NTRG_ElasticBotnetReport_06102015

2. ELKNOT FAMILY ANALYSIS
Novetta has observed two subfamilies of the Elknot malware being deployed in relation to the
Elasticsearch attacks. The first subfamily of Elknot is a two-stage binary consisting of a dropper
binary (“the dropper”) and its embedded payload (“the payload”). The second subfamily of Elknot is
a single-stage binary, which itself consists of two variants (“Variant A” and “Variant B”). The payload
of the Elknot dropper subfamily matches Variant A of the Elknot payload subfamily. Despite the
commonalities between the Elknot subfamilies (and their variants), the two subfamilies of Elknot
have been segregated because they represent not only different deployment methods, but also use
different builders as illustrated below.
The following sections will analyse the dropper subfamily’s binary, the binaries of payload subfamily’s
Variant A and Variant B, as well as key details regarding the dropper’s builder (“the builder”).
2.1 DROPPER’S BUILDER ANALYSIS
Source Samples SHA-256s:
185251b437d3935a5d6e92a49e07a3c2f95289156a6bbe54df3cb771d78affa3,
0c9107b2742705fa1834fd7e8beaa3778f6f1ba1e38fd3eb30b1aeac30c7a1de,
58d7343dfa554e8847c8d3ff07ef4b2a449c57c426a0ba62584d6deb06992842,
62fa123912eaa226babe46a6adef06638432fa2b3758c1e3cc7aca873c947fe6
THE ELASTIC BOTNET REPORT
4