Hajime (malware)

Short description: Computer malware

Hajime[1]Written in| C[2]

|

Operating system| Linux[3]
Type| Botnet[4]

Hajime (Japanese for "beginning") is a malware which appears to be similar to the Wifatch malware in that it appears to attempt to secure devices.[5] Hajime is also far more advanced than Mirai, according to various researchers.[6]

The top countries infected by the malware were Iran, Brazil, Vietnam, Russia and Turkey, followed by India, Pakistan, Italy and Taiwan.[7]

## Malware

Hajime is a worm according to sources which have placed research on the subject.[8] It appears to have been discovered as early as October 2016.[9]

Later in April 2017, Hajime generated large media coverage as it appeared to be in competition with Mirai.[10] This led to a number of reports which compared and noted that it appeared to have a similar purpose to Linux.Wifatch.[11] It also did not contain any modules or tools for denial of service attacks, but instead only contained methods for extending its reach.[12]

Hand written assembly code specifically for several platforms was also discovered by researchers as well.[13]

Hajime is similar to Mirai in its method of how it manages to compromise systems.[14] One of the key differences with Mirai is that it uses a peer-to-peer network for communications.[15]

What was also noted was the message the malware left on systems it compromised.[16] The message left on systems compromised by Hajime displayed on terminals is shown below.[17]

Just a white hat, securing some systems.

Important messages will be signed like this!
Hajime Author.
Contact CLOSED Stay sharp!

[18]

## See also

* BASHLITE – another notable IoT malware
* Denial-of-service attack
* Linux malware
* Linux.Darlloz – another notable IoT malware
* Remaiten \- another IoT DDoS bot

## References

1. ↑ Arghire, Ionut (April 26, 2017). "Mysterious Hajime Botnet Grows to 300,000 IoT Devices: Kaspersky". securityweek.com. http://www.securityweek.com/mysterious-hajime-botnet-grows-300000-iot-devices-kaspersky. Retrieved 14 October 2017.
2. ↑ Cimpanu, Catalin (October 18, 2016). "Hajime IoT Worm Considerably More Sophisticated than Mirai". Softpedia. http://news.softpedia.com/news/hajime-iot-worm-considerably-more-sophisticated-than-mirai-509423.shtml. Retrieved 13 October 2017.
3. ↑ Kan, Michael (April 17, 2017). "IoT malware clashes in a botnet territory battle". PC World. https://www.pcworld.com/article/3190182/security/iot-malware-clashes-in-a-botnet-territory-battle.html. Retrieved 13 October 2017.
4. ↑ Leyden, John (27 April 2017). "Mysterious Hajime botnet has pwned 300,000 IoT devices". The Register. https://www.theregister.co.uk/2017/04/27/hajime_iot_botnet/. Retrieved 14 October 2017.
5. ↑ Grange, Waylon (18 April 2017). "Hajime worm battles Mirai for control of the Internet of Things". Symantec. https://www.symantec.com/connect/blogs/hajime-worm-battles-mirai-control-internet-things. Retrieved 13 October 2017.
6. ↑ Paganini, Pierluigi (April 20, 2017). "Symantec is monitoring the Hajime IoT malware, is it the work of vigilante hacker?". securityaffairs.co. http://securityaffairs.co/wordpress/58151/malware/hajime-iot-malware.html. Retrieved 13 October 2017.
7. ↑ "300,000 obeying devices: Hajime is conquering the Internet of Things world" (in en). 26 May 2021. https://www.kaspersky.com/about/press-releases/2017_300000-obeying-devices-hajime-is-conquering-the-internet-of-things-world.
8. ↑ Vatu, Gabriela (April 21, 2017). "IoT Malware Hajime Fights Against Mirai, Tries to Secure Devices". Softpedia. http://news.softpedia.com/news/iot-malware-hajime-fights-against-mirai-tries-to-secure-devices-515037.shtml. Retrieved 13 October 2017.
9. ↑ Vatu, Gabriela (April 27, 2017). "Vigilante IoT Worm Hajime Infects 300,000 Devices". Softpedia. http://news.softpedia.com/news/vigilante-iot-worm-hajime-infects-300-000-devices-515233.shtml. Retrieved 13 October 2017.
10. ↑ Spring, Tom (April 21, 2017). "Mirai and Hajime Locked Into IoT Botnet Battle". threatpost. https://threatpost.com/mirai-and-hajime-locked-into-iot-botnet-battle/125112/. Retrieved 13 October 2017.
11. ↑ Cimpanu, Catalin (April 19, 2017). "Vigilante Hacker Uses Hajime Malware to Wrestle with Mirai Botnets". Bleeping Computer. https://www.bleepingcomputer.com/news/security/vigilante-hacker-uses-hajime-malware-to-wrestle-with-mirai-botnets/. Retrieved 13 October 2017.
12. ↑ Millman, Rene (April 28, 2017). "Hajime malware now has 300,000 strong botnet at disposal say researchers". scmagazineuk.com. https://www.scmagazineuk.com/hajime-malware-now-has-300000-strong-botnet-at-disposal-say-researchers/article/653516/. Retrieved 13 October 2017.
13. ↑ Edwards, Sam; Profetis, Ioannis (16 October 2016). "Hajime: Analysis of a decentralized intern et worm for IoT devices". rapiditynetworks.com. https://security.rapiditynetworks.com/publications/2016-10-16/hajime.pdf. Retrieved 14 October 2017.
14. ↑ Arghire, Ionut (April 20, 2017). "White Hat Hacker Created Mysterious IoT Worm, Symantec Says". securityweek.com. http://www.securityweek.com/white-hat-hacker-created-mysterious-iot-worm-symantec-says. Retrieved 14 October 2017.
15. ↑ Khandelwal, Swati (April 26, 2017). "Hajime 'Vigilante Botnet' Growing Rapidly; Hijacks 300,000 IoT Devices Worldwide". thehackernews.com. https://thehackernews.com/2017/04/vigilante-hacker-iot-botnet_26.html. Retrieved 14 October 2017.
16. ↑ "Hajime Botnet – Friend or Foe?". radware.com. 26 April 2017. https://security.radware.com/ddos-threats-attacks/hajime-iot-botnet/. Retrieved 14 October 2017.
17. ↑ Khandelwal, Swati (April 19, 2017). "To Protect Your Devices, A Hacker Wants to Hack You Before Someone Else Does". thehackernews.com. https://thehackernews.com/2017/04/vigilante-hacker-iot-botnet.html. Retrieved 14 October 2017.
18. ↑ Paganini, Pierluigi (April 27, 2017). "The Hajime Botnet continues to grow and implements a new attack technique". securityaffairs.co. http://securityaffairs.co/wordpress/58415/malware/hajime-botnet.html. Retrieved 14 October 2017.

* v
* t
* e

IoT Malware

Notable IoT malware|

* BASHLITE
* BrickerBot
* Carna
* Hajime
* Linux.Darlloz
* Linux.Wifatch
* Mirai
* Remaiten

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Hajime (malware). Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Software:Hajime_(malware)&oldid=746895"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template