Threat Alert: Log4j Vulnerability Has Been adopted by two Linux Botnets
<!--kg-card-begin: markdown--><p>The Log4j vulnerability that came to light at the end of the year can undoubtedly be considered a major event in the security community.  Honeypot and botnet are our bread and butter, and we have been concerned about which botnets would be exploiting this since the vulnerability was made public. This morning we got the first answers, our Anglerfish and Apacket honeypots have caught 2 waves of attacks using the Log4j vulnerability to form botnets, and a quick sample analysis showed that they were used to form Muhstik and Mirai botnets respectively, both targeting Linux devices.</p>
<h2 id="sampleanalysis">Sample Analysis</h2>
<h3 id="mirai">MIRAI</h3>
<p>This wave propagates a new variant of miria, which has made the following changes compared to the initial code.</p>
<ol>
<li>
<p>table_init/table_lock_val/table_unlock_val and other mirai-specific configuration management functions have been removed.</p>
</li>
<li>
<p>The attack_init function is also discarded, and the ddos attack function is called directly by the command processing function.</p>
</li>
</ol>
<p>Also, a uy top-level domain is chosen for its C2 domain name, which is also rare.</p>
<h3 id="muhstik">Muhstik</h3>
<p>Muhstik, a botnet we disclosed in <a href="(https://blog.netlab.360.com/botnet-muhstik-is-actively-exploiting-drupal-cve-2018-7600-in-a-worm-style/)">2018</a>, is a variant of Tsunami that borrows from the Mirai code. In this captured sample, we note that the new Muhstik variant adds a backdoor module, ldm, which has the ability to add an SSH backdoor public key with the following installed backdoor public key.</p>
<pre><code>ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQBtGZHLQlMLkrONMAChDVPZf+9gNG5s2rdTMBkOp6P7mKIQ/OkbgiozmZ3syhELI4L0M1TmJiRbbrIta8662z4WAKhXpiU22llfwrkN0m8yKJApd8lDzvvdBw+ShzJr+WaEWX7uW3WCe5NCxGxc6AU7c2vmuLlO0B203pIGVIbV1xJmj6MXrdZpNy7QRo9zStWmgmVY4GR4v26R3XDOn1gshuQ6PgUqgewQ+AlslLVuekdH23sLQfejXyJShcoFI6BbH67YTcoh4G/TuQdGe8lIeAAmp7lzzHMyu+2iSNoFFCeF48JSA2YZvssFOsGuAtV/9uPNQoi9EyvgM2mGDgJ
</code></pre>
<p>After the public key is added to the ~/.ssh/authorized_keys file, the attacker can directly log into the remote server without password authentication.</p>
<p>Considering the special vulnerability mechanism of log4j2, Muhstik takes a blunt approach to spread the payload aimlessly knowing that there will be vulnerable machines, and in order to know who has been infected, Muhstik adopts TOR network for its reporting mechanism.</p>
<p>Before accessing the TOR network, Muhstik queries relay.l33t-ppl.inf through some publicly available DoH services(see the list beflow). During this process, a number of DNS requests are generated. Note: The following domains are not C2 domains but DoH service providers, depends on the situation, readers might be able to use the list to crosscheck their network for possible infections if they are not expect DoH usage on their network.</p>
<pre><code>doh.defaultroutes.de
dns.hostux.net
dns.dns-over-https.com
uncensored.lux1.dns.nixnet.xyz
dns.rubyfish.cn dns.twnic.tw
doh.centraleu.pi-dns.com
doh.dns.sb doh-fi.blahdns.com
fi.doh.dns.snopyta.org
dns.flatuslifir.is
doh.li
dns.digitale-gesellschaft.ch
</code></pre>
<p>When it is not possible to report infect information directly from the TOR network, Muhstik will try to use  TOR's public mapped domains, the list of relevant domains is as follows</p>
<pre><code>bvprzqhoz7j2ltin.onion.ws
bvprzqhoz7j2ltin.onion.ly
bvprzqhoz7j2ltin.tor2web.s
</code></pre>
<p>Muhstik's ELF sample has the following codes.：<br>
<img src="__GHOST_URL__/content/images/2021/12/tsunami_command-1-1.png" alt="tsunami_command-1-1" loading="lazy"></p>
<p>We can see that the sample supports DDoS and backdoor commands. The C2 of the sample is stored in a mirai-style configuration with the following configuration information in plain text.：</p>
<pre><code> [0x02]: &quot;listening tun0\x00&quot;, size=15
 [0x03]: &quot;irc.de-za&quot;\x1f\x90&quot;listening tun0\x00&quot;l&quot;, size=30
 [0x04]: &quot;\x1f\x90&quot;, size=2
 [0x05]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x06]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x07]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x08]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x0a]: &quot;/proc/\x00&quot;, size=7
 [0x0c]: &quot;/exe\x00&quot;, size=5
 [0x0d]: &quot;/status\x00&quot;, size=8
 [0x0e]: &quot;/fd\x00&quot;, size=4
 [0x0f]: &quot;\x58\x4D\x4E\x4E\x43\x50\x46\x22\x00&quot;, size=33
 [0x10]: &quot;zollard\x00&quot;, size=8
 [0x11]: &quot;muhstik-11052018\x00&quot;, size=17
 [0x12]: &quot;\x02^nL\x0b\x1a\x06_nL\x02\x0f\x00&quot;, size=13
 [0x13]: &quot;eth1\x00&quot;, size=5
 [0x14]: &quot;lan0\x00&quot;, size=5
 [0x15]: &quot;-\x00&quot;, size=2
 [0x16]: &quot;eth0\x00&quot;, size=5
 [0x17]: &quot;inet0\x00&quot;, size=6
 [0x18]: &quot;lano\x00&quot;, size=5
 [0x19]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x1a]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x1b]: &quot;d4cf8e4ab26f7fd15ef7df9f7937493d\x00&quot;, size=33
 [0x1c]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x1d]: &quot;37.44.244.124\x00&quot;, size=14
 [0x1e]: &quot;37.44.244.124\x00&quot;, size=14
 [0x1f]: &quot;37.44.244.124\x00&quot;, size=14
 [0x20]: &quot;37.44.244.124\x00&quot;, size=14
 [0x21]: &quot;37.44.244.124\x00&quot;, size=14
 [0x22]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
 [0x23]: &quot;log.exposedbotnets.ru\x00&quot;, size=22
</code></pre>
<p>The <code>log.exposedbotnets.ru</code> is C2, which resolves to <code>37.44.244.124</code>. The author registered a domain starting with log perhaps intentionally to fit the Log4j vulnerability.</p>
<h2 id="conclusion">Conclusion</h2>
<p>Considering the huge impact of the Log4j vulnerability, we expect more botnets to support it to spread. We will keep an eye on this and will share new observations here.</p>
<h2 id="contactus">Contact us</h2>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab">Twitter</a> or email us to netlab at 360 dot cn.</p>
<h2 id="ioc">IOC:</h2>
<h3 id="mirai">Mirai</h3>
<p>C2:</p>
<pre><code>nazi.uy
</code></pre>
<p>URL:</p>
<pre><code>http://62.210.130.250/lh.sh
http://62.210.130.250:80/web/admin/x86_64
http://62.210.130.250:80/web/admin/x86
http://62.210.130.250:80/web/admin/x86_g
</code></pre>
<h3 id="muhstik">Muhstik</h3>
<p>C2:</p>
<pre><code>log.exposedbotnets.ru
</code></pre>
<p>URL:</p>
<pre><code>http://45.130.229.168:9999/Exploit.class
http://18.228.7.109/.log/log
http://18.228.7.109/.log/pty1;
http://18.228.7.109/.log/pty2;
http://18.228.7.109/.log/pty3;
http://18.228.7.109/.log/pty4;
http://18.228.7.109/.log/pty5;
http://210.141.105.67:80/wp-content/themes/twentythirteen/m8
http://159.89.182.117/wp-content/themes/twentyseventeen/ldm
</code></pre>
<!--kg-card-end: markdown-->
The Log4j vulnerability that came to light at the end of the year can undoubtedly be considered a major event in the security community. Honeypot and botnet are our bread and butter, and we have been concerned about which botnets would be exploiting this since the vulnerability was made public. This morning we got the first answers, our Anglerfish and Apacket honeypots have caught 2 waves of attacks using the Log4j vulnerability to form botnets, and a quick sample analysis showed that they were used to form Muhstik and Mirai botnets respectively, both targeting Linux devices.



Sample Analysis



MIRAI


This wave propagates a new variant of miria, which has made the following changes compared to the initial code.


 1. 
    
    
    table_init/table_lock_val/table_unlock_val and other mirai-specific configuration management functions have been removed.
    

 2. 
    
    
    The attack_init function is also discarded, and the ddos attack function is called directly by the command processing function.
    


Also, a uy top-level domain is chosen for its C2 domain name, which is also rare.



Muhstik


Muhstik, a botnet we disclosed in 2018, is a variant of Tsunami that borrows from the Mirai code. In this captured sample, we note that the new Muhstik variant adds a backdoor module, ldm, which has the ability to add an SSH backdoor public key with the following installed backdoor public key.


ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQBtGZHLQlMLkrONMAChDVPZf+9gNG5s2rdTMBkOp6P7mKIQ/OkbgiozmZ3syhELI4L0M1TmJiRbbrIta8662z4WAKhXpiU22llfwrkN0m8yKJApd8lDzvvdBw+ShzJr+WaEWX7uW3WCe5NCxGxc6AU7c2vmuLlO0B203pIGVIbV1xJmj6MXrdZpNy7QRo9zStWmgmVY4GR4v26R3XDOn1gshuQ6PgUqgewQ+AlslLVuekdH23sLQfejXyJShcoFI6BbH67YTcoh4G/TuQdGe8lIeAAmp7lzzHMyu+2iSNoFFCeF48JSA2YZvssFOsGuAtV/9uPNQoi9EyvgM2mGDgJ



After the public key is added to the ~/.ssh/authorized_keys file, the attacker can directly log into the remote server without password authentication.


Considering the special vulnerability mechanism of log4j2, Muhstik takes a blunt approach to spread the payload aimlessly knowing that there will be vulnerable machines, and in order to know who has been infected, Muhstik adopts TOR network for its reporting mechanism.


Before accessing the TOR network, Muhstik queries relay.l33t-ppl.inf through some publicly available DoH services(see the list beflow). During this process, a number of DNS requests are generated. Note: The following domains are not C2 domains but DoH service providers, depends on the situation, readers might be able to use the list to crosscheck their network for possible infections if they are not expect DoH usage on their network.


doh.defaultroutes.de
dns.hostux.net
dns.dns-over-https.com
uncensored.lux1.dns.nixnet.xyz
dns.rubyfish.cn dns.twnic.tw
doh.centraleu.pi-dns.com
doh.dns.sb doh-fi.blahdns.com
fi.doh.dns.snopyta.org
dns.flatuslifir.is
doh.li
dns.digitale-gesellschaft.ch



When it is not possible to report infect information directly from the TOR network, Muhstik will try to use TOR's public mapped domains, the list of relevant domains is as follows


bvprzqhoz7j2ltin.onion.ws
bvprzqhoz7j2ltin.onion.ly
bvprzqhoz7j2ltin.tor2web.s



Muhstik's ELF sample has the following codes.：




We can see that the sample supports DDoS and backdoor commands. The C2 of the sample is stored in a mirai-style configuration with the following configuration information in plain text.：


 [0x02]: "listening tun0\x00", size=15
 [0x03]: "irc.de-za"\x1f\x90"listening tun0\x00"l", size=30
 [0x04]: "\x1f\x90", size=2
 [0x05]: "log.exposedbotnets.ru\x00", size=22
 [0x06]: "log.exposedbotnets.ru\x00", size=22
 [0x07]: "log.exposedbotnets.ru\x00", size=22
 [0x08]: "log.exposedbotnets.ru\x00", size=22
 [0x0a]: "/proc/\x00", size=7
 [0x0c]: "/exe\x00", size=5
 [0x0d]: "/status\x00", size=8
 [0x0e]: "/fd\x00", size=4
 [0x0f]: "\x58\x4D\x4E\x4E\x43\x50\x46\x22\x00", size=33
 [0x10]: "zollard\x00", size=8
 [0x11]: "muhstik-11052018\x00", size=17
 [0x12]: "\x02^nL\x0b\x1a\x06_nL\x02\x0f\x00", size=13
 [0x13]: "eth1\x00", size=5
 [0x14]: "lan0\x00", size=5
 [0x15]: "-\x00", size=2
 [0x16]: "eth0\x00", size=5
 [0x17]: "inet0\x00", size=6
 [0x18]: "lano\x00", size=5
 [0x19]: "log.exposedbotnets.ru\x00", size=22
 [0x1a]: "log.exposedbotnets.ru\x00", size=22
 [0x1b]: "d4cf8e4ab26f7fd15ef7df9f7937493d\x00", size=33
 [0x1c]: "log.exposedbotnets.ru\x00", size=22
 [0x1d]: "37.44.244.124\x00", size=14
 [0x1e]: "37.44.244.124\x00", size=14
 [0x1f]: "37.44.244.124\x00", size=14
 [0x20]: "37.44.244.124\x00", size=14
 [0x21]: "37.44.244.124\x00", size=14
 [0x22]: "log.exposedbotnets.ru\x00", size=22
 [0x23]: "log.exposedbotnets.ru\x00", size=22



The log.exposedbotnets.ru is C2, which resolves to 37.44.244.124. The author registered a domain starting with log perhaps intentionally to fit the Log4j vulnerability.



Conclusion


Considering the huge impact of the Log4j vulnerability, we expect more botnets to support it to spread. We will keep an eye on this and will share new observations here.



Contact us


Readers are always welcomed to reach us on Twitter or email us to netlab at 360 dot cn.



IOC:



Mirai


C2:


nazi.uy



URL:


http://62.210.130.250/lh.sh
http://62.210.130.250:80/web/admin/x86_64
http://62.210.130.250:80/web/admin/x86
http://62.210.130.250:80/web/admin/x86_g




Muhstik


C2:


log.exposedbotnets.ru



URL:


http://45.130.229.168:9999/Exploit.class
http://18.228.7.109/.log/log
http://18.228.7.109/.log/pty1;
http://18.228.7.109/.log/pty2;
http://18.228.7.109/.log/pty3;
http://18.228.7.109/.log/pty4;
http://18.228.7.109/.log/pty5;
http://210.141.105.67:80/wp-content/themes/twentythirteen/m8
http://159.89.182.117/wp-content/themes/twentyseventeen/ldm


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"The Log4j vulnerability that came to light at the end of the year can undoubtedly be considered a major event in the security community.  Honeypot and botnet are our bread and butter, and we have been concerned about which botnets would be exploiting this since the vulnerability was made public. This morning we got the first answers, our Anglerfish and Apacket honeypots have caught 2 waves of attacks using the Log4j vulnerability to form botnets, and a quick sample analysis showed that they were used to form Muhstik and Mirai botnets respectively, both targeting Linux devices.\n\n## Sample Analysis\n\n### MIRAI\nThis wave propagates a new variant of miria, which has made the following changes compared to the initial code.\n\n1. table_init/table_lock_val/table_unlock_val and other mirai-specific configuration management functions have been removed.\n\n2. The attack_init function is also discarded, and the ddos attack function is called directly by the command processing function.\n\nAlso, a uy top-level domain is chosen for its C2 domain name, which is also rare.\n\n\n### Muhstik\n\nMuhstik, a botnet we disclosed in [2018]((https://blog.netlab.360.com/botnet-muhstik-is-actively-exploiting-drupal-cve-2018-7600-in-a-worm-style/)), is a variant of Tsunami that borrows from the Mirai code. In this captured sample, we note that the new Muhstik variant adds a backdoor module, ldm, which has the ability to add an SSH backdoor public key with the following installed backdoor public key.\n```\nssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQBtGZHLQlMLkrONMAChDVPZf+9gNG5s2rdTMBkOp6P7mKIQ/OkbgiozmZ3syhELI4L0M1TmJiRbbrIta8662z4WAKhXpiU22llfwrkN0m8yKJApd8lDzvvdBw+ShzJr+WaEWX7uW3WCe5NCxGxc6AU7c2vmuLlO0B203pIGVIbV1xJmj6MXrdZpNy7QRo9zStWmgmVY4GR4v26R3XDOn1gshuQ6PgUqgewQ+AlslLVuekdH23sLQfejXyJShcoFI6BbH67YTcoh4G/TuQdGe8lIeAAmp7lzzHMyu+2iSNoFFCeF48JSA2YZvssFOsGuAtV/9uPNQoi9EyvgM2mGDgJ\n```\n\nAfter the public key is added to the ~/.ssh/authorized_keys file, the attacker can directly log into the remote server without password authentication.\n\nConsidering the special vulnerability mechanism of log4j2, Muhstik takes a blunt approach to spread the payload aimlessly knowing that there will be vulnerable machines, and in order to know who has been infected, Muhstik adopts TOR network for its reporting mechanism.\n\nBefore accessing the TOR network, Muhstik queries relay.l33t-ppl.inf through some publicly available DoH services(see the list beflow). During this process, a number of DNS requests are generated. Note: The following domains are not C2 domains but DoH service providers, depends on the situation, readers might be able to use the list to crosscheck their network for possible infections if they are not expect DoH usage on their network.\n```\ndoh.defaultroutes.de\ndns.hostux.net\ndns.dns-over-https.com\nuncensored.lux1.dns.nixnet.xyz\ndns.rubyfish.cn dns.twnic.tw\ndoh.centraleu.pi-dns.com\ndoh.dns.sb doh-fi.blahdns.com\nfi.doh.dns.snopyta.org\ndns.flatuslifir.is\ndoh.li\ndns.digitale-gesellschaft.ch\n```\n\nWhen it is not possible to report infect information directly from the TOR network, Muhstik will try to use  TOR's public mapped domains, the list of relevant domains is as follows\n```\nbvprzqhoz7j2ltin.onion.ws\nbvprzqhoz7j2ltin.onion.ly\nbvprzqhoz7j2ltin.tor2web.s\n```\n\nMuhstik's ELF sample has the following codes.：\n![tsunami_command-1-1](__GHOST_URL__/content/images/2021/12/tsunami_command-1-1.png)\n\nWe can see that the sample supports DDoS and backdoor commands. The C2 of the sample is stored in a mirai-style configuration with the following configuration information in plain text.：\n```\n [0x02]: \"listening tun0\\x00\", size=15\n [0x03]: \"irc.de-za\"\\x1f\\x90\"listening tun0\\x00\"l\", size=30\n [0x04]: \"\\x1f\\x90\", size=2\n [0x05]: \"log.exposedbotnets.ru\\x00\", size=22\n [0x06]: \"log.exposedbotnets.ru\\x00\", size=22\n [0x07]: \"log.exposedbotnets.ru\\x00\", size=22\n [0x08]: \"log.exposedbotnets.ru\\x00\", size=22\n [0x0a]: \"/proc/\\x00\", size=7\n [0x0c]: \"/exe\\x00\", size=5\n [0x0d]: \"/status\\x00\", size=8\n [0x0e]: \"/fd\\x00\", size=4\n [0x0f]: \"\\x58\\x4D\\x4E\\x4E\\x43\\x50\\x46\\x22\\x00\", size=33\n [0x10]: \"zollard\\x00\", size=8\n [0x11]: \"muhstik-11052018\\x00\", size=17\n [0x12]: \"\\x02^nL\\x0b\\x1a\\x06_nL\\x02\\x0f\\x00\", size=13\n [0x13]: \"eth1\\x00\", size=5\n [0x14]: \"lan0\\x00\", size=5\n [0x15]: \"-\\x00\", size=2\n [0x16]: \"eth0\\x00\", size=5\n [0x17]: \"inet0\\x00\", size=6\n [0x18]: \"lano\\x00\", size=5\n [0x19]: \"log.exposedbotnets.ru\\x00\", size=22\n [0x1a]: \"log.exposedbotnets.ru\\x00\", size=22\n [0x1b]: \"d4cf8e4ab26f7fd15ef7df9f7937493d\\x00\", size=33\n [0x1c]: \"log.exposedbotnets.ru\\x00\", size=22\n [0x1d]: \"37.44.244.124\\x00\", size=14\n [0x1e]: \"37.44.244.124\\x00\", size=14\n [0x1f]: \"37.44.244.124\\x00\", size=14\n [0x20]: \"37.44.244.124\\x00\", size=14\n [0x21]: \"37.44.244.124\\x00\", size=14\n [0x22]: \"log.exposedbotnets.ru\\x00\", size=22\n [0x23]: \"log.exposedbotnets.ru\\x00\", size=22\n```\n\nThe `log.exposedbotnets.ru` is C2, which resolves to `37.44.244.124`. The author registered a domain starting with log perhaps intentionally to fit the Log4j vulnerability.\n\n## Conclusion\nConsidering the huge impact of the Log4j vulnerability, we expect more botnets to support it to spread. We will keep an eye on this and will share new observations here.\n\n## Contact us\nReaders are always welcomed to reach us on [Twitter](https://twitter.com/360Netlab) or email us to netlab at 360 dot cn.\n\n\n## IOC:\n### Mirai\nC2:\n```\nnazi.uy\n```\n\nURL:\n```\nhttp://62.210.130.250/lh.sh\nhttp://62.210.130.250:80/web/admin/x86_64\nhttp://62.210.130.250:80/web/admin/x86\nhttp://62.210.130.250:80/web/admin/x86_g\n```\n\n### Muhstik\nC2:\n```\nlog.exposedbotnets.ru\n```\n\nURL:\n```\nhttp://45.130.229.168:9999/Exploit.class\nhttp://18.228.7.109/.log/log\nhttp://18.228.7.109/.log/pty1;\nhttp://18.228.7.109/.log/pty2;\nhttp://18.228.7.109/.log/pty3;\nhttp://18.228.7.109/.log/pty4;\nhttp://18.228.7.109/.log/pty5;\nhttp://210.141.105.67:80/wp-content/themes/twentythirteen/m8\nhttp://159.89.182.117/wp-content/themes/twentyseventeen/ldm\n```"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}