Trusted Design

Defaulting on Passwords (Part 1): r0_bot

概要

Early in March, while studying the ChinaZ threat, it became readily apparent that default passwords were being used for more than just a supplementary attack vector. Several bots relied heavily, if not exclusively, on systems with weak and/or default passwords to spread. We setup a system with weak and default passwords to capture any and all malware spread in this fashion. For this first test, I selected 5 sets of passwords; admin/admin, guest/guest, ubnt/ubnt, cisco/cisco and ADMIN/ADMIN (the last for picking up folks scanning for Supermicro IPMI devices). Unsurprisingly, it took just under 3 hours for the first infection to hit. What did surprise us though was what password combination was first to be hit; ubnt/ubnt.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - 86fbdd7df9486a17e9c408c7e50635e26402fdf297c9e97f1a5256100401dcc5 -
• URL - http://46.228.204.44/r0r/index.php -
• FileHash-SHA256 - 9c2848962733846bf50b490fd8f6c7ce9ecade2d3f2f530f5ecbba283af87d3a -
• FileHash-SHA256 - 5c8c41253aa68adeb955e7d1c7b8e084e06537f75eff12c3f3a0f3cb30cb2152 -
• FileHash-SHA256 - 0ffa9e646e881568c1f65055917547b04d89a8a2150af45faa66beb2733e7427 -

類似Pulses

• Necurs Botnet Returns With Updated Locky Ransomware In Tow (score: 0.54)
• Exploring a P2P Transient Botnet - From Discovery to Enumeration (score: 0.51)
• MajikPOS Combines PoS Malware and RATs to Pull Off its Malicious Tricks (score: 0.50)
• GamaPoS: The Andromeda Botnet Connection (score: 0.50)
• Without Necurs, Locky Struggles (score: 0.50)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る