StealRat Botnet - Revision history

Leo: replaced phorkie templates

2022-12-13T22:31:00Z

replaced phorkie templates

Show changes

Leo: replaced phorkie templates

2022-12-13T22:28:19Z

replaced phorkie templates

Show changes

115.246.231.90: /* Botnet Agents */

2022-12-13T15:15:34Z

Botnet Agents

← Older revision		Revision as of 15:15, 13 December 2022
Line 24:		Line 24:

	=== Botnet Agents ===		=== Botnet Agents ===
	The StealRat botnet has agents which ~~make~~ the actual HTTP request against compromised websites which either directly sends spam through a PHP mail script on a compromised website, or sends spam through a PHP shell on a compromised website.		The StealRat botnet has agents which makes the actual HTTP request against compromised websites which either directly sends spam through a PHP mail script on a compromised website, or sends spam through a PHP shell on a compromised website.

	=== Compromised Websites ===		=== Compromised Websites ===

Leo: Added category

2020-06-15T00:09:41Z

Added category

← Older revision		Revision as of 00:09, 15 June 2020
Line 120:		Line 120:
	== See Also ==		== See Also ==
	* http://blog.trendmicro.com/trendlabs-security-intelligence/compromised-sites-conceal-stealrat-botnet-operations/		* http://blog.trendmicro.com/trendlabs-security-intelligence/compromised-sites-conceal-stealrat-botnet-operations/

			{{Navbox Web}}[[Category:WebApp]]

Leo: IP address of the c&c server

2015-12-07T18:57:55Z

IP address of the c&c server

← Older revision		Revision as of 18:57, 7 December 2015
Line 21:		Line 21:
	# URLs to compromised websites to use as mail gateways.		# URLs to compromised websites to use as mail gateways.

	The command and control server is hosted by LeaseWeb in Amsterdam with the domain 'touchpadz.com'.		The command and control server is hosted by LeaseWeb in Amsterdam with the domain 'stat.touchpadz.com'. It resolves to the IP address 5.79.83.27.

	=== Botnet Agents ===		=== Botnet Agents ===

Leo: /* The PHP Mailer Script */

2015-11-25T21:22:12Z

The PHP Mailer Script

← Older revision		Revision as of 21:22, 25 November 2015
Line 31:		Line 31:
	=== The PHP Mailer Script ===		=== The PHP Mailer Script ===
	The PHP mailer script is an exploit uploaded by the attacker that allows the botnet to send spam messages. The deobfuscated mailer script can be seen below.		The PHP mailer script is an exploit uploaded by the attacker that allows the botnet to send spam messages. The deobfuscated mailer script can be seen below.
	{{phorkie\|7}}		{{phorkie\|7\|formatted.php}}

	At its most active, these mailer scripts can be hit every few seconds by random botnet clients. An individual request will contain POST values listed below.		At its most active, these mailer scripts can be hit every few seconds by random botnet clients. An individual request will contain POST values listed below.

Leo: phorkie tags

2015-11-25T21:09:44Z

phorkie tags

← Older revision		Revision as of 21:09, 25 November 2015
Line 31:		Line 31:
	=== The PHP Mailer Script ===		=== The PHP Mailer Script ===
	The PHP mailer script is an exploit uploaded by the attacker that allows the botnet to send spam messages. The deobfuscated mailer script can be seen below.		The PHP mailer script is an exploit uploaded by the attacker that allows the botnet to send spam messages. The deobfuscated mailer script can be seen below.
	<phorkie~~>https://phorkie.leo.home.steamr.com/~~7~~/embed</phorkie>~~		{{phorkie\|7}}

	At its most active, these mailer scripts can be hit every few seconds by random botnet clients. An individual request will contain POST values listed below.		At its most active, these mailer scripts can be hit every few seconds by random botnet clients. An individual request will contain POST values listed below.
	<phorkie~~>https://phorkie.leo.home.steamr.com/~~8~~/embed</phorkie>~~		{{phorkie\|8}}

	The POST arguments sent to the mailer script are listed below. While the keys are given as whole words, only the first letter is used.		The POST arguments sent to the mailer script are listed below. While the keys are given as whole words, only the first letter is used.
Line 44:		Line 44:

	Both the email address list and message are encoded using base64 and XOR'd with 1's. The email address list contains 19 email addresses delimited by the hash '#' character. The email message contains the a fake name and username, email subject and message.		Both the email address list and message are encoded using base64 and XOR'd with 1's. The email address list contains 19 email addresses delimited by the hash '#' character. The email message contains the a fake name and username, email subject and message.
	<phorkie~~>https://phorkie.leo.home.steamr.com/~~9~~/embed</phorkie>~~		{{phorkie\|9}}

	This botnet in particular always send messages with a single link which goes to yet another hacked server which redirects an unsuspecting user to a site the botnet operators are promoting.		This botnet in particular always send messages with a single link which goes to yet another hacked server which redirects an unsuspecting user to a site the botnet operators are promoting.
Line 53:		Line 53:
	=== The PHP Shell ===		=== The PHP Shell ===
	The PHP shell is a short exploit injected to an existing PHP script. A secret key is hard coded to allow arbitrary code execution by POSTing to the shell.		The PHP shell is a short exploit injected to an existing PHP script. A secret key is hard coded to allow arbitrary code execution by POSTing to the shell.
	<phorkie~~>https://phorkie.leo.home.steamr.com/~~2~~/embed</phorkie>~~		{{phorkie\|2}}

	This most likely was created from an existing exploit such as a vulnerable wordpress plugin.		This most likely was created from an existing exploit such as a vulnerable wordpress plugin.
Line 63:		Line 63:
	==== Proxying Mail Requests ====		==== Proxying Mail Requests ====
	Every few hours, one of the botnet clients will attempt to execute an obfuscated piece of PHP code on the PHP shell which proxies mail requests to other exploited servers.		Every few hours, one of the botnet clients will attempt to execute an obfuscated piece of PHP code on the PHP shell which proxies mail requests to other exploited servers.
	<phorkie~~>https://phorkie.leo.home.steamr.com/~~1~~/embed</phorkie>~~		{{phorkie\|1}}

	The payload is encoded using base64. The deciphered payload can be viewed below. The single quotes around the function names is an artifact of my decoder.		The payload is encoded using base64. The deciphered payload can be viewed below. The single quotes around the function names is an artifact of my decoder.
	<phorkie~~>https://phorkie.leo.home.steamr.com/~~3~~/embed</phorkie>~~		{{phorkie\|3}}

	Basically, the payload above fetches a binary from the C&C server based on the host's architecture to {{code\|/tmp}} and executes it with an environment variable {{code\|XDVSN_SESSION_COOKIE}} which is encoded using base64 and XOR'd with 1's. Decoding this value yielded URLs and arguments to other of the C&C resources which the binary uses in order to spam using other remote servers.		Basically, the payload above fetches a binary from the C&C server based on the host's architecture to {{code\|/tmp}} and executes it with an environment variable {{code\|XDVSN_SESSION_COOKIE}} which is encoded using base64 and XOR'd with 1's. Decoding this value yielded URLs and arguments to other of the C&C resources which the binary uses in order to spam using other remote servers.
	<phorkie~~>https://phorkie.leo.home.steamr.com/~~4~~/embed</phorkie>~~		{{phorkie\|4}}

	From what I can figure out, the arguments are:		From what I can figure out, the arguments are:
Line 90:		Line 90:
	=== The PHP Exploit Creator ===		=== The PHP Exploit Creator ===
	Once in a while, a botnet client will run a different piece of obfuscated PHP code which creates the PHP mailer scripts.		Once in a while, a botnet client will run a different piece of obfuscated PHP code which creates the PHP mailer scripts.
	<phorkie~~>https://phorkie.leo.home.steamr.com/~~5~~/embed</phorkie>~~		{{phorkie\|5}}

	Deobfuscating the code shows that the exploit creator will randomly traverse into a directory and dump the payload into a random file whose name is randomly generated from a list of generic words, all of which are web related in order to be discrete.		Deobfuscating the code shows that the exploit creator will randomly traverse into a directory and dump the payload into a random file whose name is randomly generated from a list of generic words, all of which are web related in order to be discrete.
	<phorkie~~>https://phorkie.leo.home.steamr.com/~~6~~/embed</phorkie>~~		{{phorkie\|6}}

	The payload always contains the PHP mailer script discussed in the sections above.		The payload always contains the PHP mailer script discussed in the sections above.

Leo: Removed exploit domain for safety.

2015-09-20T08:48:20Z

Removed exploit domain for safety.

← Older revision		Revision as of 08:48, 20 September 2015
Line 100:		Line 100:
	The C&C server is hosted in the Netherlands by LeaseWeb. By capturing the botnet requests to proxy and to amplify the spam requests, the C&C resources were discovered. There are three resources that are of interest:		The C&C server is hosted in the Netherlands by LeaseWeb. By capturing the botnet requests to proxy and to amplify the spam requests, the C&C resources were discovered. There are three resources that are of interest:

	* ~~http~~://pages.~~touchpadz~~.com/crond32		* hxxp://pages. .com/crond32
	* ~~http~~://pages.~~touchpadz~~.com/crond64		* hxxp://pages. .com/crond64
	* ~~http~~://sk.~~touchpadz~~.com//img/logo.gif?sessd=$ldb&sessc=$lc&sessk=$kk		* hxxp://sk. .com//img/logo.gif?sessd=$ldb&sessc=$lc&sessk=$kk
	* ~~http~~://bat.~~touchpadz~~.com/aa2.php		* hxxp://bat. .com/aa2.php
	* ~~http~~://stat.~~touchpadz~~.com/gj13c.php		* hxxp://stat. .com/gj13c.php

	The first two are the 32 and 64bit binaries used by the botnet to proxy HTTP requests to PHP mailer scripts.		The first two are the 32 and 64bit binaries used by the botnet to proxy HTTP requests to PHP mailer scripts.

Leo at 08:47, 20 September 2015

2015-09-20T08:47:31Z

← Older revision		Revision as of 08:47, 20 September 2015
Line 17:		Line 17:

	The C&C server provides the 3 things for the malware.		The C&C server provides the 3 things for the malware.
	# Email addresses to ~~spapm~~		# Email addresses to spam
	# A message to send, including the actual message, the subject, the sender name, and email address		# A message to send, including the actual message, the subject, the sender name, and email address
	# URLs to compromised websites to use as mail gateways.		# URLs to compromised websites to use as mail gateways.
Line 47:		Line 47:

	This botnet in particular always send messages with a single link which goes to yet another hacked server which redirects an unsuspecting user to a site the botnet operators are promoting.		This botnet in particular always send messages with a single link which goes to yet another hacked server which redirects an unsuspecting user to a site the botnet operators are promoting.

			Interestingly, the user agent targetting the PHP mailer script is always
			Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.7.6)

	=== The PHP Shell ===		=== The PHP Shell ===
Line 75:		Line 78:
	* lu = the base URL to the C&C server that provides an encrypted list of email addresses.		* lu = the base URL to the C&C server that provides an encrypted list of email addresses.
	* lc = limit on the number of emails to fetch		* lc = limit on the number of emails to fetch

			More on the C&C in the section below.

	{{Info\|A Simple Solution\|This attack can be prevented if {{code\|/tmp}} is made to be {{code\|noexec}}.}}		{{Info\|A Simple Solution\|This attack can be prevented if {{code\|/tmp}} is made to be {{code\|noexec}}.}}
Line 80:		Line 85:
	Interestingly, these clients always make the request with the user agent string of:		Interestingly, these clients always make the request with the user agent string of:
	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0		Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0

			Once the binary executes with the proper environment variable set, it will fetch a random URL to use as a mail gateway, a list of about 100 email addresses to spam, and a email message from the C&C server. In batches of 19 email addresses, the binary will make one request to a random PHP mailer script until all emails have been exhausted and the program terminates.

	=== The PHP Exploit Creator ===		=== The PHP Exploit Creator ===
Line 91:		Line 98:

	== More about the C&C Server ==		== More about the C&C Server ==
	=== ~~Encryption Method ===~~		The C&C server is hosted in the Netherlands by LeaseWeb. By capturing the botnet requests to proxy and to amplify the spam requests, the C&C resources were discovered. There are three resources that are of interest:
	The email ~~address list~~ is ~~encrypted by XORing~~ the ~~requesting~~ key ~~with~~ the ~~payload~~.
			* http://pages.touchpadz.com/crond32
			* http://pages.touchpadz.com/crond64
			* http://sk.touchpadz.com//img/logo.gif?sessd=$ldb&sessc=$lc&sessk=$kk
			* http://bat.touchpadz.com/aa2.php
			* http://stat.touchpadz.com/gj13c.php

			The first two are the 32 and 64bit binaries used by the botnet to proxy HTTP requests to PHP mailer scripts.

			The logo.gif resource takes in three parameters:
			# sessd - the email table
			# sessc - the number of email addresses to fetch
			# sessk - a 16 character long key the contents are 'encrypted' with. 0's are used to pad the string if its length is less than 16 bytes.

			The contents returned is XOR'ed using the key provided.

			aa2.php provides the spam messages.
			gj13c.php provides a URL to a PHP mailer script.

	== See Also ==		== See Also ==
	* http://blog.trendmicro.com/trendlabs-security-intelligence/compromised-sites-conceal-stealrat-botnet-operations/		* http://blog.trendmicro.com/trendlabs-security-intelligence/compromised-sites-conceal-stealrat-botnet-operations/

Leo: /* Exploits Used */

2015-09-20T08:26:02Z

Exploits Used

← Older revision		Revision as of 08:26, 20 September 2015
Line 85:		Line 85:
	<phorkie>https://phorkie.leo.home.steamr.com/5/embed</phorkie>		<phorkie>https://phorkie.leo.home.steamr.com/5/embed</phorkie>

	Deobfuscating the code shows that the exploit creator will randomly traverse into a directory and dump the ~~exploit~~ into a random file whose name is randomly generated from a list of generic words, all of which are web related in order to be discrete.		Deobfuscating the code shows that the exploit creator will randomly traverse into a directory and dump the payload into a random file whose name is randomly generated from a list of generic words, all of which are web related in order to be discrete.
	<phorkie>https://phorkie.leo.home.steamr.com/6/embed</phorkie>		<phorkie>https://phorkie.leo.home.steamr.com/6/embed</phorkie>

	The ~~actual~~ payload contains the PHP mailer script discussed above.		The payload always contains the PHP mailer script discussed in the sections above.
	~~<phorkie>https://phorkie.leo.home.steamr.com/7/embed</phorkie>~~

	== More about the C&C Server ==		== More about the C&C Server ==