Rewterz Threat Alert – HiddenWasp Malware Affecting Linux

Severity

High

Analysis Summary

A new Linux malware, dubbed “HiddenWasp”, that installs a backdoor for remote control. The malware begins with a script that is used to create a user account, clean the system of old variants, and download a tarball file from a remote server. This tarball contains the initial deployment script, the trojan binary, and the rootkit. The script executes the binary, adds the rootkit to the LD_PRELOAD path, and configures the necessary environment variables. It finishes executing by establishing persistence via an entry in /etc/rc.local. If the required environment variables are set, the user-space rootkit runs a function to hide malicious artifacts and associated network connections. The binary, which shares strings with ChinaZ malware, has a main purpose of connecting to a C2 server in order to receive commands from its operator. It also has functionality to ensure that the rootkit remains operational. As part of the execution, the Trojan searches for and tries to hide certain artifacts tied to an open-source Chinese rootkit. This indicates the HiddenWasp malware targets systems that have already been infected.

Impact

Targeted remote control

Indicators of Compromise

IP(s) / Hostname(s)

• 103[.]206[.]123[.]13
• 103[.]206[.]122[.]245

URLs

• http[:]//103[.]206[.]123[.]13:8080/system[.]tar[.]gz
• http[:]//103[.]206[.]123[.]13:8080/configUpdate[.]tar[.]gz
• http[:]//103[.]206[.]123[.]13:8080/configUpdate-32[.]tar[.]gz

Malware Hash (MD5/SHA1/SH256)

• e9e2e84ed423bfc8e82eb434cede5c9568ab44e7af410a85e5d5eb24b1e622e3
• f321685342fa373c33eb9479176a086a1c56c90a1826a0aef3450809ffc01e5d
• d66bbbccd19587e67632585d0ac944e34e4d5fa2b9f3bb3f900f517c7bbf518b
• 0fe1248ecab199bee383cef69f2de77d33b269ad1664127b366a4e745b1199c8
• 2ea291aeb0905c31716fe5e39ff111724a3c461e3029830d2bfa77c1b3656fc0
• d596acc70426a16760a2b2cc78ca2cc65c5a23bb79316627c0b2e16489bf86c0
• 609bbf4ccc2cb0fcbe0d5891eea7d97a05a0b29431c468bf3badd83fc4414578
• 8e3b92e49447a67ed32b3afadbc24c51975ff22acbd0cf8090b078c0a4a7b53d f38ab11c28e944536e00ca14954df5f4d08c1222811fef49baded5009bbbc9a2
• 8914fd1cfade5059e626be90f18972ec963bbed75101c7fbf4a88a6da2bc671b

Affected Vendors

Linux

Remediation

Block threat indicators at your respective controls.