March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – CVE-2019-16005 – Cisco Webex Video Mesh Node Command Injection Vulnerability
January 10, 2020
Rewterz Threat Alert – Bank of America Phishing Campaign
January 10, 2020
Rewterz Threat Advisory – CVE-2019-16005 – Cisco Webex Video Mesh Node Command Injection Vulnerability
January 10, 2020
Rewterz Threat Alert – Bank of America Phishing Campaign
January 10, 2020
Severity
Medium
Analysis Summary
A Mirai-like botnet named “LiquorBot” was analyzed by Bitdefender researchers. Their blog post discusses the distribution method and goals of this botnet variant. In most cases the initial infection vector is via SSH brute-forcing, although it is also capable of exploiting several command injection and remote execution vulnerabilities. Installation of the malware begins with a dropper shell script that downloads a series of binaries from a remote server. These binaries are all LiquorBot samples but compiled for a variety of CPU architectures. Upon installation, the bot relaunches itself under the guise of the sshd daemon and subsequently clears its tracks. There are 3 servers involved in the botnet’s communication: a C2 server from which it receives commands, a mining server, and the server hosting the aforementioned binaries. The available commands include those to download and execute files or shutdown the server. Additionally, this botnet malware incorporates Monero cryptocurrency mining into its functionality.
Impact
Mine for cryptocurrency
Indicators of Compromise
SHA1
- 14592719e2a354633131bc238f07aa0cb9cce698
- 1611a8445085d1687c72b7e5a7c5602cbe580c8b
- 1f15195ddc1e4174674fbf5d1fc95ed0a7726f7b
- 2784a122089c20d5c02665da1241fe02f9ac90cc
- 2901d4ee7f289bf0b1a863bec716d751f66a4324
- 2d1d294aac29fab2041949d4cb5c58d3169a31d3
- 31176239ab5187af5d89666f37038340b95a5a4e
- 31d9ca734c5f4c1787131d3a1b6b91ca60e57794
- 331ec23c250b86d912fa34e0e700bfcac1a7c388
- 3453a96414e63a813b82c6d98fa3b76c1824abd8
- 36382165bb53a7ed9387a02e5b9baee36fe23f64
- 48c863e4ad23fb946386320f3a85391b54ba50ad
- 49602256c8d65d0620d5abe8011a78425c7ae177
- 54bdfa936c9eb4ea329ca35b95e471d51daef1d5
- 5821ff8eb9b23035a520e1fb836e43b1ec87ffaf
- 61abc90c20930c7615880ac9931778b48b9e6ebd
- 63b556a0afcf643337310254cc7f57c729188f36
- 65cd6a0371bdfffd7383907ba9a816e8e2e95da5
- 6c7a92d5d68b68ddba10af7ca6350cfb24b2595f
- 6d24c472b06e6f9ac3204ca768319d2b035a210a
- 8364c272e0c95ed214c71dbcb48f89c468544bc8
- 8df16857cb914f5eded0249cfde07f1c01697db1
- a69f9f5f2ac15aec393ab68277ec268c0624fe91
- b40f4f13b2b144946b165a2e4284c96fbc0d4682
- b9dd4d230d103b3db458d752d4917466ec1cb9b0
- ba55d92e3d7dba70205597433f1a98b35e4911b8
- bb07341ab6b203687845ae38cd8c17dfc947e79f
- c59dd90f7cefadaa80d9c0113f8af39e4ed0c1a1
- c5adabbdbf641f3e53e3268af60ac1b26088aa6b
- c6d850e264d7d8d6978cd85d69c22b29378e34e4
- c7ed7241e2d21fa471b6bfd6b97b24b514b3c5f2
- d216f33695421dfb17e69ed05aec46cf84b544b7
- d59175ffacd8895362253a3bcb18637ced765fcd
- d62cdd8f16a8f6b6cde5e8da633c224eab4765f2
- e91f2d5df4ef43cb4c69b15de9a68c7ff2d4951d
- fd65e6c5ae07c50c7d7639e2712c45324d4cf8de
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.