous

Yes! I am seeing the same thing on my Vizio TV. It looks like a single broadcast packet on UDP 7776 is causing it. I'm not sure what the TV is trying to do that's setting this off. Anonymous

-

Sign Up for Free or Log In to start participating in the conversation!