In the new to me department. It looks like this one has been around for more than three years. Today I was doing some banner grabbing looking for a Mirai node that had gotten away from me, and came across the Telnet banner below. It appears this device is infected with a piece of malware called Reincarna/Linux.Wifatch. It purports to being a memory resident malware that defends the device from more malicious malware. More information about reincarna/Linux.wifatch from Symantec. Symantec's write-up states that the malware provides a backdoor and connects back to a Command and Control server, so maybe not so benevolent after all. -------------------------------------- # telnet X.X.X.X REINCARNA / Linux.Wifatch Your device has been infected by REINCARNA / Linux.Wifatch. We have no intent of damaging your device or harm your privacy in any way. Telnet and other backdoors have been closed to avoid further infection of This software can be removed by rebooting your device, but unless you take This remote disinfection bot is free software. The source code Team White --------------------------------- -- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected) |
Rick 324 Posts ISC Handler Nov 11th 2016 |
Thread locked Subscribe |
Nov 11th 2016 5 years ago |
The first Carna botnet was used in 2012 to generate the Internet Census. https://en.wikipedia.org/wiki/Carna_botnet s http://internetcensus2012.bitbucket.org/paper.html
|
Anonymous |
Quote |
Nov 11th 2016 5 years ago |
Sign Up for Free or Log In to start participating in the conversation!