那些和185.244.25.0/24网段有关的Botnet
<!--kg-card-begin: markdown--><p>根据我们的观察，过去几年185.244.25.0/24这个网段出现了超多的Botnet，包括但不仅限于mirai、gafgyt、tsunami、fbot、moobot、handymanny等，他们属于同一个组织或共享了相关代码。下表是过去一年我们关于该网段的一些统计数据。可以看出该网段有很多的CC和攻击行为。</p>
<table>
<thead>
<tr>
<th>Count of CC (host:port)</th>
<th>Count of attack target host</th>
<th>Count of downloader IP</th>
<th>Count of loader IP</th>
</tr>
</thead>
<tbody>
<tr>
<td>416</td>
<td>36933</td>
<td>166</td>
<td>181</td>
</tr>
</tbody>
</table>
<p>本文主要介绍和该网段有关最近比较活跃/有趣的几个Botnet家族，包括moobot、fbot、handymanny等。</p>
<p>对于其他Botnet为了方便读者了解该网段下具体有那些Botnet及其变种，我们用该网段下的Loader IP植入样本阶段使用的关键字生成一张Tag cloud图，大致反应该网段下有那些Botnet及其变种。如下图所示：<br>
<a href="__GHOST_URL__/content/images/2019/09/g185.branch.png" target="_blank"><img src="__GHOST_URL__/content/images/2019/09/g185.branch.min.png" /></a></p>
<h1 id="moobot">moobot</h1>
<p>moobot基于mirai开发。有很多个版本，根据其CC协议和编程语言的不同我们大致可将其分为moobot.socks5，moobot.tor，moobot.tor.b，moobot.go，moobot.go.tor，moobot.c等几个版本。其中moobot.c使用185.244.25.219作为Downloader，可以看出他和185.244.25.0/24网段有关。moobot各版本相关样本：</p>
<blockquote>
<h3 id="moobotsocks5">moobot.socks5</h3>
<p>First seen: 2019-07-15 10:10:47<br>
MD5: 70f1df04d4384422ba746a92940c0138<br>
Downloader: <code>http://89.248[.174.198/main/x86</code><br>
Downloader: <code>http://93.174[.93.191:80/accn/kuojin.x86</code><br>
CC: n1gger.com:23<br>
该版本的moobot 使用socks5协议和CC通信，样本扫描TCP/34567(DVRIP)，TCP/9527端口</p>
<h3 id="moobottor">moobot.tor</h3>
<p>First seen: 2019-07-17 07:41:00<br>
MD5: eebca17df98350fa127fef978a5cccde<br>
Downloader: <code>http://185.100[.84.187:80/t/t.arm7</code><br>
Reporter: audi.n1gger.com:49567<br>
CC:  nd3rwzslqhxibkl7.onion:1356<br>
CC使用tor域名，扫描34567，9527端口</p>
<h3 id="moobottorb">moobot.tor.b</h3>
<p>First seen: 2019-08-09 02:25:24<br>
MD5: 79351b97ad07f77d336e38afcb213868<br>
Downloader: <code>http://91.92[.66.192/rt/mips</code><br>
CC: typicalniggerdayatthecoolaidparty.n1gger.com TXT 91.92.66.192<br>
CC:dbkjbueuvmf5hh7z.onion:10444<br>
CC协议在mirai的基础上有微小修改</p>
<h3 id="moobotgo">moobot.go</h3>
<p>First seen: 2019-08-16 09:41:19<br>
MD5: c15fe4dc2f063b135d2bb83c35d75289<br>
Downloader: <code>http://91.92[.66.192/bins/x86</code><br>
CC: 31.13.195.56    port=18337<br>
moobot golang版本</p>
<h3 id="moobotgotor">moobot.go.tor</h3>
<p>First seen: 2019-08-20 07:38:05<br>
MD5: 168d0af614dc8513579d8436c930db76<br>
Downloader: <code>http://89.248[.174.219/moo/x86</code><br>
CC: sisuugde7gzpef2d.onion:14995<br>
moobot golang版本，CC使用tor域名</p>
<h3 id="moobotc">moobot.c</h3>
<p>First seen: 2019-08-21 02:23:48<br>
MD5: 527572a2a28807766569c0870558e807<br>
Downloader: <code>http://185.244[.25.219/bins/armv7l</code><br>
CC: typicalniggerdayatthecoolaidparty.n1gger.com TXT 31.13.195.56<br>
moobot无代理版本，CC IP和moobot.go相同，使用<code>185.244.25.219/24</code>网段ip作为downloader</p>
</blockquote>
<h2 id="moobot">moobot端口扫描及漏洞利用</h2>
<h3 id="">端口扫描</h3>
<p>当前moobot延用mirai扫描机制，Bot全网扫描，将扫描结果上报给Loader，再由Loader植入样本。从我们的<a href="https://scan.netlab.360.com/#/dashboard?tsbeg=1568815200000&amp;tsend=1569315600000&amp;dstport=1588&amp;toplistname=similardstport&amp;topn=10&amp;sortby=sum">ScanMon</a>结果看最近7天其感染IP 60K左右。值得一提的是，当前moobot扫描很多端口，包括DVRIP/ADB/HTTP/TELNET相关的端口，但单个Bot样本并不同时扫描所有端口，而是由多个不同的Bot样本共同完成这些端口扫描。这也许是为了提高Bot扫描效率？当前moobot主要扫描以下端口：</p>
<ul>
<li>DVRIP/34567</li>
<li>HTTP/80, 81, 82, 83, 84, 85, 88, 1588, 5984, 8000, 8080, 8081, 8181, 8888, 9090, 9200, 60001[<a href="https://twitter.com/MasafumiNegishi/status/1175988802805846016">1]</a>。对于HTTP服务，Bot查找如下图所示的HTTP Server，然后上报给Loader用来后续植入样本。<br>
<a href="__GHOST_URL__/content/images/2019/09/moo_banner.png"><img src="__GHOST_URL__/content/images/2019/09/moo_banner.png" class="kg-image"/></a></li>
<li>ADB/5555</li>
<li>TELNET/23</li>
</ul>
<p>扫描源地理位置分布：</p>
<pre><code>   7913 Brazil
   5749 China
   5305 Viet Nam
   4514 Thailand
   4510 Uruguay
   3685 Italy
   3070 Russian Federation
   2440 Argentina
   2410 Turkey
   2073 Malaysia
   2068 Republic of Korea
   1783 India
   1594 Germany
   1554 United States
   1433 Iran
   1132 Mexico
   1062 Spain
    967 United Kingdom
    946 Morocco
    937 Greece
    798 Indonesia
    782 Venezuela
    774 Pakistan
    758 Romania
    632 Japan
    577 Chile
    497 Poland
    477 Qatar
    472 South Africa
    456 Israel
    455 Dominican
    417 Ukraine
    415 Colombia
    407 Egypt
    376 Hungary
    370 Tunisia
    322 France
    295 Kazakhstan
    279 Saudi Arabia
    273 Australia
    271 Singapore
    244 Bulgaria
    232 United Arab Emirates
    185 Canada
    136 Jordan
    120 Oman
    114 Serbia
    112 Portugal
    101 Puerto Rico
</code></pre>
<h3 id="">漏洞利用</h3>
<p>moobot对于HTTP，ADB，TELNET的利用都是已知的，这里不在獒述。下面主要说明其对DVRIP(port 34567)协议的漏洞利用。我们发现最早利用这个漏洞的是<a href="__GHOST_URL__/the-new-developments-of-the-fbot-en/">Fbot</a>，但当时没有详细说明该漏洞是如何利用的，下面对这部分作简要说明。moobot主要利用DVRIP升级接口上传升级文件，执行升级文件中的shell命令完成后门开启，然后通过该后门后门植入恶意样本，过程大致如下：</p>
<ul>
<li>
<p>构造名为InstallDesc的DVRIP升级配置压缩文件。主要内容如下，可以看出该配置主要为了执行<code>telnetd -p 9001 -l /bin/sh</code>开启后门，此处后门端口为TCP/9001：<br>
<a href="__GHOST_URL__/content/images/2019/09/moo_telnet.png"><img src="__GHOST_URL__/content/images/2019/09/moo_telnet.png" class="kg-image"/></a></p>
</li>
<li>
<p>利用DVRIP默认密码登录目标设备<br>
<img src="__GHOST_URL__/content/images/2019/09/moobot.dvrip.png" alt="moobot.dvrip" loading="lazy"></p>
</li>
<li>
<p>通过DVRIP升级接口上传升级文件InstallDesc到目标设备<br>
<img src="__GHOST_URL__/content/images/2019/09/dvrip.upgrade.png" alt="dvrip.upgrade" loading="lazy"></p>
</li>
<li>
<p>DVRIP服务执行升级过程，执行升级配置文件中的shell命令，开启后门</p>
</li>
<li>
<p>Loader通过该后门植入Bot样本</p>
</li>
</ul>
<h2 id="moobot">moobot相关的攻击事件</h2>
<p>我们观察到moobot攻击了很多流行站点/重要服务。包括DNS ROOT，Twitter, Facebook, Pornhub, <a href="https://wikimediafoundation.org/news/2019/09/07/malicious-attack-on-wikipedia-what-we-know-and-what-were-doing/">Wikimedia</a>, <a href="https://twitter.com/MasafumiNegishi/status/1170881367871082497">Twitch, World of Warcraft Server</a>, Google，Baidu， Alibaba，Krebs on Security等。攻击这么多流行站点的目的据一名为<a href="https://www.genelmag.com/article/ddos-attack-on-twitch-and-wow-servers">UKDrillas</a>的黑客或客户组织称是为了测试该Botnet的攻击效果。部分moobot攻击目标对应的SLD如下图所示:<br>
<a href="__GHOST_URL__/content/images/2019/09/atk.sld.png" target="_blank"><img src="__GHOST_URL__/content/images/2019/09/atk.sld.min-1.png" /></a></p>
<h2 id="moobot">moobot加密方式</h2>
<p>moobot资源加密使用和<a href="__GHOST_URL__/the-new-developments-of-the-fbot-en/">fbot</a>相似的加密方式。加密方式为码表替换，字串反序，无XOR，解密代码如下(相关样本<code>0f8c6a64bac73e83eef94b3ec333c93a</code>)：</p>
<pre><code>tab1_enc = '''
AA AB AC AD AE AF BA BB BC BD BE BF CA CB CC CD CE 
CF DA DB DC DE DF EA EB EC ED EF FA FB FC FD FE FF 
A1 A2 A3 A4 A5 A6 A7 A8 A9 B1 B2 B3 B4 B5 B6 B7 B8 
B9 C1 C2 C3 C4 C5 C6 C7 C8 C9 D1 D2 D3 D4 D5 D6 D7 
D8 D9 E1 E2 E3 E4 E5 E6 E7 E8 E9 F1 F2 F3 F4 F5 F6
'''.replace(' ', '').replace('\n','').decode('hex')

tab2_enc = '''
7A 37 75 4E 42 63 33 20 61 32 4C 54 23 76 4A 48 38 
49 25 62 46 77 6B 68 2F 22 73 3B 55 24 65 53 3A 44 
5A 43 6A 45 6D 59 78 57 70 74 7C 6F 3E 26 66 64 2D 
35 47 39 71 52 4D 40 7E 34 51 30 79 58 6C 67 41 4B 
50 36 69 31 56 72 4F 5C 29 5D 2E 28 5B 6E 7B 7D 2C
'''.replace(' ', '').replace('\n','').decode('hex')

def decode(indata):
    res = ''
    for i in indata:
        res += chr(ord(i)^0x00)
    return res
tab1 = decode(tab1_enc)
tab2 = decode(tab2_enc)
def getK(c):
    for i in range(0, len(tab1)):
        if c == tab1[i]:
            return i
    return -1

def decrypt(pointer):
    res = &quot;&quot;
    for v12 in pointer:
        res += tab2[getK(v12)]
    return res
</code></pre>
<p>解密示例</p>
<pre><code>slogan='''
B3 B3 A5 BB ED D2 BC ED BB DE B3 AF BB FC EA BF
'''.replace(' ', '').replace('\n','').decode('hex')
c2_addr='''
A5 B3 AF E9 E4 FC D5 D5 E2 F3 E9 D2 B1 E4 BC A9 
B7 E1 BC D4 B3 B3 AF FC EA B1 B1 BC D2 BC B7 E4 
FC D5 D5 E1 F3 D4 BC AF E1 A9 D2 B1
'''.replace(' ', '').replace('\n','').decode('hex')

print (decrypt(slogan)[::-1])
#The cow says moo
print (decrypt(c2_addr)[::-1])
#typicalniggerdayatthecoolaidparty.n1gger.com

</code></pre>
<h1 id="fbot">fbot</h1>
<p>fbot和moobot.go.tor使用相同的Downloader<code>89.248.174.219</code>，相似的加密技术，CC域名都使用TXT记录等特点。我们认为fbot和moobot是有关系的。属于同一个组织或者不同组织共享相关的代码。相关样本：</p>
<blockquote>
<p>First seen: 2019-08-15 06:35:15<br>
MD5: beab327053b17556e80338efdf0b2e19<br>
Downloader: <code>http://89.248[.174.219:80/bins/x86</code><br>
CC: ohyaya.raiseyourdongers.pw TXT  5.206.227.65</p>
</blockquote>
<h2 id="fbot">fbot加密方式</h2>
<p>fbot资源加密方式为码表替换，XOR加密，解密代码如下：</p>
<pre><code>tab1_enc = '''
14 15 0A 1D 1F 08 0E 00 01 17 1A 03 0B 09 16 
12 1E 10 0C 0D 18 1B 0F 11 1C 13 2D 3F 28 36 
34 38 3C 3A 31 35 20 37 2C 3D 2E 2F 33 2B 21 
30 3E 32 23 2A 3B 29 6E 61 60 69 6B 6C 6D 68 6F 6A 64 19 07 7D
'''.replace(' ', '').replace('\n','').decode('hex')

tab2_enc = '''
18 1B 1A 1D 1C 1F 1E 11 10 13 12 15 14 17 16 
09 08 0B 0A 0D 0C 0F 0E 01 00 03 38 3B 3A 3D 
3C 3F 3E 31 30 33 32 35 34 37 36 29 28 2B 2A 
2D 2C 2F 2E 21 20 23 69 68 6B 6A 6D 6C 6F 6E 61 60 77 76 79 74
'''.replace(' ', '').replace('\n','').decode('hex')

def decode(indata):
    res = ''
    for i in indata:
        res += chr(ord(i)^0x59)
    return res
tab1 = decode(tab1_enc)
tab2 = decode(tab2_enc)
def getK(c):
    for i in range(0, len(tab1)):
        if c == tab1[i]:
            return i
    return -1

def decrypt(pointer):
    res = &quot;&quot;
    for v12 in pointer:
        res += tab2[getK(v12)]
    return res

</code></pre>
<p>解密示例</p>
<pre><code>c2=&quot;wcbtbt=rthxmbwgrowdemrx=vz&quot;
print decrypt(c2)
#ohyaya.raiseyourdongers.pw
</code></pre>
<p>如果想了解更多fbot的信息可翻阅我们以前的相关文章。[<a href="__GHOST_URL__/the-new-developments-of-the-fbot-en/">1]</a>[<a href="__GHOST_URL__/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/">2]</a></p>
<h1 id="handymanny">handymanny</h1>
<p><a href="https://twitter.com/liuya0904/status/1171633662502350848">handymanny</a>和brickbot、Silex等Botnet类似，主要是破坏目标设备系统，让目标设备无法正常工作。样本由Loader通过telnet植入，Loader IP<code>185.244.25.200</code>，这说明handymanny和185.244.25.200/24网段也是有关的。相关样本：</p>
<blockquote>
<p>First seen: 2019-09-08 20:03:11<br>
MD5: 1fcfcb14304c586f12dc410546a3a5b7<br>
Downloader: <code>http://185.112[.82.89:80/bins/arm.handymanny</code><br>
Loader IP: 185.244.25.200<br>
CC: 185.112.82.89:123</p>
</blockquote>
<p>其破坏目标系统相关操作如下图所示：<br>
<img src="__GHOST_URL__/content/images/2019/09/EEJ6l6AXkAECNgY.min.png" alt="EEJ6l6AXkAECNgY.min" loading="lazy"></p>
<h1 id="ioc">部分IoC</h1>
<h3 id="moobot">moobot</h3>
<pre><code>md5:
40507d0675bee829311f1f67622dded9
70f1df04d4384422ba746a92940c0138
eebca17df98350fa127fef978a5cccde
79351b97ad07f77d336e38afcb213868
c15fe4dc2f063b135d2bb83c35d75289
168d0af614dc8513579d8436c930db76
527572a2a28807766569c0870558e807
0f8c6a64bac73e83eef94b3ec333c93a

CC:
31.13.195.56
audi.n1gger.com
botnetisharam.com
dbkjbueuvmf5hh7z.onion
n1gger.com
nd3rwzslqhxibkl7.onion
sisuugde7gzpef2d.onion
typicalniggerdayatthecoolaidparty.n1gger.com

URL:
http://89.248[.174.198/main/x86
http://93.174[.93.191:80/accn/kuojin.x86
http://185.100[.84.187:80/t/t.arm7
http://91.92[.66.192/rt/mips
http://91.92[.66.192/bins/x86
http://89.248[.174.219/moo/x86
http://185.244[.25.219/bins/armv7l
</code></pre>
<h3 id="fbot">fbot</h3>
<pre><code>md5:
beab327053b17556e80338efdf0b2e19

CC:
ohyaya.raiseyourdongers.pw

URL:
http://89.248[.174.219:80/bins/x86
</code></pre>
<h3 id="handymanny">handymanny</h3>
<pre><code>md5:
1fcfcb14304c586f12dc410546a3a5b7
453ac5c036c000827e291a5a58500f47
48032f646f6d14f946ab389a6b13000c
60f3cf7c5c0152d99cde53df7fb4e349
6a084828f8e33b3d6257667b938c5ae9
6e37aac9706d8f98172ff533ce6d660c
7309c3bb936c36bb53f065300f901cd4
7b7c455340a216e1e83b361080104980
7e472aae22796128f4c314e68a294d30
8c8bb10919266e6bd437de76e42e97dd
a17465a1232e2b3e18bb7a0a1cf4333d
a1f7f4fa878ab96f649f885a8769bb2b
a460e1ce45003d63d5f864eae38622ba
a8d02b5451c020f16f7a2b80a5491bb2
c4c608be28017a633d37607dae4975ab
ceb810beae3be334e2e598c94f264c09
d1d9b19cd6f287801d7063f7cddd0d50
ddf54946d4ab87fd12d61b758cd0f0a1
e4d954a693a2191afd360bd9e201182a
e8070d7e00c4b86dd2f929712d670c17

CC:
185.112.82.89

Loader IP:
185.244.25.200

URL:
http://185.112[.82.89:80/bins/arm.handymanny
</code></pre>
<!--kg-card-end: markdown-->
根据我们的观察，过去几年185.244.25.0/24这个网段出现了超多的Botnet，包括但不仅限于mirai、gafgyt、tsunami、fbot、moobot、handymanny等，他们属于同一个组织或共享了相关代码。下表是过去一年我们关于该网段的一些统计数据。可以看出该网段有很多的CC和攻击行为。





Count of CC (host:port)
Count of attack target host
Count of downloader IP
Count of loader IP




416
36933
166
181





本文主要介绍和该网段有关最近比较活跃/有趣的几个Botnet家族，包括moobot、fbot、handymanny等。


对于其他Botnet为了方便读者了解该网段下具体有那些Botnet及其变种，我们用该网段下的Loader IP植入样本阶段使用的关键字生成一张Tag cloud图，大致反应该网段下有那些Botnet及其变种。如下图所示：





moobot


moobot基于mirai开发。有很多个版本，根据其CC协议和编程语言的不同我们大致可将其分为moobot.socks5，moobot.tor，moobot.tor.b，moobot.go，moobot.go.tor，moobot.c等几个版本。其中moobot.c使用185.244.25.219作为Downloader，可以看出他和185.244.25.0/24网段有关。moobot各版本相关样本：






moobot.socks5


First seen: 2019-07-15 10:10:47

MD5: 70f1df04d4384422ba746a92940c0138

Downloader: http://89.248[.174.198/main/x86

Downloader: http://93.174[.93.191:80/accn/kuojin.x86

CC: n1gger.com:23

该版本的moobot 使用socks5协议和CC通信，样本扫描TCP/34567(DVRIP)，TCP/9527端口



moobot.tor


First seen: 2019-07-17 07:41:00

MD5: eebca17df98350fa127fef978a5cccde

Downloader: http://185.100[.84.187:80/t/t.arm7

Reporter: audi.n1gger.com:49567

CC: nd3rwzslqhxibkl7.onion:1356

CC使用tor域名，扫描34567，9527端口



moobot.tor.b


First seen: 2019-08-09 02:25:24

MD5: 79351b97ad07f77d336e38afcb213868

Downloader: http://91.92[.66.192/rt/mips

CC: typicalniggerdayatthecoolaidparty.n1gger.com TXT 91.92.66.192

CC:dbkjbueuvmf5hh7z.onion:10444

CC协议在mirai的基础上有微小修改



moobot.go


First seen: 2019-08-16 09:41:19

MD5: c15fe4dc2f063b135d2bb83c35d75289

Downloader: http://91.92[.66.192/bins/x86

CC: 31.13.195.56 port=18337

moobot golang版本



moobot.go.tor


First seen: 2019-08-20 07:38:05

MD5: 168d0af614dc8513579d8436c930db76

Downloader: http://89.248[.174.219/moo/x86

CC: sisuugde7gzpef2d.onion:14995

moobot golang版本，CC使用tor域名



moobot.c


First seen: 2019-08-21 02:23:48

MD5: 527572a2a28807766569c0870558e807

Downloader: http://185.244[.25.219/bins/armv7l

CC: typicalniggerdayatthecoolaidparty.n1gger.com TXT 31.13.195.56

moobot无代理版本，CC IP和moobot.go相同，使用185.244.25.219/24网段ip作为downloader




moobot端口扫描及漏洞利用



端口扫描


当前moobot延用mirai扫描机制，Bot全网扫描，将扫描结果上报给Loader，再由Loader植入样本。从我们的ScanMon结果看最近7天其感染IP 60K左右。值得一提的是，当前moobot扫描很多端口，包括DVRIP/ADB/HTTP/TELNET相关的端口，但单个Bot样本并不同时扫描所有端口，而是由多个不同的Bot样本共同完成这些端口扫描。这也许是为了提高Bot扫描效率？当前moobot主要扫描以下端口：


 * DVRIP/34567
 * HTTP/80, 81, 82, 83, 84, 85, 88, 1588, 5984, 8000, 8080, 8081, 8181, 8888, 9090, 9200, 60001[1]。对于HTTP服务，Bot查找如下图所示的HTTP Server，然后上报给Loader用来后续植入样本。
   
   
 * ADB/5555
 * TELNET/23


扫描源地理位置分布：


   7913 Brazil
   5749 China
   5305 Viet Nam
   4514 Thailand
   4510 Uruguay
   3685 Italy
   3070 Russian Federation
   2440 Argentina
   2410 Turkey
   2073 Malaysia
   2068 Republic of Korea
   1783 India
   1594 Germany
   1554 United States
   1433 Iran
   1132 Mexico
   1062 Spain
    967 United Kingdom
    946 Morocco
    937 Greece
    798 Indonesia
    782 Venezuela
    774 Pakistan
    758 Romania
    632 Japan
    577 Chile
    497 Poland
    477 Qatar
    472 South Africa
    456 Israel
    455 Dominican
    417 Ukraine
    415 Colombia
    407 Egypt
    376 Hungary
    370 Tunisia
    322 France
    295 Kazakhstan
    279 Saudi Arabia
    273 Australia
    271 Singapore
    244 Bulgaria
    232 United Arab Emirates
    185 Canada
    136 Jordan
    120 Oman
    114 Serbia
    112 Portugal
    101 Puerto Rico




漏洞利用


moobot对于HTTP，ADB，TELNET的利用都是已知的，这里不在獒述。下面主要说明其对DVRIP(port 34567)协议的漏洞利用。我们发现最早利用这个漏洞的是Fbot，但当时没有详细说明该漏洞是如何利用的，下面对这部分作简要说明。moobot主要利用DVRIP升级接口上传升级文件，执行升级文件中的shell命令完成后门开启，然后通过该后门后门植入恶意样本，过程大致如下：


 * 
   
   
   构造名为InstallDesc的DVRIP升级配置压缩文件。主要内容如下，可以看出该配置主要为了执行telnetd -p 9001 -l /bin/sh开启后门，此处后门端口为TCP/9001：
   
   
   

 * 
   
   
   利用DVRIP默认密码登录目标设备
   
   
   

 * 
   
   
   通过DVRIP升级接口上传升级文件InstallDesc到目标设备
   
   
   

 * 
   
   
   DVRIP服务执行升级过程，执行升级配置文件中的shell命令，开启后门
   

 * 
   
   
   Loader通过该后门植入Bot样本
   



moobot相关的攻击事件


我们观察到moobot攻击了很多流行站点/重要服务。包括DNS ROOT，Twitter, Facebook, Pornhub, Wikimedia, Twitch, World of Warcraft Server, Google，Baidu， Alibaba，Krebs on Security等。攻击这么多流行站点的目的据一名为UKDrillas的黑客或客户组织称是为了测试该Botnet的攻击效果。部分moobot攻击目标对应的SLD如下图所示:





moobot加密方式


moobot资源加密使用和fbot相似的加密方式。加密方式为码表替换，字串反序，无XOR，解密代码如下(相关样本0f8c6a64bac73e83eef94b3ec333c93a)：


tab1_enc = '''
AA AB AC AD AE AF BA BB BC BD BE BF CA CB CC CD CE 
CF DA DB DC DE DF EA EB EC ED EF FA FB FC FD FE FF 
A1 A2 A3 A4 A5 A6 A7 A8 A9 B1 B2 B3 B4 B5 B6 B7 B8 
B9 C1 C2 C3 C4 C5 C6 C7 C8 C9 D1 D2 D3 D4 D5 D6 D7 
D8 D9 E1 E2 E3 E4 E5 E6 E7 E8 E9 F1 F2 F3 F4 F5 F6
'''.replace(' ', '').replace('\n','').decode('hex')

tab2_enc = '''
7A 37 75 4E 42 63 33 20 61 32 4C 54 23 76 4A 48 38 
49 25 62 46 77 6B 68 2F 22 73 3B 55 24 65 53 3A 44 
5A 43 6A 45 6D 59 78 57 70 74 7C 6F 3E 26 66 64 2D 
35 47 39 71 52 4D 40 7E 34 51 30 79 58 6C 67 41 4B 
50 36 69 31 56 72 4F 5C 29 5D 2E 28 5B 6E 7B 7D 2C
'''.replace(' ', '').replace('\n','').decode('hex')

def decode(indata):
    res = ''
    for i in indata:
        res += chr(ord(i)^0x00)
    return res
tab1 = decode(tab1_enc)
tab2 = decode(tab2_enc)
def getK(c):
    for i in range(0, len(tab1)):
        if c == tab1[i]:
            return i
    return -1

def decrypt(pointer):
    res = ""
    for v12 in pointer:
        res += tab2[getK(v12)]
    return res



解密示例


slogan='''
B3 B3 A5 BB ED D2 BC ED BB DE B3 AF BB FC EA BF
'''.replace(' ', '').replace('\n','').decode('hex')
c2_addr='''
A5 B3 AF E9 E4 FC D5 D5 E2 F3 E9 D2 B1 E4 BC A9 
B7 E1 BC D4 B3 B3 AF FC EA B1 B1 BC D2 BC B7 E4 
FC D5 D5 E1 F3 D4 BC AF E1 A9 D2 B1
'''.replace(' ', '').replace('\n','').decode('hex')

print (decrypt(slogan)[::-1])
#The cow says moo
print (decrypt(c2_addr)[::-1])
#typicalniggerdayatthecoolaidparty.n1gger.com





fbot


fbot和moobot.go.tor使用相同的Downloader89.248.174.219，相似的加密技术，CC域名都使用TXT记录等特点。我们认为fbot和moobot是有关系的。属于同一个组织或者不同组织共享相关的代码。相关样本：





First seen: 2019-08-15 06:35:15

MD5: beab327053b17556e80338efdf0b2e19

Downloader: http://89.248[.174.219:80/bins/x86

CC: ohyaya.raiseyourdongers.pw TXT 5.206.227.65




fbot加密方式


fbot资源加密方式为码表替换，XOR加密，解密代码如下：


tab1_enc = '''
14 15 0A 1D 1F 08 0E 00 01 17 1A 03 0B 09 16 
12 1E 10 0C 0D 18 1B 0F 11 1C 13 2D 3F 28 36 
34 38 3C 3A 31 35 20 37 2C 3D 2E 2F 33 2B 21 
30 3E 32 23 2A 3B 29 6E 61 60 69 6B 6C 6D 68 6F 6A 64 19 07 7D
'''.replace(' ', '').replace('\n','').decode('hex')

tab2_enc = '''
18 1B 1A 1D 1C 1F 1E 11 10 13 12 15 14 17 16 
09 08 0B 0A 0D 0C 0F 0E 01 00 03 38 3B 3A 3D 
3C 3F 3E 31 30 33 32 35 34 37 36 29 28 2B 2A 
2D 2C 2F 2E 21 20 23 69 68 6B 6A 6D 6C 6F 6E 61 60 77 76 79 74
'''.replace(' ', '').replace('\n','').decode('hex')

def decode(indata):
    res = ''
    for i in indata:
        res += chr(ord(i)^0x59)
    return res
tab1 = decode(tab1_enc)
tab2 = decode(tab2_enc)
def getK(c):
    for i in range(0, len(tab1)):
        if c == tab1[i]:
            return i
    return -1

def decrypt(pointer):
    res = ""
    for v12 in pointer:
        res += tab2[getK(v12)]
    return res




解密示例


c2="wcbtbt=rthxmbwgrowdemrx=vz"
print decrypt(c2)
#ohyaya.raiseyourdongers.pw



如果想了解更多fbot的信息可翻阅我们以前的相关文章。[1][2]



handymanny


handymanny和brickbot、Silex等Botnet类似，主要是破坏目标设备系统，让目标设备无法正常工作。样本由Loader通过telnet植入，Loader IP185.244.25.200，这说明handymanny和185.244.25.200/24网段也是有关的。相关样本：





First seen: 2019-09-08 20:03:11

MD5: 1fcfcb14304c586f12dc410546a3a5b7

Downloader: http://185.112[.82.89:80/bins/arm.handymanny

Loader IP: 185.244.25.200

CC: 185.112.82.89:123



其破坏目标系统相关操作如下图所示：





部分IoC



moobot


md5:
40507d0675bee829311f1f67622dded9
70f1df04d4384422ba746a92940c0138
eebca17df98350fa127fef978a5cccde
79351b97ad07f77d336e38afcb213868
c15fe4dc2f063b135d2bb83c35d75289
168d0af614dc8513579d8436c930db76
527572a2a28807766569c0870558e807
0f8c6a64bac73e83eef94b3ec333c93a

CC:
31.13.195.56
audi.n1gger.com
botnetisharam.com
dbkjbueuvmf5hh7z.onion
n1gger.com
nd3rwzslqhxibkl7.onion
sisuugde7gzpef2d.onion
typicalniggerdayatthecoolaidparty.n1gger.com

URL:
http://89.248[.174.198/main/x86
http://93.174[.93.191:80/accn/kuojin.x86
http://185.100[.84.187:80/t/t.arm7
http://91.92[.66.192/rt/mips
http://91.92[.66.192/bins/x86
http://89.248[.174.219/moo/x86
http://185.244[.25.219/bins/armv7l




fbot


md5:
beab327053b17556e80338efdf0b2e19

CC:
ohyaya.raiseyourdongers.pw

URL:
http://89.248[.174.219:80/bins/x86




handymanny


md5:
1fcfcb14304c586f12dc410546a3a5b7
453ac5c036c000827e291a5a58500f47
48032f646f6d14f946ab389a6b13000c
60f3cf7c5c0152d99cde53df7fb4e349
6a084828f8e33b3d6257667b938c5ae9
6e37aac9706d8f98172ff533ce6d660c
7309c3bb936c36bb53f065300f901cd4
7b7c455340a216e1e83b361080104980
7e472aae22796128f4c314e68a294d30
8c8bb10919266e6bd437de76e42e97dd
a17465a1232e2b3e18bb7a0a1cf4333d
a1f7f4fa878ab96f649f885a8769bb2b
a460e1ce45003d63d5f864eae38622ba
a8d02b5451c020f16f7a2b80a5491bb2
c4c608be28017a633d37607dae4975ab
ceb810beae3be334e2e598c94f264c09
d1d9b19cd6f287801d7063f7cddd0d50
ddf54946d4ab87fd12d61b758cd0f0a1
e4d954a693a2191afd360bd9e201182a
e8070d7e00c4b86dd2f929712d670c17

CC:
185.112.82.89

Loader IP:
185.244.25.200

URL:
http://185.112[.82.89:80/bins/arm.handymanny


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"根据我们的观察，过去几年185.244.25.0/24这个网段出现了超多的Botnet，包括但不仅限于mirai、gafgyt、tsunami、fbot、moobot、handymanny等，他们属于同一个组织或共享了相关代码。下表是过去一年我们关于该网段的一些统计数据。可以看出该网段有很多的CC和攻击行为。\n| Count of CC (host:port)| Count of attack target host | Count of downloader IP | Count of loader IP |\n| ----------- | --------------------------- | ------------------- | ---------- |\n| 416         | 36933                       | 166                 | 181       |\n\n本文主要介绍和该网段有关最近比较活跃/有趣的几个Botnet家族，包括moobot、fbot、handymanny等。\n\n对于其他Botnet为了方便读者了解该网段下具体有那些Botnet及其变种，我们用该网段下的Loader IP植入样本阶段使用的关键字生成一张Tag cloud图，大致反应该网段下有那些Botnet及其变种。如下图所示：\n<a href=\"__GHOST_URL__/content/images/2019/09/g185.branch.png\" target=\"_blank\"><img src=\"__GHOST_URL__/content/images/2019/09/g185.branch.min.png\" /></a>\n\n# moobot\nmoobot基于mirai开发。有很多个版本，根据其CC协议和编程语言的不同我们大致可将其分为moobot.socks5，moobot.tor，moobot.tor.b，moobot.go，moobot.go.tor，moobot.c等几个版本。其中moobot.c使用185.244.25.219作为Downloader，可以看出他和185.244.25.0/24网段有关。moobot各版本相关样本：\n> ### moobot.socks5\n> First seen: 2019-07-15 10:10:47\n> MD5: 70f1df04d4384422ba746a92940c0138\n> Downloader: `http://89.248[.174.198/main/x86`\n> Downloader: `http://93.174[.93.191:80/accn/kuojin.x86`\n> CC: n1gger.com:23\n> 该版本的moobot 使用socks5协议和CC通信，样本扫描TCP/34567(DVRIP)，TCP/9527端口\n> \n> ### moobot.tor\n> First seen: 2019-07-17 07:41:00\n> MD5: eebca17df98350fa127fef978a5cccde\n> Downloader: `http://185.100[.84.187:80/t/t.arm7`\n> Reporter: audi.n1gger.com:49567\n> CC:  nd3rwzslqhxibkl7.onion:1356\n> CC使用tor域名，扫描34567，9527端口\n>\n> ### moobot.tor.b\n> First seen: 2019-08-09 02:25:24\n> MD5: 79351b97ad07f77d336e38afcb213868\n> Downloader: `http://91.92[.66.192/rt/mips`\n> CC: typicalniggerdayatthecoolaidparty.n1gger.com TXT 91.92.66.192\n> CC:dbkjbueuvmf5hh7z.onion:10444\n> CC协议在mirai的基础上有微小修改\n> \n> ### moobot.go\n> First seen: 2019-08-16 09:41:19\n> MD5: c15fe4dc2f063b135d2bb83c35d75289\n> Downloader: `http://91.92[.66.192/bins/x86`\n> CC: 31.13.195.56    port=18337\n> moobot golang版本\n> \n> ### moobot.go.tor \n> First seen: 2019-08-20 07:38:05\n> MD5: 168d0af614dc8513579d8436c930db76\n> Downloader: `http://89.248[.174.219/moo/x86`\n> CC: sisuugde7gzpef2d.onion:14995\n> moobot golang版本，CC使用tor域名\n> \n> ### moobot.c\n> First seen: 2019-08-21 02:23:48\n> MD5: 527572a2a28807766569c0870558e807\n> Downloader: `http://185.244[.25.219/bins/armv7l`\n> CC: typicalniggerdayatthecoolaidparty.n1gger.com TXT 31.13.195.56 \n> moobot无代理版本，CC IP和moobot.go相同，使用`185.244.25.219/24`网段ip作为downloader\n> \n\n## moobot端口扫描及漏洞利用\n### 端口扫描\n\n当前moobot延用mirai扫描机制，Bot全网扫描，将扫描结果上报给Loader，再由Loader植入样本。从我们的[ScanMon](https://scan.netlab.360.com/#/dashboard?tsbeg=1568815200000&tsend=1569315600000&dstport=1588&toplistname=similardstport&topn=10&sortby=sum)结果看最近7天其感染IP 60K左右。值得一提的是，当前moobot扫描很多端口，包括DVRIP/ADB/HTTP/TELNET相关的端口，但单个Bot样本并不同时扫描所有端口，而是由多个不同的Bot样本共同完成这些端口扫描。这也许是为了提高Bot扫描效率？当前moobot主要扫描以下端口：\n- DVRIP/34567\n- HTTP/80, 81, 82, 83, 84, 85, 88, 1588, 5984, 8000, 8080, 8081, 8181, 8888, 9090, 9200, 60001[[1\\]](https://twitter.com/MasafumiNegishi/status/1175988802805846016)。对于HTTP服务，Bot查找如下图所示的HTTP Server，然后上报给Loader用来后续植入样本。\n<a href=\"__GHOST_URL__/content/images/2019/09/moo_banner.png\"><img src=\"__GHOST_URL__/content/images/2019/09/moo_banner.png\" class=\"kg-image\"/></a>\n- ADB/5555\n- TELNET/23\n\n扫描源地理位置分布：\n```\n   7913 Brazil\n   5749 China\n   5305 Viet Nam\n   4514 Thailand\n   4510 Uruguay\n   3685 Italy\n   3070 Russian Federation\n   2440 Argentina\n   2410 Turkey\n   2073 Malaysia\n   2068 Republic of Korea\n   1783 India\n   1594 Germany\n   1554 United States\n   1433 Iran\n   1132 Mexico\n   1062 Spain\n    967 United Kingdom\n    946 Morocco\n    937 Greece\n    798 Indonesia\n    782 Venezuela\n    774 Pakistan\n    758 Romania\n    632 Japan\n    577 Chile\n    497 Poland\n    477 Qatar\n    472 South Africa\n    456 Israel\n    455 Dominican\n    417 Ukraine\n    415 Colombia\n    407 Egypt\n    376 Hungary\n    370 Tunisia\n    322 France\n    295 Kazakhstan\n    279 Saudi Arabia\n    273 Australia\n    271 Singapore\n    244 Bulgaria\n    232 United Arab Emirates\n    185 Canada\n    136 Jordan\n    120 Oman\n    114 Serbia\n    112 Portugal\n    101 Puerto Rico\n```\n\n### 漏洞利用\nmoobot对于HTTP，ADB，TELNET的利用都是已知的，这里不在獒述。下面主要说明其对DVRIP(port 34567)协议的漏洞利用。我们发现最早利用这个漏洞的是[Fbot](__GHOST_URL__/the-new-developments-of-the-fbot-en/)，但当时没有详细说明该漏洞是如何利用的，下面对这部分作简要说明。moobot主要利用DVRIP升级接口上传升级文件，执行升级文件中的shell命令完成后门开启，然后通过该后门后门植入恶意样本，过程大致如下：\n- 构造名为InstallDesc的DVRIP升级配置压缩文件。主要内容如下，可以看出该配置主要为了执行`telnetd -p 9001 -l /bin/sh`开启后门，此处后门端口为TCP/9001：\n<a href=\"__GHOST_URL__/content/images/2019/09/moo_telnet.png\"><img src=\"__GHOST_URL__/content/images/2019/09/moo_telnet.png\" class=\"kg-image\"/></a>\n\n- 利用DVRIP默认密码登录目标设备\n![moobot.dvrip](__GHOST_URL__/content/images/2019/09/moobot.dvrip.png)\n\n- 通过DVRIP升级接口上传升级文件InstallDesc到目标设备\n![dvrip.upgrade](__GHOST_URL__/content/images/2019/09/dvrip.upgrade.png)\n\n- DVRIP服务执行升级过程，执行升级配置文件中的shell命令，开启后门\n\n- Loader通过该后门植入Bot样本\n\n\n\n## moobot相关的攻击事件\n我们观察到moobot攻击了很多流行站点/重要服务。包括DNS ROOT，Twitter, Facebook, Pornhub, [Wikimedia](https://wikimediafoundation.org/news/2019/09/07/malicious-attack-on-wikipedia-what-we-know-and-what-were-doing/), [Twitch, World of Warcraft Server](https://twitter.com/MasafumiNegishi/status/1170881367871082497), Google，Baidu， Alibaba，Krebs on Security等。攻击这么多流行站点的目的据一名为[UKDrillas](https://www.genelmag.com/article/ddos-attack-on-twitch-and-wow-servers)的黑客或客户组织称是为了测试该Botnet的攻击效果。部分moobot攻击目标对应的SLD如下图所示:\n<a href=\"__GHOST_URL__/content/images/2019/09/atk.sld.png\" target=\"_blank\"><img src=\"__GHOST_URL__/content/images/2019/09/atk.sld.min-1.png\" /></a>\n\n## moobot加密方式\nmoobot资源加密使用和[fbot](__GHOST_URL__/the-new-developments-of-the-fbot-en/)相似的加密方式。加密方式为码表替换，字串反序，无XOR，解密代码如下(相关样本`0f8c6a64bac73e83eef94b3ec333c93a`)：\n```\ntab1_enc = '''\nAA AB AC AD AE AF BA BB BC BD BE BF CA CB CC CD CE \nCF DA DB DC DE DF EA EB EC ED EF FA FB FC FD FE FF \nA1 A2 A3 A4 A5 A6 A7 A8 A9 B1 B2 B3 B4 B5 B6 B7 B8 \nB9 C1 C2 C3 C4 C5 C6 C7 C8 C9 D1 D2 D3 D4 D5 D6 D7 \nD8 D9 E1 E2 E3 E4 E5 E6 E7 E8 E9 F1 F2 F3 F4 F5 F6\n'''.replace(' ', '').replace('\\n','').decode('hex')\n\ntab2_enc = '''\n7A 37 75 4E 42 63 33 20 61 32 4C 54 23 76 4A 48 38 \n49 25 62 46 77 6B 68 2F 22 73 3B 55 24 65 53 3A 44 \n5A 43 6A 45 6D 59 78 57 70 74 7C 6F 3E 26 66 64 2D \n35 47 39 71 52 4D 40 7E 34 51 30 79 58 6C 67 41 4B \n50 36 69 31 56 72 4F 5C 29 5D 2E 28 5B 6E 7B 7D 2C\n'''.replace(' ', '').replace('\\n','').decode('hex')\n\ndef decode(indata):\n    res = ''\n    for i in indata:\n        res += chr(ord(i)^0x00)\n    return res\ntab1 = decode(tab1_enc)\ntab2 = decode(tab2_enc)\ndef getK(c):\n    for i in range(0, len(tab1)):\n        if c == tab1[i]:\n            return i\n    return -1\n\ndef decrypt(pointer):\n    res = \"\"\n    for v12 in pointer:\n        res += tab2[getK(v12)]\n    return res\n```\n解密示例\n```\nslogan='''\nB3 B3 A5 BB ED D2 BC ED BB DE B3 AF BB FC EA BF\n'''.replace(' ', '').replace('\\n','').decode('hex')\nc2_addr='''\nA5 B3 AF E9 E4 FC D5 D5 E2 F3 E9 D2 B1 E4 BC A9 \nB7 E1 BC D4 B3 B3 AF FC EA B1 B1 BC D2 BC B7 E4 \nFC D5 D5 E1 F3 D4 BC AF E1 A9 D2 B1\n'''.replace(' ', '').replace('\\n','').decode('hex')\n\nprint (decrypt(slogan)[::-1])\n#The cow says moo\nprint (decrypt(c2_addr)[::-1])\n#typicalniggerdayatthecoolaidparty.n1gger.com\n\n```\n\n# fbot\nfbot和moobot.go.tor使用相同的Downloader`89.248.174.219`，相似的加密技术，CC域名都使用TXT记录等特点。我们认为fbot和moobot是有关系的。属于同一个组织或者不同组织共享相关的代码。相关样本：\n> First seen: 2019-08-15 06:35:15\n> MD5: beab327053b17556e80338efdf0b2e19\n> Downloader: `http://89.248[.174.219:80/bins/x86`\n> CC: ohyaya.raiseyourdongers.pw TXT  5.206.227.65\n> \n\n## fbot加密方式\nfbot资源加密方式为码表替换，XOR加密，解密代码如下：\n```\ntab1_enc = '''\n14 15 0A 1D 1F 08 0E 00 01 17 1A 03 0B 09 16 \n12 1E 10 0C 0D 18 1B 0F 11 1C 13 2D 3F 28 36 \n34 38 3C 3A 31 35 20 37 2C 3D 2E 2F 33 2B 21 \n30 3E 32 23 2A 3B 29 6E 61 60 69 6B 6C 6D 68 6F 6A 64 19 07 7D\n'''.replace(' ', '').replace('\\n','').decode('hex')\n\ntab2_enc = '''\n18 1B 1A 1D 1C 1F 1E 11 10 13 12 15 14 17 16 \n09 08 0B 0A 0D 0C 0F 0E 01 00 03 38 3B 3A 3D \n3C 3F 3E 31 30 33 32 35 34 37 36 29 28 2B 2A \n2D 2C 2F 2E 21 20 23 69 68 6B 6A 6D 6C 6F 6E 61 60 77 76 79 74\n'''.replace(' ', '').replace('\\n','').decode('hex')\n\ndef decode(indata):\n    res = ''\n    for i in indata:\n        res += chr(ord(i)^0x59)\n    return res\ntab1 = decode(tab1_enc)\ntab2 = decode(tab2_enc)\ndef getK(c):\n    for i in range(0, len(tab1)):\n        if c == tab1[i]:\n            return i\n    return -1\n\ndef decrypt(pointer):\n    res = \"\"\n    for v12 in pointer:\n        res += tab2[getK(v12)]\n    return res\n\n```\n解密示例\n```\nc2=\"wcbtbt=rthxmbwgrowdemrx=vz\"\nprint decrypt(c2)\n#ohyaya.raiseyourdongers.pw\n```\n\n如果想了解更多fbot的信息可翻阅我们以前的相关文章。[[1\\]](__GHOST_URL__/the-new-developments-of-the-fbot-en/)[[2\\]](__GHOST_URL__/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/)\n# handymanny\n[handymanny](https://twitter.com/liuya0904/status/1171633662502350848)和brickbot、Silex等Botnet类似，主要是破坏目标设备系统，让目标设备无法正常工作。样本由Loader通过telnet植入，Loader IP`185.244.25.200`，这说明handymanny和185.244.25.200/24网段也是有关的。相关样本：\n> First seen: 2019-09-08 20:03:11\n> MD5: 1fcfcb14304c586f12dc410546a3a5b7\n> Downloader: `http://185.112[.82.89:80/bins/arm.handymanny`\n> Loader IP: 185.244.25.200\n> CC: 185.112.82.89:123\n\n其破坏目标系统相关操作如下图所示：\n![EEJ6l6AXkAECNgY.min](__GHOST_URL__/content/images/2019/09/EEJ6l6AXkAECNgY.min.png)\n\n# 部分IoC\n### moobot\n```\nmd5:\n40507d0675bee829311f1f67622dded9\n70f1df04d4384422ba746a92940c0138\neebca17df98350fa127fef978a5cccde\n79351b97ad07f77d336e38afcb213868\nc15fe4dc2f063b135d2bb83c35d75289\n168d0af614dc8513579d8436c930db76\n527572a2a28807766569c0870558e807\n0f8c6a64bac73e83eef94b3ec333c93a\n\nCC:\n31.13.195.56\naudi.n1gger.com\nbotnetisharam.com\ndbkjbueuvmf5hh7z.onion\nn1gger.com\nnd3rwzslqhxibkl7.onion\nsisuugde7gzpef2d.onion\ntypicalniggerdayatthecoolaidparty.n1gger.com\n\nURL:\nhttp://89.248[.174.198/main/x86\nhttp://93.174[.93.191:80/accn/kuojin.x86\nhttp://185.100[.84.187:80/t/t.arm7\nhttp://91.92[.66.192/rt/mips\nhttp://91.92[.66.192/bins/x86\nhttp://89.248[.174.219/moo/x86\nhttp://185.244[.25.219/bins/armv7l\n```\n\n### fbot\n```\nmd5:\nbeab327053b17556e80338efdf0b2e19\n\nCC:\nohyaya.raiseyourdongers.pw\n\nURL:\nhttp://89.248[.174.219:80/bins/x86\n```\n\n### handymanny\n```\nmd5:\n1fcfcb14304c586f12dc410546a3a5b7\n453ac5c036c000827e291a5a58500f47\n48032f646f6d14f946ab389a6b13000c\n60f3cf7c5c0152d99cde53df7fb4e349\n6a084828f8e33b3d6257667b938c5ae9\n6e37aac9706d8f98172ff533ce6d660c\n7309c3bb936c36bb53f065300f901cd4\n7b7c455340a216e1e83b361080104980\n7e472aae22796128f4c314e68a294d30\n8c8bb10919266e6bd437de76e42e97dd\na17465a1232e2b3e18bb7a0a1cf4333d\na1f7f4fa878ab96f649f885a8769bb2b\na460e1ce45003d63d5f864eae38622ba\na8d02b5451c020f16f7a2b80a5491bb2\nc4c608be28017a633d37607dae4975ab\nceb810beae3be334e2e598c94f264c09\nd1d9b19cd6f287801d7063f7cddd0d50\nddf54946d4ab87fd12d61b758cd0f0a1\ne4d954a693a2191afd360bd9e201182a\ne8070d7e00c4b86dd2f929712d670c17\n\nCC:\n185.112.82.89\n\nLoader IP:\n185.244.25.200\n\nURL:\nhttp://185.112[.82.89:80/bins/arm.handymanny\n```"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}