Botnet continue to exploit vulnerabilities and CAPSAICIN botnet analysis

 

Summary

Back to December 26, 2024, FortiGuard Labs noticed a new variant called "CAPSAICIN" frequently spread through documented D-Link vulnerabilities that allow remote attackers to execute malicious commands like downloading payloads, killing botnets processes, DDoS attacking, telnet scanning, and installing binaries in victim hosts.

Analysis

 

Why call the botnet named “CAPSAICIN”?

CAPSAICIA bot named from malware inside strings

Figure1-special strings

 

 

The PRIVMSG function implies that “CAPSAICIN” includes more functions and relative commands as follows.

Figure2-command for “CAPSAICIN”

Like the other botnet, “CAPSAICIN” kills known botnets processes to ensure it is the only botnet executing on the victim host.

Figure3-pkill -9 known bots

 

AK47SCAN: Ak47telscan for cracking telnet using open-source projects as follows.

Figure4-ak47telscan execute

 

How to get a payload from a remote machine?

Supporting multiple ways like wget, tftp, and ftpget for payload download.

Figure5-multiple ways for payload download

 

How many ways is “CAPSAICIN” doing DDoS attacking?

DDoS supports multiple methods like STD, UNKNOWN, HTTP, HOLD, JUNK, BLACKNURSE, and DNS.

Figure6-DDoS flooding multiple ways

C2 server 45[.]86[.]86[.]60

Figure7-C2

 

 

IOCs:

C2 45[.]86[.]86[.]60

CAPSAICIN 61e7d18a4efdd3273fe436a0d66da732

Payload download link http[:]//pirati.abuser.eu/yak.sh

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

‘BotenaGo’ Malware Targets Multiple Routers with 30+ Exploit Functions and Go Reversing Analysis

 

Summary

 

Back to November 11, 2021, AT&T Alien Labs had found new malware written in the open-source programming language Golang. Deployed with more than 30 exploits, it had the potential of targeting millions of routers and IoT devices. After that, LevelBlue Labs first published research on their discovery of new malware written in the open-source programming language Golang to GitHub.

But this blog does not go to open-source analysis and still does Go reversing.

Recently, you know lots of malware turned to Go field, which is the new challenge.

Malware itself Key.

1. 30+ different exploit functions and different router versions

2. Support backdoor with telnet and reverse shell httpd

3. Not found DDos attack module inside

4. Plain text string in malware

 

Analysis

 

As you know, BotenaGo malware is the type of botnet, but when we face a new malware, we have to analyze what happened in the malware itself.

Obviously, lots of infection functions to vendors like Dlink, ZTE, Tenda, RealTek, and so on; there are some different versions, such as DlinkTwo, DlinkThree, DlinkFour, DlinkFive, DlinkSix, DlinkSeven, and DlinkEight. It told us the attacker was very familiar with different router vendors and deeply researched different versions.

Figure1- infection function to vendors

 

Those 30+ different exploit functions are relative to the GET and POST methods, which are the attacking paths. the CVE vulnerability that comes from those strings.

Figure2- GET strings for exploit functions

Figure3- POST strings for exploit functions

 

The main_scannerInitExploits structure is very clear, and similarly for each infect function to Add and Change.

Figure4- infect functions are similarly

Support backdoor with telnet loader and reverse shell loader

Figure5- backdoor loader

It creates a shell with port in hex 7AB4h (31412) and listens.

Figure6- shell port 7AB4h

 

One of the malware payload download links is as follows.

Figure7- payload download link

 

The other IOCs can collect from plain text strings with the key “wget” search.

 

IoCs

29cb03edd8b97afe1d3d95c0fc6fa249

e7b30c7cc5e9bf272b91fe084233d7a4

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

CoinMiner embedded lots of vulnerabilities to exploit

 

This coinMiner family is very classical, which the sample itself embedded lots of vulnerabilities to exploit, yeah, there are N-day. I just introduced one of them with static analysis; here we go.

The sample

(SHA256: 128452242b0ff64f746759e106ce84b998c0b7807380a1f50975ceb8eada430e)

The sample packed with the packer: UPX (3.96).

Figure 1 – packer:UPX(3.9.6)

Try the UPX tool to unpack, and the language is Go. Yeah, the Go language is so popular with malware development.

Figure 2 – the sample compiler with Go

Ok, let’s move to static analysis. Good luck!

Some function name strings like “shell_exploit” were very attractive.

Figure 3 – shell_exploit_* strings

 

Here, choosing “_b42207_” randomly for analysis.

Figure 4 – shell_exploit_ptr_b42207_*

 

In the function “shell_exploit__ptr_b42207_run,” you can find an interesting and key string: “/securityRealm/user/admin/.”

Figure 5 – CVE-2018-1000861: key strings

The complete strings are as follows:

Figure 6 – CVE-2018-1000861 complete string for EXP

It is CVE-2018-1000861, which is the Jenkins remote command injection.

Of course, the other vulnerabilities can check it out like that; lots of work needs to be done until you can get a table list.

 

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

Hive ransomware command-line parameters analysis

 

Back to July 22, 2022, I noted that Hive ransomware gets upgrades in Rust by Microsoft Threat Intelligence (Hive ransomware gets upgrades in Rust | Microsoft Security Blog).

The report mentioned that Unlike in previous variants where there was a ‘help’ menu, in the new variant, the attacker must know the parameters beforehand. Since all strings are encrypted, it makes finding the parameters challenging for security researchers.

Getting the command-line parameters is very challenging for beginners, but recently I wanted to challenge myself.

I choose the sample (SHA-256: 33744c420884adf582c46a4b74cbd9c145f2e15a036bb1e557e89d6fd428e724) to debug.

The sample won’t continue its execution, but it will also tell key information to the analyst.

The first thing is the sample has to handle input from the user.

the second thing it prints is an error

Figure 1 – Without a username and a password, the sample won’t continue its execution

The sample uses the function “GetCommandLineW” to get command-line parameters.

Figure 2 – “GetCommandLineW” for getting paramters

Beginning before we change the command line first with any short string like the “xx,” which makes running error

Figure 3 – change the command line with appending string “xx”

And now let’s debug using “GetCommandLineW” to set a breakpoint and make it run there as follows:

Figure 4 – set breakpoint with GetCommandLineW

From here, we will debug step by step and be more patient, and finally we will find all parameters like –da, –wmi, and –min-size.

Figure 5 – -da parameter

Figure 6 – -wmi and –min-size parameter

Different variants have different parameters.

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

Unveiling Gelsemium’s (毒狼草) Linux backdoor WolfsBane

 

Back to Dec 19, 2024, I noted that ESET researchers analyzed previously unknown Linux backdoors (Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine).

I was attracted by the part of the WolfsBane backdoor, stored in a file named udevd, which embedded libMainPlugin. so, libUdp.so and libHttps.so.

I tried to extract those above three so files, and now let’s do it.

We need the malware sample named udevd, the hash sha1 0AB53321BB9699D354A032259423175C08FEC1A4.

Which came from the first archive, the hash sha1 f1df0c5a74c9885cb5934e3eee5e7d3cf4d291c0

udevd is an ELF file.

And search. so can see the above three so file module: libMainPlugin.so, libUdp.so, and libHttps.so

Let’s debug udevd with dbg, be patient, and finally jump here.

Yeah, we note that the key function is memcpy and the EmbeddedResource, which did deserialize the input archive and copy them to memory.

We just need to dump the three so files from memory.

First: find out the start address and how many bytes they are.

Second: write a Python script to dump as the following

Finally, we can successfully get libMainPlugin. so, libUdp.so and libHttps.so

The backdoor encrypts the libMainPlugin.So the library using the RC4 algorithm saves it to <work_directory>/X1l/data/gphoto2.

libUdp.so and libHttps.so provide C&C communications via UDP and HTTPS protocols.

IoCs

0AB53321BB9699D354A032259423175C08FEC1A4

f1df0c5a74c9885cb5934e3eee5e7d3cf4d291c0

End. 

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

APT32 poisoning GitHub to target Chinese cybersecurity professionals and malware analysis

OK, let’s jump to the first part of malware and extract the TraceIndexer.exe and TTDReplay.dll.

The incident summary and detail you can view from China ThreatBook: APT32 Poisoning GitHub, Targeting Chinese Cybersecurity Professionals and Specific Large Enterprises | ThreatBook CTI,

Here I’m focused on diving deep into the process of malware analysis, the malicious file .uso, which is from the project of GitHub and recently removed by APT32, the structure as the following:

Let’s go to the malicious file .suo, it is the archive document, so you can use 7-zip to unpack it. Here is the file list:

Note that a big size file, VsToolboxService, which opens it with a text editor like Notepad or EmEditor

The malicious code is serialized by a formatter, with very long strings encoded by base64. Copy them to CyberChef and decode.

And continue to copy the highlighted‌ yellow to decode it again!

So now save and detect it, the payload encoded by base64, and the framework is .NET.

Some strings as flowing

try DnSpy to see the code.

Here, the malware seems to have a loader and plugin DLL; they are TraceIndexer.exe and TTDReplay.dll, so the important thing is we need to extract the code.

Let’s do it.

First: TraceIndexer.exe begins with the base64 string “TVqQ”

Second: TTDReplay.dll begins with the base64 string “TVp4”

Here we need to know the “TVq” and “TVp” equal to “MZ”

Back to the malware with HxD, we can find them and extract them one by one.

Open TraceIndexer.exe with IDA, and it is right for guessing before.

And now, let’s jump to the second part of malware analysis with the TraceIndexer.exe and TTDReplay.dll.

 

Beginning the analyzing before we need to change the command line in x64dbg, because it has two parameters. If not, it will exit the process.

The malware collects victim information, like computer name, user name, and so on.

And collection running process of machine and encode by base64 and packet them with JSON format

And use the token ID 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 as authorization to post back to C2.

C2 server https://api.notion.com/v1/blocks/11f5edabab70805fb7ebe2a462f4b7c0/children

And notion page id 11f5edabab708090b982d1fe423f2c0b is embedded in TTDReplay.dll.

IOCs

5042d3083e5bc41a75461f24fce48df4

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher