Hajime Botnet - ARM5 detects potential botnet command and control activity through suspicious ARM5-based communication patterns indicative of compromised devices. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage botnet infections before they escalate.
YARA Rule
rule Hajime_ARM5 : MALW
{
meta:
description = "Hajime Botnet - ARM5"
author = "Joan Soriano / @joanbtl"
date = "2017-05-01"
version = "1.0"
MD5 = "d8821a03b9dc484144285d9051e0b2d3"
SHA1 = "89ec638b95b289dbce0535b4a2c5aad90c169d06"
ref1 = "https://www.symantec.com/connect/blogs/hajime-worm-battles-mirai-control-internet-things/"
ref2 = "https://security.rapiditynetworks.com/publications/2016-10-16/hajime.pdf"
strings:
$userpass = "%d (!=0),user/pass auth will not work, ignored.\n"
$etcTZ = "/etc/TZ"
$Mvrs = ",M4.1.0,M10.5.0"
$bld = "%u.%u.%u.%u.in-addr.arpa"
condition:
$userpass and $etcTZ and $Mvrs and $bld and hash.sha1(0,filesize) == "89ec638b95b289dbce0535b4a2c5aad90c169d06"
}
This YARA rule can be deployed in the following contexts:
This rule contains 4 string patterns in its detection logic.
Scenario: System update or patching using WSUS (Windows Server Update Services)
Filter/Exclusion: process.parent_process != "wsus" || process.parent_process != "svchost.exe" && process.parent_process != "wuauserv.exe"
Scenario: Scheduled backup job using Veeam Backup & Replication
Filter/Exclusion: process.name != "veeambackup.exe" || process.parent_process != "veeambackup.exe"
Scenario: Admin task using PowerShell to configure network settings
Filter/Exclusion: process.name != "powershell.exe" || process.parent_process != "explorer.exe" && process.parent_process != "taskhost.exe"
Scenario: Legitimate remote management using Microsoft Remote Desktop Services (RDP)
Filter/Exclusion: process.name != "mstsc.exe" || process.parent_process != "explorer.exe" && process.parent_process != "taskhost.exe"
Scenario: Automated log collection using ELK Stack (Logstash)
Filter/Exclusion: process.name != "logstash.exe" || process.parent_process != "logstash.exe" && process.parent_process != "systemd.exe"