SHARE
TWEET

Elf Remote DDoS Management Tools from China

MalwareMustDie Jul 29th, 2014 730 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # MalwareMustDie! #ELF from China,
  2. # DDoS backdoor tool with account management.
  3. # CNC is alive (TO BE BLOCK) in :
  4.  183.60.202.59||4134 | 183.0.0.0/10 | CHINANET | CN | CHINATELECOM.COM.CN | CHINANET GUANGDONG PROVINCE NETWORK
  5.  
  6. // The sample...
  7.  
  8. $ date
  9. Tue Jul 29 11:00:26 JST 2014
  10. $ ls -alF
  11. total 2504
  12. drwxrwxrwx   2 MMD wheel      512 Jul 29 10:58 ./
  13. drwxrwxrwx  43 MMD wheel     1536 Jul 29 10:58 ../
  14. -rwxr--r--   1 MMD wheel  2492148 Jul 20 06:47 txmap*
  15. $ md5 txmap
  16. MD5 (txmap) = 917a2a3d8c30282acbe7b1ff121a4336
  17. $
  18.  
  19. // ELF...
  20.  
  21. ELF Header:
  22.   Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
  23.   Class:                             ELF32
  24.   Data:                              2's complement, little endian
  25.  Version:                           1 (current)
  26.  OS/ABI:                            UNIX - System V
  27.  ABI Version:                       0
  28.  Type:                              EXEC (Executable file)
  29.  Machine:                           Intel 80386
  30.  Version:                           0x1
  31.  Entry point address:               0x8048130
  32.  Start of program headers:          52 (bytes into file)
  33.  Start of section headers:          2491188 (bytes into file)
  34.  Flags:                             0x0
  35.  Size of this header:               52 (bytes)
  36.  Size of program headers:           32 (bytes)
  37.  Number of program headers:         5
  38.  Size of section headers:           40 (bytes)
  39.  Number of section headers:         24
  40.  Section header string table index: 23
  41.  
  42. Section Headers:
  43.  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  44.  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  45.  [ 1] .note.ABI-tag     NOTE            080480d4 0000d4 000020 00   A  0   0  4
  46.  [ 2] .init             PROGBITS        080480f4 0000f4 000030 00  AX  0   0  4
  47.  [ 3] .text             PROGBITS        08048130 000130 0bde0c 00  AX  0   0 16
  48.  [ 4] __libc_freeres_fn PROGBITS        08105f40 0bdf40 000ffa 00  AX  0   0 16
  49.  [ 5] .fini             PROGBITS        08106f3c 0bef3c 00001c 00  AX  0   0  4
  50.  [ 6] .rodata           PROGBITS        08106f60 0bef60 018720 00   A  0   0 32
  51.  [ 7] __libc_subfreeres PROGBITS        0811f680 0d7680 00002c 00   A  0   0  4
  52.  [ 8] __libc_atexit     PROGBITS        0811f6ac 0d76ac 000004 00   A  0   0  4
  53.  [ 9] .eh_frame         PROGBITS        0811f6b0 0d76b0 0195b0 00   A  0   0  4
  54.  [10] .gcc_except_table PROGBITS        08138c60 0f0c60 004725 00   A  0   0  4
  55.  [11] .tdata            PROGBITS        0813e388 0f5388 000010 00 WAT  0   0  4
  56.  [12] .tbss             NOBITS          0813e398 0f5398 000020 00 WAT  0   0  4
  57.  [13] .ctors            PROGBITS        0813e398 0f5398 000024 00  WA  0   0  4
  58.  [14] .dtors            PROGBITS        0813e3bc 0f53bc 00000c 00  WA  0   0  4
  59.  [15] .jcr              PROGBITS        0813e3c8 0f53c8 000004 00  WA  0   0  4
  60.  [16] .data.rel.ro      PROGBITS        0813e3e0 0f53e0 000814 00  WA  0   0 32
  61.  [17] .got              PROGBITS        0813ebf4 0f5bf4 000078 04  WA  0   0  4
  62.  [18] .got.plt          PROGBITS        0813ec6c 0f5c6c 00000c 04  WA  0   0  4
  63.  [19] .data             PROGBITS        0813ec80 0f5c80 16a0f4 00  WA  0   0 32
  64.  [20] .bss              NOBITS          082a8d80 25fd74 007748 00  WA  0   0 32
  65.  [21] __libc_freeres_pt NOBITS          082b04c8 25fd74 000014 00  WA  0   0  4
  66.  [22] .comment          PROGBITS        00000000 25fd74 0004da 00      0   0  1
  67.  [23] .shstrtab         STRTAB          00000000 26024e 0000e4 00      0   0  1
  68. Key to Flags:
  69.  W (write), A (alloc), X (execute), M (merge), S (strings)
  70.  I (info), L (link order), G (group), x (unknown)
  71.  O (extra OS processing required) o (OS specific), p (processor specific)
  72.  
  73. Program Headers:
  74.  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  75.  LOAD           0x000000 0x08048000 0x08048000 0xf5385 0xf5385 R E 0x1000
  76.  LOAD           0x0f5388 0x0813e388 0x0813e388 0x16a9ec 0x172154 RW  0x1000
  77.  NOTE           0x0000d4 0x080480d4 0x080480d4 0x00020 0x00020 R   0x4
  78.  TLS            0x0f5388 0x0813e388 0x0813e388 0x00010 0x00030 R   0x4
  79.  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x4
  80.  
  81. Section to Segment mapping:
  82.  Segment Sections...
  83.   00     .note.ABI-tag .init .text __libc_freeres_fn .fini .rodata __libc_subfreeres __libc_atexit .eh_frame .gcc_except_table
  84.   01     .tdata .ctors .dtors .jcr .data.rel.ro .got .got.plt .data .bss __libc_freeres_ptrs
  85.   02     .note.ABI-tag
  86.   03     .tdata .tbss
  87.   04    
  88.  
  89. // These are the DONTs..
  90.  
  91. There are no section groups in this file.
  92. There is no dynamic section in this file.
  93. There are no relocations in this file.
  94. There are no unwind sections in this file.
  95. No version information found in this file.
  96.  
  97. Notes at offset 0x000000d4 with length 0x00000020:
  98.   Owner         Data size       Description
  99.   GNU           0x00000010      NT_VERSION (version)
  100.  
  101.  
  102. // Is in VT...ps:  I didn't upload this..
  103.  
  104. [34]VirusTotal https://www.virustotal.com/en/file/92c87b7bddb66de8a5a27d944b5d4b46c59b38047b8a5fc381118c615c3775f9/analysis/1406605801/
  105. SHA256: 92c87b7bddb66de8a5a27d944b5d4b46c59b38047b8a5fc381118c615c3775f9
  106. File name: txmap
  107. Detection ratio: 10 / 53
  108. Analysis date: 2014-07-19 23:16:24 UTC ( 1 week, 2 days ago )
  109. First submission 2014-07-19 23:16:24 UTC ( 1 week, 2 days ago )
  110. Last submission 2014-07-19 23:16:24 UTC ( 1 week, 2 days ago )
  111.  
  112. // Detected as, guess what? "Elknot"
  113.  
  114. Antivirus                 Result             Update
  115.    Avast                ELF:Elknot-N [Trj]          20140719
  116.    ClamAV               Unix.Trojan.Elknot-1        20140719
  117.    DrWeb                Linux.DDoS.6                20140719
  118.    ESET-NOD32           Linux/Agent.F.Gen           20140719
  119.    Ikarus               DoS.Linux.Elknot            20140719
  120.    Jiangmin             Backdoor/Linux.ju           20140719
  121.    Kaspersky            Backdoor.Linux.Mayday.g     20140719
  122.    Microsoft            DoS:Linux/Elknot.G          20140719
  123.    Sophos               Linux/DDoS-AZ               20140719
  124.    VIPRE                Backdoor.Linux.Elknot.f (v) 20140720
  125.  
  126. // etc:
  127. File size 2.4 MB ( 2492148 bytes )
  128. File type ELF, Magic literal
  129. ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
  130. statically linked, for GNU/Linux 2.6.9, stripped
  131.  
  132. // Binary check..
  133.    MIMEType
  134.    application/octet-stream
  135.    CPUByteOrder
  136.    Little endian
  137.    CPUArchitecture
  138.    32 bit
  139.    FileType
  140.    ELF executable
  141.    FileAccessDate
  142.    2014:07:20 00:17:03+01:00
  143.    ObjectFileType
  144.    Executable file
  145.    CPUType
  146.    i386
  147.    FileCreateDate
  148.    2014:07:20 00:17:03+01:00
  149.  
  150. /---------------/
  151. / First analysis/
  152. /---------------/
  153.  
  154. // Compiler Source file:
  155.  
  156. Fake.cpp
  157. Global.cpp
  158. main.cpp
  159. Manager.cpp
  160. ServerIP.cpp
  161. StatBase.cpp
  162. ThreadAttack.cpp
  163. ThreadHostStatus.cpp
  164. ThreadTaskManager.cpp
  165. ThreadTimer.cpp
  166. AutoLock.cpp
  167. FileOp.cpp
  168. Log.cpp
  169. Md5.cpp
  170. Media.cpp
  171. NetBase.cpp
  172. ThreadCondition.cpp
  173. Thread.cpp
  174. ThreadMutex.cpp
  175. Utility.cpp
  176.  
  177.  
  178. // UNIX path slurped:
  179.  
  180. /bin/sh
  181. /cpuinfo
  182. /dev/console
  183. /dev/full
  184. /dev/log
  185. /dev/null
  186. /dev/tty
  187. /etc/fstab
  188. /etc/host.conf
  189. /etc/ld.so.cache
  190. /etc/localtime
  191. /etc/mtab
  192. /etc/nsswitch.conf
  193. /etc/resolv.conf
  194. /etc/suid-debug
  195. /gcof
  196. /lib/
  197. /lib/obsolete/linuxthreads/
  198. /loc
  199. /locale.alias
  200. /meminfo
  201. /proc
  202. /proc/
  203. /proc/%d/exe
  204. /proc/cpuinfo
  205. /proc/cpuinfo
  206. /proc/meminfo
  207. /proc/net
  208. /proc/net/dev
  209. /proc/self/exe
  210. /proc/self/exe
  211. /proc/self/maps
  212. /proc/self/maps
  213. /proc/stat
  214. /proc/stat
  215. /proc/sys/kernel/ngroups_max
  216. /proc/sys/kernel/ngroups_max
  217. /proc/sys/kernel/osrelease
  218. /proc/sys/kernel/osrelease
  219. /proc/sys/kernel/rtsig-max
  220. /proc/sys/kernel/rtsig-max
  221. /proc/sys/kernel/version
  222. /staf
  223. /usr
  224. /usr/lib/
  225. /usr/lib/gconv
  226. /usr/lib/gconv/gconv-modules.cache
  227. /usr/lib/locale
  228. /usr/lib/locale/locale-archive
  229. /usr/libexec/getconf
  230. /usr/lib/gconv/gconv-modules.cache
  231. /usr/lib/locale
  232. /usr/lib/locale/locale-archive
  233. /usr/libexec/getconf
  234. /usr/share/locale
  235. /usr/share/zoneinfo
  236. /var/profile
  237. /var/run/nscd/socket
  238. /var/tmp
  239.  
  240. // Where & how it was compiled:
  241. GCC: (GNU) 4.0.0 20050519 (Red Hat 4.0.0-8)
  242.  
  243. // And the compat:
  244. GCC: (GNU) 4.2.1
  245.  
  246. // Variable templates:
  247. cp %s %s
  248. %s %s 1
  249. cp %s %sa
  250. %m/%d/%y
  251. %H:%M
  252. %H:%M:%S
  253. %.*Lf
  254. =t%j
  255. ^2XX%
  256. 2I%%
  257. Arena %d:
  258. system bytes     = %10u
  259. in use bytes     = %10u
  260. max mmap regions = %10u
  261. max mmap bytes   = %10lu
  262. *** glibc detected *** %s: %s: 0x%s ***
  263. %Y-%m-%d
  264. %I:%M:%S %p
  265. <%d>
  266. syslog: unknown facility/priority: %x
  267. MemFree: %ld kB
  268. MemTotal: %ld kB
  269. %a %b %e %H:%M:%S %Y
  270. %a %b %e %H:%M:%S %Z %Y
  271. %p%t%g%t%m%t%f
  272. %a%N%f%N%d%N%b%N%s %h %e %r%N%C-%z %T%N%c%N
  273. +%c %a %l
  274. !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
  275. *** %n in writable segment detected ***
  276. *** invalid %N$ use detected ***
  277. %[^0-9,+-]
  278. %hu:%hu:%hu
  279. M%hu.%hu.%hu%n
  280. file=%s [%lu];  generating link map
  281.   dynamic: 0x%0*lx  base: 0x%0*lx   size: 0x%0*Zx
  282.     entry: 0x%0*lx  phdr: 0x%0*lx  phnum:   %*u
  283. file=%s [%lu];  needed by %s [%lu]
  284. find library=%s [%lu]; searching
  285.                (%s from file %s)
  286.                (%s)
  287.   trying file=%s
  288.  search cache=%s
  289. symbol=%s;  lookup in file=%s [%lu]
  290. file=%s [%lu];  needed by %s [%lu] (relocation dependency)
  291. binding file %s [%lu] to %s [%lu]: %s symbol `%s'
  292. [%s]
  293. %s: Symbol `%s' has different size in shared object, consider re-linking
  294. %s: no PLTREL found in object %s
  295.  
  296. %s: out of memory to store relocation results for %s
  297. relocation processing: %s%s
  298. %s: %s: %s%s%s%s%s
  299. %s: error: %s: %s (%s)
  300. %s: cannot open file: %s
  301.  
  302. %s: cannot create file: %s
  303. %s: cannot map file: %s
  304. %s: cannot stat file: %s
  305. %s: file is no correct profile data file for `%s'
  306. %s%s%s
  307. %s%s%s: %s
  308. opening file=%s [%lu]; direct_opencount=%u
  309. closing file=%s; direct_opencount=%u
  310. file=%s [%lu];  destroying link map
  311. calling fini: %s [%lu]
  312. cannot load auxiliary `%s' because of empty dynamic string token substitution
  313. load auxiliary object=%s requested by file=%s
  314. load filtered object=%s requested by file=%s
  315. calling init: %s
  316. calling preinit: %s
  317. checking for version `%s' in file %s [%lu] required by file %s [%lu]
  318. @%,1
  319.  t%~
  320. _u%1
  321. st(j%R
  322. J<%u
  323. ZY@t%
  324. |%u;
  325. %s:%s
  326. %d:%d
  327. cpu MHz         : %d.%d
  328. cpu %llu %llu %llu %llu
  329. %s %llu %llu %llu %llu
  330. %7s %llu %lu %lu %lu %lu %lu %lu %lu %llu %lu %lu %lu %lu %lu %lu %lu
  331. (%d)
  332. [ %02d.%02d %02d:%02d:%02d.%03ld ] [%lu] [%s] %s
  333. %02x
  334. %lld
  335. %d.%d.%d.%d
  336. /proc/%d/exe
  337. %m/%d/%y
  338.  
  339. %H:%M
  340. %H:%M:%S
  341. %.*Lf
  342. =t%j
  343. ^2XX%
  344. 2I%%
  345. Arena %d:
  346. system bytes     = %10u
  347. in use bytes     = %10u
  348. max mmap regions = %10u
  349. max mmap bytes   = %10lu
  350. *** glibc detected *** %s: %s: 0x%s ***
  351. %[^0-9,+-]
  352. %hu:%hu:%hu
  353. M%hu.%hu.%hu%n
  354. %Y-%m-%d
  355. %I:%M:%S %p
  356. <%d>
  357. %h %e %T
  358. [%d]
  359. syslog: unknown facility/priority: %x
  360. MemTotal: %ld kB
  361. MemFree: %ld kB
  362. %d.%d.%d.%d
  363. opening file=%s [%lu]; direct_opencount=%u
  364. calling fini: %s [%lu]
  365. closing file=%s; direct_opencount=%u
  366. file=%s [%lu];  destroying link map
  367. %a %b %e %H:%M:%S %Y
  368. %a %b %e %H:%M:%S %Z %Y
  369. %p%t%g%t%m%t%f
  370. %a%N%f%N%d%N%b%N%s %h %e %r%N%C-%z %T%N%c%N
  371. +%c %a %l
  372. !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
  373. *** %n in writable segment detected ***
  374. *** invalid %N$ use detected ***
  375. %s %s %s %s %d %d
  376. %d %d
  377. %s: line %d: expected `on' or `off', found `%s'
  378. %s: line %d: cannot specify more than %d trim domains
  379. %s: line %d: list delimiter not followed by domain
  380. %s: line %d: expected service, found `%s'
  381. %s: line %d: cannot specify more than %d services
  382. %s: line %d: list delimiter not followed by keyword
  383. %s: line %d: bad command `%s'
  384. %s: line %d: ignoring trailing garbage `%s'
  385.                (%s from file %s)
  386.                (%s)
  387.   trying file=%s
  388. file=%s [%lu];  generating link map
  389.   dynamic: 0x%0*lx  base: 0x%0*lx   size: 0x%0*Zx
  390.     entry: 0x%0*lx  phdr: 0x%0*lx  phnum:   %*u
  391. file=%s [%lu];  needed by %s [%lu]
  392. find library=%s [%lu]; searching
  393.  search cache=%s
  394. symbol=%s;  lookup in file=%s [%lu]
  395. file=%s [%lu];  needed by %s [%lu] (relocation dependency)
  396. binding file %s [%lu] to %s [%lu]: %s symbol `%s'
  397. [%s]
  398. %s: Symbol `%s' has different size in shared object, consider re-linking
  399. %s: no PLTREL found in object %s
  400. %s: out of memory to store relocation results for %s
  401. relocation processing: %s%s
  402. cannot load auxiliary `%s' because of empty dynamic string token substitution
  403. load auxiliary object=%s requested by file=%s
  404. load filtered object=%s requested by file=%s
  405. %s: %s: %s%s%s%s%s
  406. %s: error: %s: %s (%s)
  407. calling init: %s
  408. calling preinit: %s
  409. checking for version `%s' in file %s [%lu] required by file %s [%lu]
  410. %s: cannot open file: %s
  411. %s: cannot stat file: %s
  412. %s: cannot create file: %s
  413. %s: cannot map file: %s
  414. %s: file is no correct profile data file for `%s'
  415. %s%s%s
  416. %s%s%s: %s
  417.  
  418. // Some strings: (i have strong reason pasting this part)
  419.  
  420. 0x00002B1   XZj/S
  421. 0x00002D2   SWh{o
  422. 0x0013755   P <*t
  423. 0x00139C5   P <*t
  424. 0x0017CFC   t   8Y%
  425. 0x001E404   t   8X%
  426. 0x001F730   t   8Q%
  427. 0x0021A0B   t   8X%
  428. 0x00229C3   t   8A%
  429. 0x00233A5   /~|;U
  430. 0x00236AA   t   8Y%
  431. 0x00240E5   /~|;U
  432. 0x00243EA   t   8Y%
  433. 0x0032FF2   P0<%u
  434. 0x00344BA   <EtK<OtG
  435. 0x003C6E7   t   ;p(
  436. 0x003F76D   t   ;Y(
  437. 0x00404A7   t   9r(
  438. 0x00411AF   t   9X(
  439. 0x00413F4   t   ;Z(
  440. 0x0041F2F   t   9X(
  441. 0x0042174   t   ;Z(
  442. 0x0042EAE   t   ;r(
  443. 0x0043A27   t   9Z(
  444. 0x0047F25   9E wn
  445. 0x00487A8    t8f=
  446. 0x004CB20   ;M tL
  447. 0x004DA3C   CUNG5
  448. 0x004DAF1   CUNG5
  449. 0x004DF70   CUNG5
  450. 0x004DFCD   B4CUNG
  451. 0x004E9BD   CUNG5
  452. 0x0058F4B   H ;H$}
  453. 0x0058FBA   <   w=1
  454. 0x005917E   <.t;<_t7<$t3
  455. 0x0059EC5   <Gt]<TtY
  456. 0x005A2CF   <nte1
  457. 0x005A814   le ff
  458. 0x005B0E1   e fof
  459. 0x005B137   nk tf
  460. 0x005B71A   le ff
  461. 0x005B7AF   ss ff
  462. 0x005C331   <tj9F
  463. [... BLAH!..too long to pastebin... cut!! ]
  464. 0x026019B   GCC: (GNU) 4.2.1
  465. 0x02601AD   GCC: (GNU) 4.2.1
  466. 0x02601BF   GCC: (GNU) 4.2.1
  467. 0x02601D1   GCC: (GNU) 4.2.1
  468. 0x02601E3   GCC: (GNU) 4.2.1
  469. 0x02601F5   GCC: (GNU) 4.2.1
  470. 0x0260207   GCC: (GNU) 4.2.1
  471. 0x0260219   GCC: (GNU) 4.2.1
  472. 0x026022B   GCC: (GNU) 4.2.1
  473. 0x026023D   GCC: (GNU) 4.2.1
  474. 0x026024F   .shstrtab
  475. 0x0260259   .note.ABI-tag
  476. 0x0260267   .init
  477. 0x026026D   .text
  478. 0x0260273   __libc_freeres_fn
  479. 0x0260285   .fini
  480. 0x026028B   .rodata
  481. 0x0260293   __libc_subfreeres
  482. 0x02602A5   __libc_atexit
  483. 0x02602B3   .eh_frame
  484. 0x02602BD   .gcc_except_table
  485. 0x02602CF   .tdata
  486. 0x02602D6   .tbss
  487. 0x02602DC   .ctors
  488. 0x02602E3   .dtors
  489. 0x02602EF   .data.rel.ro
  490. 0x0260301   .got.plt
  491. 0x026030A   .data
  492. 0x0260315   __libc_freeres_ptrs
  493. 0x0260329   .comment
  494.  
  495. /-----------------/
  496. / Reversing Notes /
  497. /-----------------/
  498.  
  499. // Chinese??
  500. Yep it's Chinese ...
  501. 0x8223C38   aINZD       db 'エエスィヤュハシフラスモラヨハァーワ(%d)',0Dh,0Ah,0 (bear the buggy UTF)
  502. 0x004DFCD   0x004DFCD   B4CUNG
  503. 0x004E9BD   0x004E9BD   CUNG5
  504. 0x00D3C20   0x00D3C20   i18n:1999
  505.  
  506. // Compiled by?
  507. It was having compat gcc 4.0.0 (gcc 4.0.0-8) at redhat distro
  508. for compiler itself.. the GCC: (GNU) version 4.2.1 used.
  509.  
  510. // DDoS tool?
  511. Yes..With a task management tool, there is related to the money/ballance...
  512. users and groups accounts..with keys and key validation..
  513.  
  514. /-------------------/
  515. / Disassembler tips /
  516. /-------------------/
  517. In reversing this malware..You cannot see what it is without a good disassembler tool.
  518. Fnctions are-address based.
  519. Be careful of the start point trap:
  520.  
  521. Go to: start () to be hammered by this :
  522.   xor     ebp, ebp
  523.   pop     esi
  524.   mov     ecx, esp
  525.   and     esp, 0FFFFFFF0h
  526.   push    eax
  527.   push    esp
  528.   push    edx
  529.   push    offset sub_80A9700
  530.   push    offset sub_80A9740
  531.   push    ecx
  532.   push    esi
  533.   push    offset sub_804826
  534.  
  535. // and trail the call that hooked Linux syscall after that and figured each function one by one.
  536. // I made the table for  it each time.
  537. // i.e. In reversing routes start-hint/method to follow:
  538. 0x80A8FC0 start!
  539. 0x80D8380 switch 31 cases: 0x21, 0x20, 17, 11, 6, 10, E, D , C ,B , 5, 3
  540. 0x80D4290 LINUX - sys_newuname
  541. 0x80A91E8 Read: "/proc/sys/kernel/osrelease"
  542. 0xsub_80D5450 LINUX - sys_read
  543. (etc..)
  544.  
  545. // or follow .rodata that's called:
  546. // i.e.2.  writing err dumps ...contents;
  547. .rodata:0810DC74 aLibc_fatal_std db 'LIBC_FATAL_STDERR_',0
  548. .rodata:0810DC87 aDevTty         db '/dev/tty',0        
  549. .rodata:0810DC90 aBacktrace      db '======= Backtrace: =========',0Ah,0
  550. .rodata:0810DC90                                        
  551. .rodata:0810DCAE aMemoryMap      db '======= Memory map: ========',0Ah,0
  552. .rodata:0810DCAE                                        
  553. .rodata:0810DCCC aProcSelfMaps   db '/proc/self/maps',0  
  554. .rodata:0810DCCC                                        
  555. .rodata:0810DCDC aCcs            db ',ccs=',0            
  556. .rodata:0810DCE2                 align 4
  557. .rodata:0810DCE4                 dd 7 dup(0)
  558. .rodata:0810DD00 dword_810DD00   dd 2 dup(0)            
  559. .rodata:0810DD00                                        
  560.  
  561. /---------------/
  562. /   Debug       /
  563. /---------------/
  564.  
  565. // launched by this parrent:
  566. execve("./MALWARE", ["./MALWARE"], [/* 16 vars */]) = 0
  567. [ Process PID=28480 runs in 32 bit mode. ]
  568. uname({sys="Linux", node="1x111", ...}) = 0
  569. brk(0)                                  = 0x90fc000
  570. brk(0x90fccb0)                          = 0x90fccb0
  571. set_thread_area(0xfff95c2c)             = 0
  572. brk(0x911dcb0)                          = 0x911dcb0
  573. brk(0x911e000)                          = 0x911e000
  574. readlink("/proc/self/exe", "../mmd/test/MALWARE", 1024) = 18
  575. rt_sigaction(SIGINT, {SIG_IGN, [], 0}, {SIG_DFL, [], 0}, 8) = 0
  576. rt_sigaction(SIGQUIT, {SIG_IGN, [], 0}, {SIG_DFL, [], 0}, 8) = 0
  577. rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
  578. clone(child_stack=0, flags=CLONE_PARENT_SETTID|SIGCHLD, parent_tidptr=0xfff94ff4) = 28481
  579. waitpid(28481, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 28481
  580. rt_sigaction(SIGINT, {SIG_DFL, [], 0}, NULL, 8) = 0
  581. rt_sigaction(SIGQUIT, {SIG_DFL, [], 0}, NULL, 8) = 0
  582. rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
  583. --- SIGCHLD (Child exited) @ 0 (0) ---
  584. clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0) = 28483
  585. rt_sigaction(SIGINT, {SIG_IGN, [], 0}, {SIG_DFL, [], 0}, 8) = 0
  586. rt_sigaction(SIGQUIT, {SIG_IGN, [], 0}, {SIG_DFL, [], 0}, 8) = 0
  587. rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
  588. clone(child_stack=0, flags=CLONE_PARENT_SETTID|SIGCHLD, parent_tidptr=0xfff94ff4) = 28484
  589. waitpid(28484, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 28484
  590. rt_sigaction(SIGINT, {SIG_DFL, [], 0}, NULL, 8) = 0
  591. rt_sigaction(SIGQUIT, {SIG_DFL, [], 0}, NULL, 8) = 0
  592. rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
  593. --- SIGCHLD (Child exited) @ 0 (0) ---
  594. clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0) = 28486
  595. exit_group(0)  // Put breakpoint before forking started
  596.  
  597. // examine:
  598. // new process forked:
  599.  
  600. 28488 ?        Ssl    0:00 [sam]
  601.  
  602. // freezed all and check sockets, and voila!
  603.  
  604. COMMAND   PID USER   FD   TYPE  DEVICE SIZE/OFF     NODE NAME
  605. sam     28756  mmd  cwd    DIR     9,2     4096 29757163 /home/mmd/test
  606. sam     28756  mmd  rtd    DIR     9,2     4096        2 /
  607. sam     28756  mmd  txt    REG     9,2  1480387 29763093 /home/mmd/test/MALWARE (deleted)
  608. sam     28756  mmd    0u   CHR     1,3      0t0     1027 /dev/null
  609. sam     28756  mmd    1u   CHR     1,3      0t0     1027 /dev/null
  610. sam     28756  mmd    2u   CHR     1,3      0t0     1027 /dev/null
  611. sam     28756  mmd    3u  IPv4 7932614      0t0      TCP serpico.malwaremustdie.org:60162->183.60.202.59:10991 (ESTABLISHED)
  612.  
  613. // INET sockets:
  614. tcp        0     27 78.46.37.69:60224       183.60.202.59:10991     ESTABLISHED 29547/
  615.  
  616. // CNC
  617. $ echo 183.60.202.59 | bash /malware/checkdomains/origin.sh
  618. 183.60.202.59||4134 | 183.0.0.0/10 | CHINANET | CN | CHINATELECOM.COM.CN | CHINANET GUANGDONG PROVINCE NETWORK
  619.  
  620. // DDoS PoC (Amplification) recorded:
  621.  1 11018 11020 mmd 3u IPv4 19591952 0t0 TCP x.x.x.x:44103->1.1.1.1:sunrpc (SYN_SENT)
  622.  
  623. ----
  624. #MalwareMustDie! | analysis by @unixfreaxjp
  625. sample credit to Officer Ken Pryor
RAW Paste Data
Top