GreenSpot APT phishing campaigns with fake 163.com login analysis

 

Summary

From the Hunt.io blog, I noted that GreenSpot APT phishing campaigns quickly traced the event and downloaded the files to do simple checking.

 

Technical analysis

 

Until 2025.2.13, the following sites are still accessible.

The fake site hxxp[:]//mail.eco163[.]com/ jumps to hxxps[:]//www.kaola[.]com/ when entering a username.

About both hxxps[:]//l2024163[.]com/ and hxxps[:]//chamber.icu/,

Potential victims are prompted to enter the username and password twice to download the file. The first try always triggers an error message; its motivation is to let 163[.]com users confirm password accuracy, so the fake sites try to steal valid user credentials.

Figure1- Download Large Attachments

Figure2- Fake login

 

To check The attachments out, not finding “VBA Macros” embedded, is high confidence to ensure those without any malicious behavior. It seems that GreenSpot is focused on stealing user credentials, not directly doing harm to the user of the client machine. The motivation and tactics of GreenSpot are very clear, smart, and professional. But it does not mean that those attachments are not harmful in the future, because it changes and updates them so easily.

Figure3-VBA Macros No

 

IOCs

Network:

hxxp[:]//mail.eco163[.]com/

hxxps[:]//l2024163[.]com/

hxxps[:]//chamber.icu/

Files:

f205b862f6e72b5eaf303de4c6c61df1

cd5f033a40b739f2e7ab5b4ffbfeea72

Conclusion

From the above analysis, GreenSpot APT phishing campaigns focused on stealing 163[.]com user credentials with no malicious attachments, but that does not mean in the future it will still be dangerous.

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

The North Korean nation-state APT43 Kimsuky used the PowerShell forceCopy to conduct spear-phishing analysis

 

Summary

From the AhnLab SEcurity intelligence Center (ASEC) I noted that Theft of Web Browser Information (forceCopy) which malware are PowerShell scripts, and I have collected three malwares, they have similar design, I choose one of them to analysis. The design of the PowerShell script used by obfuscation technology from Kimsuky is worthy of more attention, especially nowadays as AI is developing fast; it makes malware makers and analysts more easily able to do their jobs.

 

Technical analysis

This forceCopy is the PowerShell (executable).

The hash MD5: 1e9d94d88fdac3c4a0a47a3a1d07e329

 

The source code is difficult to read, so I did it manually and made it easy to read. These codes are a small part of them.

1. It defines a function (stored in the variable $mqtz60) that takes an array of strings ($vvv32) as input;

2. For each string in the array, it decodes the string from Base64, converts the resulting  byte array to a string and then executes the resulting string as PowerShell code.

3.The variable $xya0 and it long string and The range [88..2]

     means it takes characters from index 88 to index 2 in reverse order ，

     This is unusual and likely part of the obfuscation.

4. And the other variables $ipv1, $wxa2, $qwe3, $ycf4, $pvd5 are similar, 

   the variable $aegk6  connects with them. 

Figure1-source code Optimized in format

Just using “Write-Output” to print the decoded string instead of executing it, and finally we can get the decrypted source code. This PowerShell script snippet performs several operations, including interacting with Google Drive, executing a PowerShell script, and handling output and uploading it with an access token.

Figure2- decrypted strings

Of course, normally here to change the code to get tmps4.ps1, but I had not found it. Maybe it plans to run a keylogger or other malware to steal victim information. The access token is embedded inside PowerShell, including the other parameters like folderId, clientId, and secret.

Figure3-token paramers

IOCs

(Md5)

1e9d94d88fdac3c4a0a47a3a1d07e329

Conclusion
The Kimsuky threat group is continuously updating malware and launching spear phishing attacks against their targets. It is so hot for their campaign and also is a huge threat to the economic world.

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

Rapperbot how to improve and expand its ability based on an early version static analysis

 

Summary

RapperBot is a malware family primarily targeting IoT devices. It has been observed in the wild since June 2022. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup DeepSeek, which attracted my curiosity, so I looked for another variant, which was improved based on an early version.

 

 

Technical analysis

This Rapperbot is the ELF for ARM (executable).

The hash MD5: 139052977D3A5E9246A51D726DAE32BD

 

Improved abilities and the design

such as “EF9EBF4D5A1A44D0DB92DE06D3DCE7A1” without the ability of brute forcing. I did an analysis report before; when it successfully cracked the target, it would use the wget command to download malware itself and expand its attack surface from hxxp://109.206.243.207/d. And the variant has no web vulnerabilities to exploit, which is used by the other botnet, like EnemyBot. It means that the RapperBot group keeps updating their abilities of malware and expanding the infection to the IoT devices; they had their basic design based on the reserve strings. And they still keep the YouTube address hxxps://www.youtube.com/watch?v=4fm_ZZn5qaw. What is the motivation? Ads?

Figure1- brute-forcing strings and malware addresses

 

obviously the variant of RapperBot improved from strings like “aAdmin7ujmko0ad” and “aAdministrators” embedded in binary, which was used to do brute forcing for the SSH client, and the ARM samples,Move to the logic design of the variant. Compared to an early version, I found that the code had changed a little; it only added a variable v13 saving the result from the function and passed the variable as a parameter to a new function named sub_C3D8(v13). The wrapper will expand the whole and new abilities, which they would like to do for a new variant.

Figure2-expanding new abilities

 

In the branch path of logic design in sub_C3D8(v13), downloading the attack sample and doing a brute force are two different conditions; they are both in a do-while loop.

IOC

139052977D3A5E9246A51D726DAE32BD

Conclusion
Until now I have not found the attack samples shared, which did a DDoS attack on DeepSeek, but from both samples, RapperBot seems to continually update their abilities. The variant was focused on SSH brute force and furthermore to expand the attack surface. The campaign they did was hidden threat.

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

Rapperbot static analysis for ARM architecture, the other variants to do a DDoS attack on Chinese AI startup DeepSeek

 

Summary

RapperBot is a malware family primarily targeting IoT devices. It has been observed in the wild since June 2022. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup DeepSeek, which attracted my curiosity, So I looked for one variant, which is an early version, to analyze that belongs to the ARM architecture.

 

 

Technical analysis

This Rapperbot is the ELF for ARM (executable).

The hash MD5: EF9EBF4D5A1A44D0DB92DE06D3DCE7A1

This variant focuses on the TCP DoS attack and not on doing a brute force like a telnet server and not on doing vulnerability exploits.

Figure1-DoS attack

 

Before starting a DoS attack, the code creates a UDP socket, the port is 13568, connects it to a remote address, retrieves the local socket details, and then closes the socket, and finally returns the value 134744072.

Figure2-Retrieving socket detail

the value 134744072 from Figure 2 as a parameter to do the XOR algorithm with PID and PPID.

Figure3-XOR with 134744072,pid, ppid and clock time

The result from Figure 3 is a parameter to retrieve machine information. The wrapper has many choices to design the function for getting machine information, like the “/proc/stat” and “/proc/cpuinfo”.

Figure4-machine information snippet

And the botnet uses the getrlimit() function to retrieve resource limits for a process.

Figure5-getrlimit function

Like the other malware, Rapperbot has important and sensitive information hidden by a confusion technique with XOR in the botnet.

Figure6- asc_1C64C snippet

Rapperbot will decode the asc_1C64C strings before starting to do a DDoS attack.

Figure7-decode strings and kill something

The function sub_9B40 decodes the asc_1C64C.

Figure8-decode algorithm snippet

 

The function sub_83D4 kills something special.

Figure9-kill something snippet

It tries to create a TCP socket, sets a socket to non-blocking mode, and attempts to connect to the remote server.

Figure10-tcp for connecting to the remote server

This version of Rapperbot Not like Mirai and Hailbot supporting DDoS in many different ways, which has limited ability for DoS with TCP and UDP attacks.

Figure11-DoS attack snippet 1

Figure12- DoS attack snippet 2

 

Another DoS attack type is as follows.

Figure13- DoS attack snippet 3

 

This is funny and a new idea for delivering ads inside a botnet with the URL https[:]//www.youtube.com/watch?v=4fm_ZZn5qaw for “@2tallforfood - I Am Da Bag (Official Video)”, it seems that it is so popular with 2.78M subscribers.

Figure14-ads

Figure14-subscribers

It has “SSH-2.0-HELLOWORLD” strings but without SSH brute forcing.

Figure15-SSH strings

 

IOCs

EF9EBF4D5A1A44D0DB92DE06D3DCE7A1

 

Conclusion
This variant of the botnet seems to be developing a version from the above analysis, which has a limited ability for DoS attacks and the sensitive information obfuscated with XOR in the botnet.

End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

HailBot analysis, the other variants to do a DDoS attack on Chinese AI startup DeepSeek

 

Summary

HailBot is the variant of the Marai botnet. This botnet is very popular in 2023 and later became faster, delivering and infecting large-scale. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup deepseek.

 

 

Technical analysis

This HailBot is the ELF for ARM (executable).

The hash MD5: 74AE300E854410ABB8C71A9E5C6182FF

 

The HailBot kills the other botnet to ensure that it is the only one running on the victim host.

Figure1-Kill other botnet

 

The botnet kills other processes.

Figure2-Kill other processes

 

HailBot disguises itself to hide the process with the mount.

Figure3-Hide process

 

Supporting TCP and UDP DDoS attacks that are imbedded inside the botnet, which has more than 10 different DDoS attack ways.

Firgure4-DDoS attack mode

 

HailBot is the variant of the Marai botnet, which is focused on running DDoS attacks without any other functions like telnet brute force and without any other vulnerabilities to exploit.

 

 

IOCs

74AE300E854410ABB8C71A9E5C6182FF

 

Conclusion

HailBot is the variant of the Marai botnet, which is focused on running DDoS attacks, and the attacker is professional.

 End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher 

Mirai botnet among different instruction sets: x86, ARM, PPC, and MIPS with static analysis

 

Summary

Mirai botnet family first discovered in 2016, the botnet will look for devices of IoT with scanner which embedded a dictionary for brute force attack and vulnerabilities exploit, and can do a DDoS attack like TCP flood and UDP flood and so on, later on, the source code distributed in github and different variants came from that time, nowadays, botnet is big challenging and threat to IoT, it is worthy doing research with different instruction sets, this report come here for a new try and let’s do it.

 

 

Technical analysis

 

This botnet is the ELF for Intel 386 (executable).

The hash

MD5: 6950F28382D7F11E18BDF53F3983117B

The load segment displays lots of source files that can help analysts to learn from which source code is being included and infer the main function of malware, likely with the source file “kill.c” to tell the analyst it may use the kill command to stop the process and “socket.c,” which can be used for malware to connect to the network.

Figure1-Source File List

Figure2-Kill Pid

 

The botnet at the part of initConnection connects to the server and port with plain text “31.172.87.248:12345,” and then goes to sleep and receives the command from the server and starts the attack DDoS module with processCmd, which supports TCP flood and UDP flood and so on, and stops the process.

Figure3- InitConnection To Server

Figure4- ProcessCmd With DDoS

Figure5-The Type Of ProcessCmd And Stop Process

 

TCP flood supports SYN, RST, FIN, ACK and PUSH.

Figure6-TCP Flood

 

The getPortz function checks for the existence of Python, Python3, and Perl binaries. If any exist, it returns."22" If none exist but /usr/sbin/telnetd is missing, it returns. "Unknown Port", Otherwise, it defaults to "22".

Figure7-GetPortz

The version of the botnet seems to be focused on starting an attack with DDoS, not to do cracking with a dictionary for telnet, and not to use any vulnerability to exploit.

 

 

This botnet is the ELF for ARM (Executable) in 32-bit.

The hash

MD5: 8ECAFDA00F1F5E5F8E94A10BB94D79B3

 

The load segment does not display any source files list and the function list without any useful information for analysts; it will take more time to dive deeply into the botnet when doing static analysis.

Figure8-Function Name About The ELF For ARM

 

The botnet embedded CVE-2017-17215 vulnerability exploited Huawei products and used command injection to implant malware, likely with downloading botnets for expanding the attack surface.

Figure9- CVE-2017-17215

 

The botnet embedded a dictionary to do a brute force attack.

Figure10-A Dictionary For Brute Force

 

The botnet kills other processes without plain text list, linux_eabi_syscallis an assembly-level mechanism for invoking system calls on ARM architectures, and the number is 37.

Figure11-Kill Other Process

 

The botnet changes the process to hide the real process for the anti-killing virus, which was running on the victim host.

Figure12-Change The Real Process

This version of the botnet with ARM architectures seems a bigger challenger than x86 architectures.

This botnet is the ELF for PowerPC (Executable) in 32-bit.

The hash

MD5: C6F057C974B24F6ABDAC5B76B10040B9

 

The load segment only displays “ppc-asm.h” include list and the function list without any useful information for analysts; 

Figure13-Load Segment

 

Using the crontab to execute a task with “bot.conf” file and make the botnet running as service. 

Figure14- Crontab And Service

 

The botnet kills other processes without plain text list, linux_syscall an assembly-level mechanism for invoking system calls on ARM architectures, and the number is 37.

Figure15-Kill Other Process

 

The botnet changes the process to hide the real process for the anti-killing virus, which was running on the victim host.

Figure16- Change The Real Process

 

This version of botnet without brute force attack and vulnerability exploited.

This botnet is the ELF for MIPS (Executable) in 32-bit.

The hash

MD5: CE6B524DB5612552294B5661EFFED7BD

 

The load segment does not display any source files list and the function list without any useful information for analysts; it will take more time to dive deeply into the botnet when doing static analysis.

Figure17-Function Name About The ELF For MIPS

 

The entry of variant of MIRAI is still very clearly, the function sub_40BA5C is main routing.

Figure18-The Entry

 

A dictionary is embedded for brute force in MIPS architectures like the following.

Figure19- Brute Force

 

In MIPS, the number of system calls begins at 4000, and “__asm { syscall }” is an inline assembly instruction that invokes a system call, the number 4170 is short for socket connection.

Figure20-Snippet For Connect

 

Username and password had been obfuscated with XOR, and the key was 0x37.

Figure21-Xor Algorithm

 

The IP address “41.216.189.127” is a fake IP, which will be changed by the sub_413780 function in order to hide the real server.

Figure22- sub_413780 Change Fade IP Address

 

The new variant uses double obfuscation to encode strings; it makes analysis more challenging. Maybe it will appear with multiple obfuscation techniques for anti-analysis.

Figure23-Double obfuscation

 

Obviously, the variant of Mirai botnet in MIPS architectures to do static analysis is a big challenge because of its policy of obfuscation.

 

 

 

ICOs

6950F28382D7F11E18BDF53F3983117B

8ECAFDA00F1F5E5F8E94A10BB94D79B3

C6F057C974B24F6ABDAC5B76B10040B9

CE6B524DB5612552294B5661EFFED7BD

 

Conclusion

From the above static analysis, we can get very limited knowledge about the Mirai botnet with different architectures, especially since they are a big challenge by obfuscation technique, although we can find the main routing or basic structure of botnet to go forward, but it still takes us more time and energy for the whole process of analysis.

 End.

──────────────────────

Seeker(李标明) · @clibm079    

China · Independent Malware Analyst & Researcher