800+ IT
News
als RSS Feed abonnieren📚 MMD-0058-2016 - ELF Linux/NyaDrop
💡 Newskategorie: Malware / Trojaner / Viren
🔗 Quelle: blog.malwaremustdie.org
Background
Since end of September 2016 I received a new type of attacks that aims the MIPS platform I provided to detect IoT attacks. I will call this threat as new ELF Linux/NyaDrop as per the name used by threat actor himself, for the "nyadrop" binary that is dropped in the compromised system.
This is not the "really" first time we're seeing this threat actually, in this year, some small events was detected on having these attacks which I ignored for some reasons, and on May 22th, me and hFiref0x of KernelMode was in a convo regarding to the threat which was detected. It was obviously the same threat (proof is as per picture below, thanks to hFiref0x for the ping that time).
On May's event, the attack was so poorly arranged so the infection wasn't occurred due to the lack of UNIX background of the bad actor. And I did not want to post it in anywhere, hopefully he will be always as dumb as per that state.
In the end of September 2016, a wave of attacks using IoT known factory hardcoded default login credential that was recently exposed on some blackhat events, was raising a lot of ELF threat to "come back" and race to infect the known IoT vulnerable sector. And during the session, the Linux/NyaDrop's loader attacks was re-surfacing again, and this time it got better (a bit), so I decided to write in this post as public awareness. For the purpose I made forensic records since early Octtober 2016 for the conducted attacks on specific platform aimed, MIPS CPU architecture, implying routers and similar networking devices, with 32bit clock.
This post is informing you about the information related to the attack, records of several attack pattern, the dropped binary analysis in reverse engineering. You may can get the hazards to be use detect and mitigate the threat, and further precaution. The complete log is shared to law enforcement. Beforehand, I thank FreeBSD foundation to the free & open source platform which I conduct all of my research, radare2 for the one and only reversing platform I use, and Linux for the great OS that is successfully implemented into plenty of IoT, and also Mr.Michel Oosterhof for his effort in improving a good honeypot.
The detail is as follows:
NyaDrop attack indicators
There are some indicators that can be used to detect this attack, the first pattern is the login "Failed attempt" and then followed by the "Success attempt" of login credential of the aimed IoT. The time for getting success attempt is very short, indicated the bruce force work.
The Fail then success attempt can be shown as per below:
In this attack the bogus credential "5up", was used as first brute login.
The one shot attack with a success attempt can be shown as per below:
And below are the several pattern of failed attacks:
The point to be noticed in these attacks are:
{
"ip": "46.172.91.20",
"hostname": "No Hostname",
"country": "RU",
"loc": "55.7386,37.6068",
"org": "AS35390 PE Masyuk Natalya"
}nyadrop: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, stripped
How ELF Linux/Nyadrop work
The successfully dropped file in the MIPS system is the Linux malware backdoor, I call it as ELF Linux/NyaDrop malware, with the function to open an internet socket (AF_INET) to remotely connect to the remote host for receiving the stream of any Linux executable data streams intended to infect the previously Linux/NyaDrop compromised machine. The stream of received data to then to be saved as "nya" ELF malware file and then execute it in the targeted MIPS cpu architecture device.
The "nya" dropped file will be deleted everytime the next new attacks are successfully logged in to the MIPS machine and then updating the previously saved "nya" malware. This method is so generic and flexible for the attacker to update the botnet component, the backdoor (Linux/NyaDrop) itself, and can be arranged without giving many trace of executables. Further, during unsuccessful attack or the "obviously-detected-honeypot", neither the binary of "nyadrop" will be saved/infected successfully, following also the "nya" binary one. This is why the malware sample is not much spotted.
Linux/Nyadrop ELF analysis
As per mentioned in the above sections, the ELF binary of MIPS x32, static and stripped, was saved with the name of the "nyadrop" on the targeted MIPS device. The header is as follows:
If you see the size, we are dealing with a small file. It's a clean libc compiled ELF from assembly codes, such form that we see much in shellcodes. Insides is filled with the MIPS opcodes. We dealt before with the similar small ELF malware before in the following posts in here [link] and here [link], I will try to deal with this one too :)
SHA1 (nyadrop) = "095bb52056d00f0d93bba78e4b5b56313de7b79f"
Size = "621 bytes"
"ELF Header:"
Magic: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, big endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: MIPS R3000
Version: 0x1
Entry point address: 0x400090
Start of program headers: 52 (bytes into file)
Start of section headers: 500 (bytes into file)
Flags: 0x10001004, cpic, o32, mips2
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 2
Size of section headers: 40 (bytes)
Number of section headers: 3
Section header string table index: 2
"Section Headers:"
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .text PROGBITS 00400090 000090 000150 00 AX 0 0 16
[ 2] .shstrtab STRTAB 00000000 0001e0 000011 00 0 0
Small size yes? But it is amazing to see what this small ELF can do..
Reversing the ELF Linux/Nyadrop
For the reversing method. I was using my usual way like with previous ELF malware or botnet analysis, with using radare2, some syscall analyzers in skeleton2 and some manual opcode reading.
Let's see reversing pad with a lot of comments I made in the screenshot below for the details on how this binary works, you'll get the idea better than reading my long explanation.
PS: Generally, the function of malware was reversed well. But please bear for some "bad reading" on some MIPS opcodes or address, which I think I may miss some few minor parts. Switching from Intel to RM, PPC and MIPS opcodes reading is sometimes a bit hard to adapt quickly. Moreover I had only several hours to translate them to catch my sleeping time.
Detection, sample and follow-ups
The detection is bad, and you can expect multiple hash will be created per injected ELF of Linux/NyaDrop due to its nature of infection. Please avoid the hash base signature since it will be very meaningless, just as the Linux/Mayhem case (dropped by multiple circumstances).
Below is the screenshot I took AFTER I uploaded the sample to the VirusTotal:
*) You can click the picture for directly viewing the report in VirusTotal.
I welcome you to share the sample to the other close research community.
Stay save friends!
#MalwareMustDie! ...