StealRat Botnet

From Leo's Notes
Revision as of 07:13, 20 September 2015 by Leo (talk | contribs) (→The PHP Shell)
This page was last edited on 20 September 2015, at 07:13.

This is an in depth look at the StealRat Botnet first discussed by TrendMicro in their paper at http://blog.trendmicro.com/trendlabs-security-intelligence/compromised-sites-conceal-stealrat-botnet-operations/.

One of the sites I host became compromised and began sending thousands of spam messages per hour. Being in the position I am, I was able to honeypot the exploit and learned much of the inner workings of this spam operation.

Overview

The StealRat botnet operates with the following components:

  1. A Command and Control server
  2. Botnet agents
  3. Compromised websites acting as botnet agents
  4. Compromised websites acting as mail gateways
  5. Compromised websites acting as a HTTP redirect

The control server isolates itself from the actual act of spamming through the botnet agents and compromised websites. Each of these components will be discussed in detail below.

Command and Control Server

My knowledge of the C&C server is based solely on the exploit that is executed remotely by botnet agents and therefore may be incomplete.

The C&C server provides the 3 things for the malware.

  1. Email addresses to spapm
  2. A message to send, including the actual message, the subject, the sender name, and email address
  3. URLs to compromised websites to use as mail gateways.

The command and control server is hosted by LeaseWeb in Amsterdam with the domain 'touchpadz.com'.

Botnet Agents

The StealRat botnet has agents which make the actual HTTP request against compromised websites which either directly sends spam through a PHP mail script on a compromised website, or sends spam through a PHP shell on a compromised website.

Compromised Websites

Exploits Used

The PHP Mailer Script

The PHP Shell

The PHP shell is a short exploit injected to an existing PHP script. <phorkie>https://phorkie.leo.home.steamr.com/2/embed</phorkie>

Computers part of the botnet will make POST requests similar to the one captured below. <phorkie>https://phorkie.leo.home.steamr.com/1/embed</phorkie>

The payload is encoded using base64. The deciphered payload can be viewed below. The single quotes around the function names is an artifact of my decoder. <phorkie>https://phorkie.leo.home.steamr.com/3/embed</phorkie>

Basically, the payload fetches a binary from the C&C server based on the host's architecture and then executes it with an environment variable XDVSN_SESSION_COOKIE set to the long string. After decompiling the binary, it turns out XDVSN_SESSION_COOKIE is XOR'd with 1's and base64 encoded. Reversing this yielded URLs and arguments to other of the C&C resources. <phorkie>https://phorkie.leo.home.steamr.com/4/embed</phorkie>

From what I can figure out, the arguments are:

  • ldb = list database containing the email addresses. Changing this yielded different email addresses.
  • kk = random keys the program should use
  • su = a URL to the C&C server that provides a random URL to a PHP mailer script
  • bu = a URL to the C&C server that provides a random email message to send
  • lu = the base URL to the C&C server that provides an encrypted list of email addresses.
  • lc = limit on the number of emails to fetch

The PHP Exploit Creator

More about the C&C Server

Encryption Method

The email address list is encrypted by XORing the requesting key with the payload.

See Also