Rewterz Threat Advisory – Oracle Solaris Multiple Third Party Components Multiple Vulnerabilities
May 31, 2019Rewterz Threat Alert – TA505 APT Group Phishing Campaign
June 3, 2019Rewterz Threat Advisory – Oracle Solaris Multiple Third Party Components Multiple Vulnerabilities
May 31, 2019Rewterz Threat Alert – TA505 APT Group Phishing Campaign
June 3, 2019Severity
High
Analysis Summary
A new Linux malware, dubbed “HiddenWasp”, that installs a backdoor for remote control. The malware begins with a script that is used to create a user account, clean the system of old variants, and download a tarball file from a remote server. This tarball contains the initial deployment script, the trojan binary, and the rootkit. The script executes the binary, adds the rootkit to the LD_PRELOAD path, and configures the necessary environment variables. It finishes executing by establishing persistence via an entry in /etc/rc.local. If the required environment variables are set, the user-space rootkit runs a function to hide malicious artifacts and associated network connections. The binary, which shares strings with ChinaZ malware, has a main purpose of connecting to a C2 server in order to receive commands from its operator. It also has functionality to ensure that the rootkit remains operational. As part of the execution, the Trojan searches for and tries to hide certain artifacts tied to an open-source Chinese rootkit. This indicates the HiddenWasp malware targets systems that have already been infected.
Impact
Targeted remote control
Indicators of Compromise
IP(s) / Hostname(s)
- 103[.]206[.]123[.]13
- 103[.]206[.]122[.]245
URLs
- http[:]//103[.]206[.]123[.]13:8080/system[.]tar[.]gz
- http[:]//103[.]206[.]123[.]13:8080/configUpdate[.]tar[.]gz
- http[:]//103[.]206[.]123[.]13:8080/configUpdate-32[.]tar[.]gz
Malware Hash (MD5/SHA1/SH256)
- e9e2e84ed423bfc8e82eb434cede5c9568ab44e7af410a85e5d5eb24b1e622e3
- f321685342fa373c33eb9479176a086a1c56c90a1826a0aef3450809ffc01e5d
- d66bbbccd19587e67632585d0ac944e34e4d5fa2b9f3bb3f900f517c7bbf518b
- 0fe1248ecab199bee383cef69f2de77d33b269ad1664127b366a4e745b1199c8
- 2ea291aeb0905c31716fe5e39ff111724a3c461e3029830d2bfa77c1b3656fc0
- d596acc70426a16760a2b2cc78ca2cc65c5a23bb79316627c0b2e16489bf86c0
- 609bbf4ccc2cb0fcbe0d5891eea7d97a05a0b29431c468bf3badd83fc4414578
- 8e3b92e49447a67ed32b3afadbc24c51975ff22acbd0cf8090b078c0a4a7b53d f38ab11c28e944536e00ca14954df5f4d08c1222811fef49baded5009bbbc9a2
- 8914fd1cfade5059e626be90f18972ec963bbed75101c7fbf4a88a6da2bc671b
Affected Vendors
Linux
Remediation
Block threat indicators at your respective controls.