Rewterz Threat Alert – LiquorBot Botnet

Friday, January 10, 2020

Severity

Medium

Analysis Summary

A Mirai-like botnet named “LiquorBot” was analyzed by Bitdefender researchers. Their blog post discusses the distribution method and goals of this botnet variant. In most cases the initial infection vector is via SSH brute-forcing, although it is also capable of exploiting several command injection and remote execution vulnerabilities. Installation of the malware begins with a dropper shell script that downloads a series of binaries from a remote server. These binaries are all LiquorBot samples but compiled for a variety of CPU architectures. Upon installation, the bot relaunches itself under the guise of the sshd daemon and subsequently clears its tracks. There are 3 servers involved in the botnet’s communication: a C2 server from which it receives commands, a mining server, and the server hosting the aforementioned binaries. The available commands include those to download and execute files or shutdown the server. Additionally, this botnet malware incorporates Monero cryptocurrency mining into its functionality.

Impact

Mine for cryptocurrency

Indicators of Compromise

SHA1

  • 14592719e2a354633131bc238f07aa0cb9cce698
  • 1611a8445085d1687c72b7e5a7c5602cbe580c8b
  • 1f15195ddc1e4174674fbf5d1fc95ed0a7726f7b
  • 2784a122089c20d5c02665da1241fe02f9ac90cc
  • 2901d4ee7f289bf0b1a863bec716d751f66a4324
  • 2d1d294aac29fab2041949d4cb5c58d3169a31d3
  • 31176239ab5187af5d89666f37038340b95a5a4e
  • 31d9ca734c5f4c1787131d3a1b6b91ca60e57794
  • 331ec23c250b86d912fa34e0e700bfcac1a7c388
  • 3453a96414e63a813b82c6d98fa3b76c1824abd8
  • 36382165bb53a7ed9387a02e5b9baee36fe23f64
  • 48c863e4ad23fb946386320f3a85391b54ba50ad
  • 49602256c8d65d0620d5abe8011a78425c7ae177
  • 54bdfa936c9eb4ea329ca35b95e471d51daef1d5
  • 5821ff8eb9b23035a520e1fb836e43b1ec87ffaf
  • 61abc90c20930c7615880ac9931778b48b9e6ebd
  • 63b556a0afcf643337310254cc7f57c729188f36
  • 65cd6a0371bdfffd7383907ba9a816e8e2e95da5
  • 6c7a92d5d68b68ddba10af7ca6350cfb24b2595f
  • 6d24c472b06e6f9ac3204ca768319d2b035a210a
  • 8364c272e0c95ed214c71dbcb48f89c468544bc8
  • 8df16857cb914f5eded0249cfde07f1c01697db1
  • a69f9f5f2ac15aec393ab68277ec268c0624fe91
  • b40f4f13b2b144946b165a2e4284c96fbc0d4682
  • b9dd4d230d103b3db458d752d4917466ec1cb9b0
  • ba55d92e3d7dba70205597433f1a98b35e4911b8
  • bb07341ab6b203687845ae38cd8c17dfc947e79f
  • c59dd90f7cefadaa80d9c0113f8af39e4ed0c1a1
  • c5adabbdbf641f3e53e3268af60ac1b26088aa6b
  • c6d850e264d7d8d6978cd85d69c22b29378e34e4
  • c7ed7241e2d21fa471b6bfd6b97b24b514b3c5f2
  • d216f33695421dfb17e69ed05aec46cf84b544b7
  • d59175ffacd8895362253a3bcb18637ced765fcd
  • d62cdd8f16a8f6b6cde5e8da633c224eab4765f2
  • e91f2d5df4ef43cb4c69b15de9a68c7ff2d4951d
  • fd65e6c5ae07c50c7d7639e2712c45324d4cf8de

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.

Data Sheets

Corporate Brochure


Our Story


Services


Solutions


Managed Security


Upcoming Rewterz Trainings/Events

Rewterz News

  • 10, January 2020 Rewterz Threat Advisory – CVE-2020-1600 – Juniper Networks Junos OS Denial of Service in the RPD daemon
  • 10, January 2020 Rewterz Threat Alert – Bank of America Phishing Campaign
  • 10, January 2020 Rewterz Threat Alert – LiquorBot Botnet
  • 10, January 2020 Rewterz Threat Advisory – CVE-2019-16005 – Cisco Webex Video Mesh Node Command Injection Vulnerability

Copyright © Rewterz. All rights reserved.