Hostile ^100% Download

snip_22539

Linux backdoor with iptables evasion

Native binary BPF packet shellNetwork backdoor using iptables PREROUTING REDIRECT

SHA-2564435fcd6862921092614dbeaa880e4192352984686ebcd98f0ba13ee8e226ef9

URLhttps://mb-api.abuse.ch/api/v1/

Also flagged by https://falhumaid.github.io/DFIR_Radar_RSS/rss.xml (What the BPFDoor backdoor tells us about attacks on the network edge) +3 more.

Evidence

Bind socket to address 0x818–0xa78

⋯7 more rows
0x888676973746572544d436c6f6e65546162gisterTMCloneTab
0x8986c65006f70656e707479006c6962632ele.openpty.libc.
0x8a8736f2e3600736f636b65740065786974so.6.socket.exit
0x8b800657865636c005f5f6664656c745f63.execl.__fdelt_c
0x8c8686b00696e65745f6e746f6100737472hk.inet_ntoa.str
0x8d86e63707900666f726b005f5f73746163ncpy.fork.__stac
0x8e86b5f63686b5f6661696c006c69737465k_chk_fail.liste
0x8f86e0073656c6563740067657470696400n.select.getpid.
0x90873656e64006d656d7365740062696e64send.memset.bind
0x9180072656164006d656d636d7000747479.read.memcmp.tty
0x9286e616d6500647570320073687574646fname.dup2.shutdo
0x938776e00707574656e760072656376006dwn.putenv.recv.m
0x948656d6370790072616e6400736574736femcpy.rand.setso
0x958636b6f7074006d616c6c6f6300726563ckopt.malloc.rec
0x9687666726f6d00696f63746c00616c6172vfrom.ioctl.alar
0x9786d0073797374656d005f5f736e707269m.system.__snpri
0x9886e74665f63686b006372656174006765ntf_chk.creat.ge
0x9987474696d656f66646179005f5f6d656dttimeofday.__mem
0x9a86370795f63686b007761697470696400cpy_chk.waitpid.
0x9b8636c6f7365006f70656e006163636570close.open.accep
0x9c87400736c656570005f5f737472637079t.sleep.__strcpy
0x9d85f63686b005f5f6378615f66696e616c_chk.__cxa_final
0x9e8697a6500736574736964005f5f6c6962ize.setsid.__lib
0x9f8635f73746172745f6d61696e00777269c_start_main.wri
⋯8 more rows

FORTIFY_SOURCE memcpy bounds check 0x1290–0x1550

⋯7 more rows
0x1300f30f1efaf2ff258ddb00000f1f440000......%......D..
0x1310f30f1efaf2ff2585db00000f1f440000......%......D..
0x1320f30f1efaf2ff257ddb00000f1f440000......%}.....D..
0x1330f30f1efaf2ff2575db00000f1f440000......%u.....D..
⋯15 more rows
0x1430f30f1efaf2ff25f5da00000f1f440000......%......D..
0x1440f30f1efaf2ff25edda00000f1f440000......%......D..
0x1450f30f1efaf2ff25e5da00000f1f440000......%......D..
0x1460f30f1efaf2ff25ddda00000f1f440000......%......D..
⋯3 more rows
0x14a0f30f1efaf2ff25bdda00000f1f440000......%......D..
0x14b0f30f1efaf2ff25b5da00000f1f440000......%......D..
0x14c0f30f1efaf2ff25adda00000f1f440000......%......D..
0x14d0f30f1efaf2ff25a5da00000f1f440000......%......D..
0x14e0f30f1efaf2ff259dda00000f1f440000......%......D..
⋯7 more rows

References the /bin/sh shell path 0x6cf9–0x6e79

⋯7 more rows
0x6d6913a7ffff4889c74885c00f84de010000....H..H........
0x6d79c6002fc640042fc6400162c6400573c6../.@./[email protected][email protected].
0x6d89400269c6400668c640036ec640070048@[email protected][email protected][email protected]
⋯15 more rows

Uses iptables PREROUTING REDIRECT rule 0x7057–0x7217

⋯7 more rows
0x70c77461626c657348ba202d74206e617420tablesH. -t nat 
0x70d74889442440488954244848b82d492050[email protected]$HH.-I P
0x70e75245524f48ba5554494e47202d704889REROH.UTING -pH.
0x70f7442450488954245848b8202573202d73D$PH.T$XH. %s -s
0x7107202548ba73202d2d73706f7248894424 %H.s --sporH.D$
0x711760488954246848b874202564202d2d64`H.T$hH.t %d --d
0x712748ba706f727420256420488944247048H.port %d H.D$pH
⋯4 more rows
0x71770000640048b869707461626c657348ba..d.H.iptablesH.
0x7187202d4920494e50554889442410488954 -I INPUH.D$.H.T
0x7197241848b854202d702025732048ba2d73$.H.T -p %s H.-s
0x71a7202573202d6a48894424204889542428 %s -jH.D$ H.T$(
⋯7 more rows

Numeric SO_ATTACH_FILTER option 0x75a6–0x7746

⋯7 more rows
0x7616c00f8eee0100004889e141b810000000.......H..A.....
0x7626ba1a000000be0100000089c7e8d99cff................
0x7636ff89c283f8ff0f84d4fdffff41bd0000............A...
0x76460000488db424b0000000b94000000048[email protected]
0x765689f74c89e8f348ab4d89e94d89e8ba00..L...H.M..M....
⋯15 more rows