StealRat Botnet

From Leo's Notes
Revision as of 08:06, 20 September 2015 by Leo (talk | contribs) (→Exploits Used)
This page was last edited on 20 September 2015, at 08:06.

This is an in depth look at the StealRat Botnet first discussed by TrendMicro in their paper at http://blog.trendmicro.com/trendlabs-security-intelligence/compromised-sites-conceal-stealrat-botnet-operations/.

One of the sites I host became compromised and began sending thousands of spam messages per hour. Being in the position I am, I was able to honeypot the exploit and learned much of the inner workings of this spam operation.

Overview

The StealRat botnet operates with the following components:

  1. A Command and Control server
  2. Botnet agents
  3. Compromised websites acting as botnet agents
  4. Compromised websites acting as mail gateways
  5. Compromised websites acting as a HTTP redirect

The control server isolates itself from the actual act of spamming through the botnet agents and compromised websites. Each of these components will be discussed in detail below.

Command and Control Server

My knowledge of the C&C server is based solely on the exploit that is executed remotely by botnet agents and therefore may be incomplete.

The C&C server provides the 3 things for the malware.

  1. Email addresses to spapm
  2. A message to send, including the actual message, the subject, the sender name, and email address
  3. URLs to compromised websites to use as mail gateways.

The command and control server is hosted by LeaseWeb in Amsterdam with the domain 'touchpadz.com'.

Botnet Agents

The StealRat botnet has agents which make the actual HTTP request against compromised websites which either directly sends spam through a PHP mail script on a compromised website, or sends spam through a PHP shell on a compromised website.

Compromised Websites

Exploits Used

The PHP Mailer Script

The PHP Shell

The PHP shell is a short exploit injected to an existing PHP script. A secret key is hard coded to allow arbitrary code execution by POSTing to the shell. <phorkie>https://phorkie.leo.home.steamr.com/2/embed</phorkie>

This most likely was created from an existing exploit such as a vulnerable wordpress plugin.

Using this PHP shell, the botnet operators and other botnet clients can run arbitrary PHP code on the server.

One of the many uses is to further distance the act of sending the spam messages by using the shell as a proxy and to also amplify the amount of spam that can be sent by the botnet clients. Another is to maintain a healthy set of PHP mailer scripts online on the server in case they are taken down.

Proxying Mail Requests

Every few hours, one of the botnet clients will attempt to execute an obfuscated piece of PHP code on the PHP shell which proxies mail requests to other exploited servers. <phorkie>https://phorkie.leo.home.steamr.com/1/embed</phorkie>

The payload is encoded using base64. The deciphered payload can be viewed below. The single quotes around the function names is an artifact of my decoder. <phorkie>https://phorkie.leo.home.steamr.com/3/embed</phorkie>

Basically, the payload above fetches a binary from the C&C server based on the host's architecture to /tmp and executes it with an environment variable XDVSN_SESSION_COOKIE which is encoded using base64 and XOR'd with 1's. Decoding this value yielded URLs and arguments to other of the C&C resources which the binary uses in order to spam using other remote servers. <phorkie>https://phorkie.leo.home.steamr.com/4/embed</phorkie>

From what I can figure out, the arguments are:

  • ldb = list database containing the email addresses. Changing this yielded different email addresses.
  • kk = random keys the program should use
  • su = a URL to the C&C server that provides a random URL to a PHP mailer script
  • bu = a URL to the C&C server that provides a random email message to send
  • lu = the base URL to the C&C server that provides an encrypted list of email addresses.
  • lc = limit on the number of emails to fetch
A Simple Solution
This attack can be prevented if /tmp is made to be noexec.


Interestingly, these clients always make the request with the user agent string of: 

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0


The PHP Exploit Creator

Once in a while, a botnet client will run a different piece of obfuscated PHP code which creates the PHP mailer scripts. <phorkie>https://phorkie.leo.home.steamr.com/5/embed</phorkie>

Deobfuscating the code shows that the exploit creator will randomly traverse into a directory and dump the exploit into a random file whose name is randomly generated from a list of generic words, all of which are web related in order to be discrete. <phorkie>https://phorkie.leo.home.steamr.com/6/embed</phorkie>

The actual payload contains the PHP mailer script discussed above. <phorkie>http://phorkie.leo.home.steamr.com/7/embed</phorkie>

More about the C&C Server

Encryption Method

The email address list is encrypted by XORing the requesting key with the payload.

See Also