An Analysis of Linux.Ngioweb Botnet
<!--kg-card-begin: markdown--><h3 id="background">Background</h3>
<p>On May 27, 2019, Our Unknown Threat Detect System highlighted a suspicious ELF file, and till this day, the detection rate on VT is still only one with a very generic name. We determined that this is a Proxy Botnet, and it is a Linux version variant of the Win32.Ngioweb[<a href="https://research.checkpoint.com/ramnits-network-proxy-servers/">1]</a> malware. We named it Linux.Ngioweb. It shares a lot of code with Win32.Ngioweb, except that it has DGA features. We registered one of the DGA C2 domain names (enutofish-pronadimoful-multihitision.org) and was able to observe the Bot connections.</p>
<p>In addition, we have observed that Linux.Ngioweb malware has been implanted into a large number of WordPress Web servers.</p>
<p>Although the Bot program is loaded with the privilege of the user group corresponding to the Web container, it still works and runs as Rotating Proxy node[<a href="https://stormproxies.com/rotating_reverse_proxies.html">2]</a>.</p>
<p>We don’t know why the attacker runs this proxy botnet, but it is possible that everything goes through the proxy is being recorded by the attacker.</p>
<h3 id="overviewoflinuxngioweb">Overview of Linux.Ngioweb</h3>
<p>The main functionality of the Linux.Ngioweb Bot sample is to implement Back-Connect Proxy[<a href="https://hide-ip-proxy.com/what-is-a-backconnect-proxy/">3]</a>.on the victim's machine. The attacker builds multiple Bots into a Proxies Pool and controls it through a two-tier C2 protocol, then provides a Rotating Proxy Service.</p>
<p><a href="__GHOST_URL__/content/images/2019/06/Linux.Ngioweb-1.png"><img src="__GHOST_URL__/content/images/2019/06/Linux.Ngioweb-1.png" class="kg-image"/></a></p>
<h3 id="reverseengineeringonlinuxngioweb">Reverse engineering on Linux.Ngioweb</h3>
<h4 id="basicinformation">Basic information</h4>
<ul>
<li>MD5: 827ecf99001fa66de513fe5281ce064d</li>
</ul>
<blockquote>
<p>ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), statically linked, stripped</p>
</blockquote>
<h4 id="antireverseengineeringtechnique">Anti-reverse engineering technique</h4>
<ul>
<li>
<p>Uses a niche library named musl libc<br>
<a href="__GHOST_URL__/content/images/2019/06/1.PNG"><img src="__GHOST_URL__/content/images/2019/06/1.PNG" class="kg-image"/></a></p>
</li>
<li>
<p>Stores its functions in the function table in advance<br>
<a href="__GHOST_URL__/content/images/2019/06/2.PNG"><img src="__GHOST_URL__/content/images/2019/06/2-3.PNG" class="kg-image"/></a></p>
</li>
<li>
<p>Uses Stack Strings Obfuscation<br>
<a href="__GHOST_URL__/content/images/2019/06/3.PNG"><img src="__GHOST_URL__/content/images/2019/06/3-2.PNG" class="kg-image"/></a></p>
</li>
<li>
<p>Generates constant table used by CRC and AES<br>
<a href="__GHOST_URL__/content/images/2019/06/crypt-1.png"><img src="__GHOST_URL__/content/images/2019/06/crypt-1.png" class="kg-image"/></a></p>
</li>
<li>
<p>Uses a two-tier C2 protocol, where Stage-2 C2 is determined by the CONNECT instruction of Stage-1 C2</p>
</li>
<li>
<p>Stage-2 C2 uses a two-layer encrypted communication protocol</p>
</li>
</ul>
<h4 id="stage1c2protocolanalysis">Stage-1 C2 protocol analysis</h4>
<p>At this stage, the main behavior of the sample is to establish communication with Stage-1 C2, and proceed to the next step according to the instructions returned by C2.</p>
<h6 id="communicationattempt">Communication attempt</h6>
<ul>
<li>
<p>Try to establish communication with the following hardcoded C2 IP every 60 seconds<br>
169.239.128.166:443<br>
185.244.149.73:443</p>
</li>
<li>
<p>Try to establish communication with the domain name generated by DGA (Domain Generation Algorithm) every 73 seconds. When the number of DGA domain names reaches 300, the Seed will be reset. So the total number of DGA domain names is 300.<br>
<a href="__GHOST_URL__/content/images/2019/06/4.PNG"><img src="__GHOST_URL__/content/images/2019/06/4-1.PNG" class="kg-image"/></a></p>
</li>
</ul>
<h6 id="dgaimplementation">DGA implementation</h6>
<pre><code class="language-c">uint64_t GenSeed(uint32_t&amp; seed, uint32_t mod)
{
      uint32_t tmp = 0x41C64E6D * seed + 0x3039;
      seed = tmp;
      return tmp % mod;
}
string dga(uint32_t&amp; seed)
{
      char* HeadBuf[] = { &quot;un&quot;, &quot;under&quot;, &quot;re&quot;, &quot;in&quot;, &quot;im&quot;, &quot;il&quot;, &quot;ir&quot;, &quot;en&quot;, &quot;em&quot;,
                          &quot;over&quot;, &quot;mis&quot;, &quot;dis&quot;, &quot;pre&quot;, &quot;post&quot;, &quot;anti&quot;,&quot;inter&quot;,
                          &quot;sub&quot;, &quot;ultra&quot;, &quot;non&quot;, &quot;de&quot;,&quot;pro&quot;, &quot;trans&quot;, &quot;ex&quot;,
                          &quot;macro&quot;, &quot;micro&quot;, &quot;mini&quot;,&quot;mono&quot;, &quot;multi&quot;, &quot;semi&quot;, &quot;co&quot; };

      char* BodyBufA[] = {&quot;able&quot;,&quot;ant&quot;,&quot;ate&quot;,&quot;age&quot;,&quot;ance&quot;,&quot;ancy&quot;,&quot;an&quot;,&quot;ary&quot;,
                          &quot;al&quot;,&quot;en&quot;,&quot;ency&quot;,&quot;er&quot;,&quot;etn&quot;, &quot;ed&quot;, &quot;ese&quot;,&quot;ern&quot;,&quot;ize&quot;,
                          &quot;ify&quot;,&quot;ing&quot;,&quot;ish&quot;,&quot;ity&quot;,&quot;ion&quot;,&quot;ian&quot;,&quot;ism&quot;,&quot;ist&quot;,&quot;ic&quot;,&quot;ical&quot;,
                          &quot;ible&quot;,&quot;ive&quot;,&quot;ite&quot;,&quot;ish&quot;,&quot;ian&quot;,&quot;or&quot;,&quot;ous&quot;,&quot;ure&quot; };

      char* BodyBufB[] = {&quot;dom&quot;,&quot;hood&quot;,&quot;less&quot;,&quot;like&quot;,&quot;ly&quot;,&quot;fy&quot;,&quot;ful&quot;,&quot;ness&quot;,
                          &quot;ment&quot;,&quot;sion&quot;,&quot;ssion&quot;,&quot;ship&quot;,&quot;ty&quot;,&quot;th&quot;,&quot;tion&quot;,&quot;ward&quot; };

      char* TailBuf[] = { &quot;.net&quot;,&quot;.info&quot;,&quot;.com&quot;,&quot;.biz&quot;,&quot;.org&quot;,&quot;.name&quot; };

      string BlockBufA = &quot;aeiou&quot;;
      string BlockBufB = &quot;bcdfghklmnprstvxz&quot;;
      string domain;
      uint32_t dashloop = GenSeed(seed, 3) + 1;
      while (dashloop--)
      {
              domain += HeadBuf[GenSeed(seed, 0x1e)];
              int flag = 0;
              int i = 0;
              if (BlockBufA.find(domain.back()) == string::npos)
                      flag = 1;
              int fillcnt = GenSeed(seed, 0x3) + 4;
              while (fillcnt &gt; i)
              {

                      if (flag + i &amp; 1)
                              domain += BlockBufA[GenSeed(seed, 0x5)];
                      else
                              domain += BlockBufB[GenSeed(seed, 0x11)];
                      i++;
              }
              if (BlockBufA.find(domain.back()) == string::npos)
                      domain += BodyBufA[GenSeed(seed, 0x23)];
              else
                      domain += BodyBufB[GenSeed(seed, 0x10)];
              if (dashloop != 0)
                      domain += &quot;-&quot;;
      }
      return domain += TailBuf[GenSeed(seed, 0x6)];
}

</code></pre>
<h6 id="communicationprotocol">Communication Protocol</h6>
<p>This phase of communication is based on the HTTP protocol and the parameters are Base64 encoded.</p>
<h6 id="packetsoverview">Packets overview</h6>
<p><a href="__GHOST_URL__/content/images/2019/06/5.PNG"><img src="__GHOST_URL__/content/images/2019/06/5-1.PNG" class="kg-image"/></a></p>
<h6 id="sentpacketsdecode">Sent Packets decode</h6>
<p>After decoded the parameter content by Base64, we get the following information.<br>
<a href="__GHOST_URL__/content/images/2019/06/6.PNG"><img src="__GHOST_URL__/content/images/2019/06/6-1.PNG" class="kg-image"/></a></p>
<ul>
<li>
<p>id=machine-id[0:15]</p>
<p><a href="__GHOST_URL__/content/images/2019/06/7.PNG"><img src="__GHOST_URL__/content/images/2019/06/7.PNG" class="kg-image"/></a></p>
</li>
<li>
<p>v=x86_64, hardcoded, architecture</p>
</li>
<li>
<p>sv=5003, hardcoded, version number</p>
</li>
<li>
<p>&amp;qlohmzalwdepupwf, random 16-byte data, the algorithm is as follows</p>
<p><a href="__GHOST_URL__/content/images/2019/06/8.PNG"><img src="__GHOST_URL__/content/images/2019/06/8-1.PNG" class="kg-image"/></a></p>
</li>
<li>
<p>User-Agent, hardcoded</p>
<pre><code>Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
</code></pre>
</li>
</ul>
<h6 id="receivedpacketsdecode">Received Packets decode</h6>
<p><a href="__GHOST_URL__/content/images/2019/06/a.PNG"><img src="__GHOST_URL__/content/images/2019/06/a-1.PNG" class="kg-image"/></a></p>
<p>Command Supported</p>
<ul>
<li>WAIT</li>
<li>CONNECT</li>
<li>DISCONNECT</li>
<li>CERT</li>
</ul>
<h4 id="stage2c2protocolanalysis">Stage-2 C2 protocol analysis</h4>
<p>At this stage, the main action of the sample is to establish communication with the C2 of Stage-2 and enable the Back-Connect Proxy function. C2 of stage-2 is specified by the CONNECT command.</p>
<h6 id="communicationprotocol">Communication Protocol</h6>
<p>At this stage, the communication is combined by double-layer encryption. The inner layer is XOR and the outer layer is AES.</p>
<h6 id="packetsoverview">Packets overview</h6>
<p><a href="__GHOST_URL__/content/images/2019/06/b.PNG"><img src="__GHOST_URL__/content/images/2019/06/b-1.PNG" class="kg-image"/></a></p>
<h6 id="encryptionalgorithm">Encryption Algorithm</h6>
<p>The XOR key is generated by a random algorithm:<br>
<a href="__GHOST_URL__/content/images/2019/06/d.PNG"><img src="__GHOST_URL__/content/images/2019/06/d-1.PNG" class="kg-image"/></a></p>
<p>The algorithm is:<br>
<a href="__GHOST_URL__/content/images/2019/06/c.PNG"><img src="__GHOST_URL__/content/images/2019/06/c-1.PNG" class="kg-image"/></a></p>
<p>AES uses ECB mode, no padding. The key is:<strong>qwerasdfzxcqwerasdftyuirfdsdsdss</strong></p>
<h6 id="packetstructure">Packet Structure</h6>
<p>The packet consists of two parts: “header” and “msg”.</p>
<p>“header” structure:</p>
<pre><code class="language-c">#le-&gt;little endian
#be-&gt;big endian
struct header
{
	uint32_le xorkey;
	uint32_be msgcrc32;
	uint32_be len;
	uint16_be msgcode
	uint16_be magic
};
</code></pre>
<p>“msg” consists of chunks, and the chunks supported by the sample are as follows:</p>
<table>
<thead>
<tr>
<th>Chunk  Type</th>
<th>Chunk Length</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>1</td>
<td>1</td>
<td>BYTE</td>
</tr>
<tr>
<td>2</td>
<td>2</td>
<td>WORD big endian</td>
</tr>
<tr>
<td>3</td>
<td>4</td>
<td>DWORD big endian</td>
</tr>
<tr>
<td>4</td>
<td>8</td>
<td>QWORD big endian</td>
</tr>
<tr>
<td>5</td>
<td>N+4</td>
<td>Bytes array.The first 4 bytes of chunk are the big endian-encoded length (N) of the array</td>
</tr>
</tbody>
</table>
<p>A “msg” can have one or more chunks, and different “msg”s are made up by different chunks .</p>
<p>The “msg” types uses by this sample are “recv” and “send”.</p>
<ul>
<li>
<p>recv<br>
<a href="__GHOST_URL__/content/images/2019/06/msgrecv.PNG"><img src="__GHOST_URL__/content/images/2019/06/msgrecv-1.PNG" class="kg-image"/></a></p>
</li>
<li>
<p>send<br>
<a href="__GHOST_URL__/content/images/2019/06/msgsend.PNG"><img src="__GHOST_URL__/content/images/2019/06/msgsend-1.PNG" class="kg-image"/></a></p>
</li>
</ul>
<p>See the table below for a summary of different “msg”s:</p>
<table>
<thead>
<tr>
<th>msgcode</th>
<th>Driection</th>
<th>Description</th>
<th>Fromat</th>
</tr>
</thead>
<tbody>
<tr>
<td>0x1010</td>
<td>recv</td>
<td>set channel id</td>
<td>3 chunks:(QWORD ConnId, Array IPAddr,WORD Port)</td>
</tr>
<tr>
<td>0x1011</td>
<td>recv</td>
<td>start proxy request</td>
<td>5 chunks:(QWORD RequestId, BYTE reason,BYTE AddrType,Array Addr, WORD port)</td>
</tr>
<tr>
<td>0x1012</td>
<td>recv</td>
<td>close connection</td>
<td>1 chunk:(QWORD ConnId)</td>
</tr>
<tr>
<td>0x10</td>
<td>send</td>
<td>check-in</td>
<td>1 chunk:(QWORD BotId)</td>
</tr>
<tr>
<td>0x11</td>
<td>send</td>
<td>set-channel ack</td>
<td>1 chunk:(DWORD VersionId)</td>
</tr>
<tr>
<td>0x14</td>
<td>send</td>
<td>tcp server started</td>
<td>5 chunks:(DWORD ConnectionId, QWORD RequestId, BYTE AddrType, Array Addr, WORD Port)</td>
</tr>
<tr>
<td>0x15</td>
<td>send</td>
<td>error</td>
<td>2 chunks:(DWORD RequestId,BYTE reason )</td>
</tr>
<tr>
<td>0x16</td>
<td>send</td>
<td>udp server started</td>
<td>5 chunks:(DWORD ConnectionId, QWORD RequestId, BYTE AddrType, Array Addr, WORD Port)</td>
</tr>
</tbody>
</table>
<h6 id="sentpacketssampleanalysis">Sent packets sample analysis</h6>
<ul>
<li>
<p>Raw data</p>
<pre><code> packet[0:31]:
 6c 52 8c 08 3e 80 a9 3c 00 00 00 10 00 10 fa 51 
 04 dd b0 b4 9d 10 ec 42 c3 00 00 00 00 00 00 00
 header		---&gt;packet[0:15]
 	xorkey		---&gt;0x088c526c
 	msgcrc32	---&gt;0x3e80a93c
 	msglen		---&gt;0x00000010
 	msgcode		---&gt;0x0010,check-in 
 	magic		---&gt;0xfa51
 msg		---&gt;packet[16:31]
 	1st chunk
 		chunktype	---&gt;0x4
 		content		---&gt;0xddb0b49d10ec42c3
 
</code></pre>
</li>
<li>
<p>After XOR encryption</p>
<pre><code>6c 52 8c 08 36 0c fb 50 08 8c 52 7c 08 9c a8 3d 
0c 51 e2 d8 95 9c be 2e cb 8c 52 6c 08 8c 52 6c
</code></pre>
</li>
<li>
<p>After AES encryption</p>
<pre><code>c1 d3 78 71 2d f6 5b bb  16 ca ff 8b ef 69 bb 26
3b 01 f0 22 70 09 38 dc  e7 06 89 de 2b 55 eb 8e
</code></pre>
</li>
</ul>
<h6 id="receivedpacketssampleanalysis">Received packets sample analysis</h6>
<ul>
<li>
<p>Raw data</p>
<pre><code>c5 ad 4a bf 30 C2 3a 43 9b 6e 22 08 73 e0 b9 5d 
3c e6 b7 f0 74 76 53 43 3a 79 0e 82 80 1a c3 84 
ba a4 85 05 4a 63 b1 d6 d1 94 ad 53 be 7a 9a 88
</code></pre>
</li>
<li>
<p>After AES decryption</p>
<pre><code>59 8b e5 6d 4a ee bf ef 6d e5 8b 79 7d f5 71 08
69 b8 81 aa 92 ed 65 fb 29 e0 8b 59 6d e1 51 47
19 e1 89 d8 29 e5 8b 59 6d e5 8b 59 6d e5 8b 59
</code></pre>
</li>
<li>
<p>After XOR decryption</p>
<pre><code>  packet[0:47]
    59 8b e5 6d 27 0b 34 b6 00 00 00 20 10 10 fa 51
    04 5d 0a f3 ff 08 ee a2 44 05 00 00 00 04 da 1e
    74 04 02 81 44 00 00 00 00 00 00 00 00 00 00 00

  header		---&gt;packet[0:15]
    xorkey		---&gt;0x6de58b59
    msgcrc32	---&gt;0x270b34b6
    msglen		---&gt;0x00000020
    msgcode		---&gt;0x1010,set channel id
    magic		---&gt;0xfa51

  msg			---&gt;packet[16:47]
    1st chunk
        chunktype	---&gt;0x04
        content		---&gt;0x5d0af3ff08eea244
    2nt chunk
        chunktype	---&gt;0x05
        content		---&gt;len:0x00000004 buf:0xda1e7404
    3rd chunk
        chunktype	---&gt;0x02
        content		---&gt;0x8144
</code></pre>
</li>
</ul>
<h3 id="stage2c2associationanalysis">Stage-2 C2 association analysis</h3>
<p>We obtained the following 6 Stage-2 C2 addresses by visiting the Stage-1 C2 URL (<a href="http://185.244.149.73:443/min.js">http://185.244.149.73:443/min.js</a>).</p>
<pre><code>5.135.58.119
5.135.58.121
5.135.58.123
5.135.58.124
91.134.157.11
193.70.73.115
</code></pre>
<p>We looked up this md5 (9017804333c820e3b4249130fc989e00) in our GraphicQuery platform and was able to find more IPs which host the same file, we then sent specific crafted packets to these IPs and was able to ID another 18 Stage-2 C2s.</p>
<pre><code>5.135.35.160
5.196.194.209
51.254.57.83
54.36.244.84
54.36.244.85
54.36.244.91
91.121.36.212
91.121.236.219
92.222.151.63
145.239.108.241
163.172.201.184
163.172.202.116
178.33.101.176
178.33.101.177
178.33.101.178
178.33.101.182
188.165.5.123
188.165.163.20
</code></pre>
<p>We found that these Stage-2 C2 IP address are providing Socks5 proxy service by looking them up on free-socks.in</p>
<p><a href="__GHOST_URL__/content/images/2019/06/free-proxy.png"><img src="__GHOST_URL__/content/images/2019/06/free-proxy.png" class="kg-image"/></a></p>
<p>As we tested, all these Socks5 proxy IPs are properly functioning. Also, they accessed the C2 domain we own(enutofish-pronadimoful-multihitision.org)  via the Stage-1 C2 protocol, so it can be said that they are all Linux.Ngioweb Bots.</p>
<pre><code class="language-bash">root@localhost:~# curl --socks5 91.134.157.11:50880 ifconfig.me
31.170.123.49

root@localhost:~# curl --socks5 91.134.157.11:62012 ifconfig.me
208.113.197.88

root@localhost:~# curl --socks5 91.134.157.11:18278 ifconfig.me
45.58.190.100

root@localhost:~# curl --socks5 91.134.157.11:64380 ifconfig.me
72.29.64.29

root@localhost:~# curl --socks5 91.134.157.11:47067 ifconfig.me
54.38.101.17

root@localhost:~# curl --socks5 91.134.157.11:63862 ifconfig.me
88.99.212.97

root@localhost:~# curl --socks5 91.134.157.11:49475 ifconfig.me
23.91.65.240
</code></pre>
<h3 id="infectedipsinformation">Infected IPs information</h3>
<p>By listening on C2 domain (enutofish-pronadimoful-multihitision.org), we have observed a total of 2692 Bot IPs.</p>
<p><a href="__GHOST_URL__/content/images/2019/06/bot.png"><img src="__GHOST_URL__/content/images/2019/06/bot.png" class="kg-image"/></a></p>
<p>The following is a detailed list of countries/regions with number of infected IPs:</p>
<pre><code>US 1306
BR 156
RU 152
DE 133
FR 102
SG 98
NL 80
GB 66
CA 66
IT 64
VN 42
AU 36
PL 31
TR 28
JP 26
IN 26
ZA 21
ID 19
ES 18
UA 15
</code></pre>
<p>By probing the infected IPs, we found out that almost all Bot IPs are web servers and have WordPress programs deployed. We did not look into how the attacker took control of these WordPress sites though.</p>
<p>We contacted some infected users and found multiple WebShells on their Web servers.<br>
These WebShells are highly obscured, but the techniques, encryption, and code share similar characters.<br>
Combined with the accessing characteristics (such as time, order) the infected IPs made to the our sinkhole DGA domain, we speculate that the attacker will periodically issue commands to the WebShells on the victim websites, as well as running the Linux.Ngioweb program.</p>
<h3 id="solutionsandsuggestions">Solutions and Suggestions</h3>
<p>We recommend that readers do not use the Socks5 proxy service provided by these Stage-2 C2 IP.</p>
<p>We recommend that WordPress users back up the website article database (delete backdoor users such as wp.service.controller.*), reinstall the latest version of WordPress program, enhance user password complexity, enhance WebShell detection capabilities, and disable PHP commands to execute related functions;</p>
<h4 id="contactus">Contact us</h4>
<p>Relevant security and law enforcement agencies are welcomed to contact netlab[at]360.cn for a list of infected IP addresses.</p>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a>, WeChat 360Netlab or email to netlab at 360 dot cn.</p>
<h4 id="ioclist">IoC list</h4>
<p>Sample MD5</p>
<pre><code>827ecf99001fa66de513fe5281ce064d
</code></pre>
<p>Stage-1 C2 (Hardcoded IP)</p>
<pre><code>169.239.128.166     	South Africa        	ASN 61138           	Zappie Host LLC
185.244.149.73      	Romania             	ASN 60117           	Host Sailor Ltd.
</code></pre>
<p>Stage-2 C2</p>
<pre><code>163.172.201.184     	France              	ASN 12876           	Online S.a.s.
163.172.202.116     	France              	ASN 12876           	Online S.a.s.
5.135.35.160        	France              	ASN 16276           	OVH SAS
5.135.58.119        	France              	ASN 16276           	OVH SAS
5.135.58.121        	France              	ASN 16276           	OVH SAS
5.135.58.123        	France              	ASN 16276           	OVH SAS
5.135.58.124        	France              	ASN 16276           	OVH SAS
5.196.194.209       	France              	ASN 16276           	OVH SAS
51.254.57.83        	France              	ASN 16276           	OVH SAS
54.36.244.84        	France              	ASN 16276           	OVH SAS
54.36.244.85        	France              	ASN 16276           	OVH SAS
54.36.244.91        	France              	ASN 16276           	OVH SAS
91.121.36.212       	France              	ASN 16276           	OVH SAS
91.121.236.219      	France              	ASN 16276           	OVH SAS
91.134.157.11       	France              	ASN 16276           	OVH SAS
92.222.151.63       	France              	ASN 16276           	OVH SAS
145.239.108.241     	Germany             	ASN 16276           	OVH SAS
178.33.101.176      	Ireland             	ASN 16276           	OVH SAS
178.33.101.177      	Ireland             	ASN 16276           	OVH SAS
178.33.101.178      	Ireland             	ASN 16276           	OVH SAS
178.33.101.182      	Ireland             	ASN 16276           	OVH SAS
188.165.5.123       	Ireland             	ASN 16276           	OVH SAS
188.165.163.20      	France              	ASN 16276           	OVH SAS
193.70.73.115       	France              	ASN 16276           	OVH SAS
</code></pre>
<p>Stage-1 C2 (DGA)</p>
<pre><code>enutofish-pronadimoful-multihitision.org
exaraxexese-macrobacaward-exafosuness.net
nonafudazage.name
demigelike.net
emuvufehood.net
subolukobese.biz
inogepicor-prorarurument.biz
overahudulize-unazibezize-overuzozerish.org
imunolance-postodinenetn-antifipuketn.net
antizerolant-monogevudom.info
transavecaful-transinenation-transikaduhern.com
subogonance.info
inoxodusor-misehupukism.info
devikoviward-semibazegily-copaxugage.name
eniguzeless-inecimanable.net
subilebesion-irogipate.biz
colozosion-antigobunaful.name
inudiduty-dezaviness.org
irelizaring-enipulical-monovuxehossion.info
ilenudavous-monoxoxapal-semimihupution.info
ultrapadupize.biz
covategal-dezakedify-enebugassion.name
transivesudom-macropimuship.org
rezolezation-transapupirify-seminecation.name
macrolutoxous-overefimety.name
coxumumage-dexolalite.name
cotexafical-postirutuvian-emimimous.biz
copubuloness-misumusal-disokozian.com
nonecuzuking-enekopofen-imakozity.info
dezohipal-ultrazebebive.name
cosazalike-antifoxirer-subudikic.biz
underotutilism-monoceraretion-underosociful.name
overugiror.net
emuzixucize.biz
disicevament-desizigasion-recadihuful.biz
decehoward-microhikodely-overokerezant.com
microlasokadom-ultralarumous.info
minixecision-iruzaxuhood.net
profusonuty.info
multifipakency-conovofy-prorakikate.com
antiseramoment.info
postavutetn-emedarevous.biz
inolugoty-inidiverible.com
prodipamament.biz
overogobity-imivocurify-disovizution.biz
decozaness-antihazation-overetalovical.net
nonesolafy.com
unihatosancy.name
interiragocern-micropuxotion-transogorion.org
seminamatity-enogibely.name
inosebovion.net
exofifure-postirexument.info
transirirenern-semizafunic-nonivubed.biz
enegizize-microtizobity.name
macrohuseded-multipazaseship.com
imefihured-macrohixuhood.org
microlulition-macrokiguxable.biz
multizesumefy-emebefion.biz
underebelassion-postizoziless.info
dezuvazen.name
decotusion-exexavihood-exevozebant.name
disuzepuly.info
inuviging-antizoluly.biz
multisotiren-ilazufist.org
predepussion.info
inidozadom.name
interikuhaful.info
cozuheming.biz
multiruxuth.org
monozogeced.org
mononoredom.info
postarubixage-monocinamety-overogefesal.com
prebekokian-misadepepive-transilogify.com
monohatodom-cohotiship.com
exebasusion.org
unahodoness-emevuzeward-emuzeduness.com
exemidexous-underiposapite-unegatature.name
interocugopist-misugexadic-ilobipegency.org
monokifomancy-misagefism-macrobepoth.com
antizekussion-minipusaral-copofuxoship.com
relutodom-comakitize.name
multikezusion.org
emopumical-enohecical.org
semitegopish.net
recepatission.info
inoluvary.com
seminitotuful.info
interanubing-emelulotal-transugotuzern.com
subefehity-iledutession.name
ultrapapiten.biz
transuvarusish-prozumoxety.info
transisigern.org
imirotiship-microhopulive-emotomeship.com
presefavution.info
enevifaking.org
misidogive-coxecovor-dexefoxan.name
overazadudom-deliromohood.com
emakanuward.com
emitohage-overasuhorure-antitipenoless.info
ultrasesebible.biz
multihadekite.name
iluvused-iravoxish.info
postobagoly-detovaward-unixohible.biz
underasusogen.com
imovaman-multimihivoship-imeduxian.biz
dedunuguhood.com
prevukition.info
underehugavish.org
misoxomelical-iluxubism.net
microcolacoful-postabitition.name
overurohely-overadolure-iruraluness.org
unurodable-dekipuhic-postuxufous.org
unitucihern-postadagen-imupuduth.org
imukokuship.org
prenubocetion-ultrahahohood.com
monofugition-underefogukic.org
irofetufy.com
irobigelike.org
presifament.biz
overetigution.info
enuvopan-imixesoward-irarupipary.biz
inorofizian.com
monopadecotion-multicecihood-imuzicasion.com
exofosehance-minimezazofy.org
monokacofudom-inuvinable.com
emisucosion-prohosexite-imorekusion.net
semiledoduly.info
multivapufy-promumuly-enonuben.net
subebodency.info
cofexasish-inodehed.net
unutexupify-conofubusion.com
misebonure-iluborize-rezericify.com
exunaxian.info
colanizity-postosecive-nonuresible.info
dedaliward-imipusen-inacaliver.com
refusovize.org
monokuvission-transodigical-semihehamussion.biz
transalavudom-multilavezuhood.net
exusizeward.net
unisimor.name
minipihagaship.com
recusigetion-transubeviful.info
multixizitufy-microtomuly-multixoleward.com
microxulodish-semibahoty.biz
macrokunith-proxobivive.net
preginaxodom.name
transimapeful-cotalision.com
prefinazuly.name
inucasazing-microhesunian-semidikokement.biz
disitirotion-transekarenate.org
unehihify-antimepavable-nonubovafy.net
misunotelike-nonugidant.info
enogosudom-macrogekabive.biz
postozokipetn-microdomobaly.biz
interunavission-ininibecist.org
microhinoler.org
prosihamish-noneguhaness.com
preberekous-microkagibant-imemahal.name
iletegifage.org
emikuraran.biz
overokigoty-ilecavish.net
nonikofucable-postelihuzism-rexecigism.net
imixifure.info
minirabupeness-nonitefuward.org
misasugegify-underazosuzish-exuvexezical.info
multipocihood-monomuhunible.org
nonohacutancy-postuxikitan-microseditoless.info
overasobament.info
overulurotion.biz
disepadely-disuzirovor.net
repetepian-irelucify.biz
enikobadom-postolixement.name
inunatogite-imoboraness.net
irimarefy.net
monohiloless-demodefy.com
previbetian-misunohigate.info
multivunuhance-inabiber.com
semicasinaty-ilibaholy.biz
transupovetn-monozeruduless.biz
debapesetn-underisaxufical-imukugamism.info
multibibetefy.com
exanonish.name
interanulish-imazekalike-unisukugate.info
inokevidage.org
monofipuly-underubihal.net
profobekify-subebobefy-exozufous.name
macrovetecuship-emebudemical-underaxakament.biz
demeficiward-retitisily-macromuvaward.org
monosumuly-ilenusuty-dedabaness.net
exapofaran-postulusadify.com
microhobament-postevofafity.com
rebezusaly-overidirity-ultrahiseness.org
unafacigage-transihicical-prebokity.info
interazution-irudegufy-antinefoly.biz
minizecidish-macrolafukish-depovased.biz
derirepous-cosideship-semibiseless.biz
overupazadity-irativorical.name
coseviness-nonikunant-macrorasihood.net
nonesocern-macrotocipity.info
interuzoputy.info
inicinic-misuluzan-ultrakuxuness.com
sububesebism-ultrabutath.com
misacireship.org
exuxuburan-miniravuhood-exosoxen.info
macrozigahood-monosulopancy.com
unegoping-detunusion-antimuruseful.biz
macrozixaward-semivanimoly-underekutoty.biz
ultratipuxian-inosilission-multiridith.net
microtonagament.info
cobemesion-redacocoful.name
disicogure-seminedasoly.biz
dekacify.net
emegamilike-imupogazance-ultrapanacesion.org
unocelibable-underelatucance.com
irodetolike-imisocatite-inecolafian.com
antikuzucen-irokarance-transitupikible.org
semiralety-macrorobinant-ultrapixutency.biz
transisomuless.name
ilebigument-macroripakesion.org
profebarable.org
nonixigefy-protisumiless.biz
corahicohood.com
pretuvution-disafatutical-irehopuvese.name
miniregath-anticesuty-postudagily.biz
coguvilaship-recakubodom.name
overipugoful-interizihing.org
imipadaness-iralikoward-semitolicoly.info
interupefity-semigiduly.info
macromosoriship.net
antigizepist.net
subuluhic-disomokate.net
irunucudor-macrogocudern-comoxizish.name
underedofobate.net
prolapuzern-progobutiful-dehifasion.org
irucasian-macrofevasion.net
unogoxeness-semixocapency.org
rehofocese.org
exebutian-interomifenism.org
subihefahood-subenopure-ultramoherihood.net
nonezogeward.com
exasavate-minidevilefy-subanevous.biz
enodenission-overucelancy-microvitasission.info
ultrafakitesion-misesuzahical-transanafetion.biz
interinipoly-minimorovor-debininess.com
prenedelission-interugefable-repekosossion.name
postifozible-irololuship.com
unozolasion.org
unobelaness-prepifavety.info
cofukosable.info
iloletible-imakeben.info
ultraronupity.name
minikisision-monobavunism-micronepavage.org
unufepaness-misedepugance.biz
inafolage.com
semifolofic-unaraxal.biz
enerivosism-imenufanist-macrovonahood.org
monobocution.info
cosuzuness-prepurizor-unasulal.name
inopivic-antimaporary-subavocobive.biz
covogidish-iletinassion.biz
defizalike-unodatage-inarabevous.com
unuvirisern-interusalosize-misucakiness.org
ireninenish-multicemath-prezucetussion.biz
interodekive.com
iramilahood-antirotuxary-misobegesion.name
multidafadite-postagoker.org
monobagehance.net
emixuvidite-ilofikency-subolubify.biz
postugihucency-emademify.name
cotefehood-imocakitency.biz
enikavely-inosifuty-postaviraly.info
transabusossion.biz
interitebure.net
unehumugage-ultraburosion.com
subutavahen-inuhabish.org
subifefer-devufoward-probelalance.org
emefimafible.biz
ilibefudom.biz
postemivaxage.net
monofudumossion.info
inuxazodom-macrodexaxahood.org
semibugegetn-monohifutuly.biz
macromohazaship-subonohion-disonixucing.com
emosacekant-cokebohood-nonetakive.biz
interozecifist-antipinukity-multifekemath.net
refedomous-antifaliless.name
ultraxekevohood-nonizerosion-exovigant.name
interarogous-unuculuhood.org
semipulimian.com
monocalacaless.biz
disevolikency-retipegation.biz
cosituxath-misuxunor.info
ultraporader-conapefy-prolobeziless.info
ilucasure.com
reletohite-misosulahood-antitedudom.info
minivucilous-inafafomism.net
monorifutaless-ilocamussion.name
inohufohese-imufilahood-antifidupite.com
emegemaxed-transigifuty-multitumolith.net
exotacible-denitokolike.com
</code></pre>
<!--kg-card-end: markdown-->
Background


On May 27, 2019, Our Unknown Threat Detect System highlighted a suspicious ELF file, and till this day, the detection rate on VT is still only one with a very generic name. We determined that this is a Proxy Botnet, and it is a Linux version variant of the Win32.Ngioweb[1] malware. We named it Linux.Ngioweb. It shares a lot of code with Win32.Ngioweb, except that it has DGA features. We registered one of the DGA C2 domain names (enutofish-pronadimoful-multihitision.org) and was able to observe the Bot connections.


In addition, we have observed that Linux.Ngioweb malware has been implanted into a large number of WordPress Web servers.


Although the Bot program is loaded with the privilege of the user group corresponding to the Web container, it still works and runs as Rotating Proxy node[2].


We don’t know why the attacker runs this proxy botnet, but it is possible that everything goes through the proxy is being recorded by the attacker.



Overview of Linux.Ngioweb


The main functionality of the Linux.Ngioweb Bot sample is to implement Back-Connect Proxy[3].on the victim's machine. The attacker builds multiple Bots into a Proxies Pool and controls it through a two-tier C2 protocol, then provides a Rotating Proxy Service.






Reverse engineering on Linux.Ngioweb


Basic information


 * MD5: 827ecf99001fa66de513fe5281ce064d





ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), statically linked, stripped



Anti-reverse engineering technique


 * 
   
   
   Uses a niche library named musl libc
   
   
   

 * 
   
   
   Stores its functions in the function table in advance
   
   
   

 * 
   
   
   Uses Stack Strings Obfuscation
   
   
   

 * 
   
   
   Generates constant table used by CRC and AES
   
   
   

 * 
   
   
   Uses a two-tier C2 protocol, where Stage-2 C2 is determined by the CONNECT instruction of Stage-1 C2
   

 * 
   
   
   Stage-2 C2 uses a two-layer encrypted communication protocol
   


Stage-1 C2 protocol analysis


At this stage, the main behavior of the sample is to establish communication with Stage-1 C2, and proceed to the next step according to the instructions returned by C2.


Communication attempt


 * 
   
   
   Try to establish communication with the following hardcoded C2 IP every 60 seconds
   
   169.239.128.166:443
   
   185.244.149.73:443
   

 * 
   
   
   Try to establish communication with the domain name generated by DGA (Domain Generation Algorithm) every 73 seconds. When the number of DGA domain names reaches 300, the Seed will be reset. So the total number of DGA domain names is 300.
   
   
   


DGA implementation


uint64_t GenSeed(uint32_t& seed, uint32_t mod)
{
      uint32_t tmp = 0x41C64E6D * seed + 0x3039;
      seed = tmp;
      return tmp % mod;
}
string dga(uint32_t& seed)
{
      char* HeadBuf[] = { "un", "under", "re", "in", "im", "il", "ir", "en", "em",
                          "over", "mis", "dis", "pre", "post", "anti","inter",
                          "sub", "ultra", "non", "de","pro", "trans", "ex",
                          "macro", "micro", "mini","mono", "multi", "semi", "co" };

      char* BodyBufA[] = {"able","ant","ate","age","ance","ancy","an","ary",
                          "al","en","ency","er","etn", "ed", "ese","ern","ize",
                          "ify","ing","ish","ity","ion","ian","ism","ist","ic","ical",
                          "ible","ive","ite","ish","ian","or","ous","ure" };

      char* BodyBufB[] = {"dom","hood","less","like","ly","fy","ful","ness",
                          "ment","sion","ssion","ship","ty","th","tion","ward" };

      char* TailBuf[] = { ".net",".info",".com",".biz",".org",".name" };

      string BlockBufA = "aeiou";
      string BlockBufB = "bcdfghklmnprstvxz";
      string domain;
      uint32_t dashloop = GenSeed(seed, 3) + 1;
      while (dashloop--)
      {
              domain += HeadBuf[GenSeed(seed, 0x1e)];
              int flag = 0;
              int i = 0;
              if (BlockBufA.find(domain.back()) == string::npos)
                      flag = 1;
              int fillcnt = GenSeed(seed, 0x3) + 4;
              while (fillcnt > i)
              {

                      if (flag + i & 1)
                              domain += BlockBufA[GenSeed(seed, 0x5)];
                      else
                              domain += BlockBufB[GenSeed(seed, 0x11)];
                      i++;
              }
              if (BlockBufA.find(domain.back()) == string::npos)
                      domain += BodyBufA[GenSeed(seed, 0x23)];
              else
                      domain += BodyBufB[GenSeed(seed, 0x10)];
              if (dashloop != 0)
                      domain += "-";
      }
      return domain += TailBuf[GenSeed(seed, 0x6)];
}




Communication Protocol


This phase of communication is based on the HTTP protocol and the parameters are Base64 encoded.


Packets overview





Sent Packets decode


After decoded the parameter content by Base64, we get the following information.




 * 
   
   
   id=machine-id[0:15]
   
   
   
   

 * 
   
   
   v=x86_64, hardcoded, architecture
   

 * 
   
   
   sv=5003, hardcoded, version number
   

 * 
   
   
   &qlohmzalwdepupwf, random 16-byte data, the algorithm is as follows
   
   
   
   

 * 
   
   
   User-Agent, hardcoded
   
   
   Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
   
   


Received Packets decode





Command Supported


 * WAIT
 * CONNECT
 * DISCONNECT
 * CERT


Stage-2 C2 protocol analysis


At this stage, the main action of the sample is to establish communication with the C2 of Stage-2 and enable the Back-Connect Proxy function. C2 of stage-2 is specified by the CONNECT command.


Communication Protocol


At this stage, the communication is combined by double-layer encryption. The inner layer is XOR and the outer layer is AES.


Packets overview





Encryption Algorithm


The XOR key is generated by a random algorithm:




The algorithm is:




AES uses ECB mode, no padding. The key is:qwerasdfzxcqwerasdftyuirfdsdsdss


Packet Structure


The packet consists of two parts: “header” and “msg”.


“header” structure:


#le->little endian
#be->big endian
struct header
{
	uint32_le xorkey;
	uint32_be msgcrc32;
	uint32_be len;
	uint16_be msgcode
	uint16_be magic
};



“msg” consists of chunks, and the chunks supported by the sample are as follows:





Chunk Type
Chunk Length
Description




1
1
BYTE


2
2
WORD big endian


3
4
DWORD big endian


4
8
QWORD big endian


5
N+4
Bytes array.The first 4 bytes of chunk are the big endian-encoded length (N) of the array





A “msg” can have one or more chunks, and different “msg”s are made up by different chunks .


The “msg” types uses by this sample are “recv” and “send”.


 * 
   
   
   recv
   
   
   

 * 
   
   
   send
   
   
   


See the table below for a summary of different “msg”s:





msgcode
Driection
Description
Fromat




0x1010
recv
set channel id
3 chunks:(QWORD ConnId, Array IPAddr,WORD Port)


0x1011
recv
start proxy request
5 chunks:(QWORD RequestId, BYTE reason,BYTE AddrType,Array Addr, WORD port)


0x1012
recv
close connection
1 chunk:(QWORD ConnId)


0x10
send
check-in
1 chunk:(QWORD BotId)


0x11
send
set-channel ack
1 chunk:(DWORD VersionId)


0x14
send
tcp server started
5 chunks:(DWORD ConnectionId, QWORD RequestId, BYTE AddrType, Array Addr, WORD Port)


0x15
send
error
2 chunks:(DWORD RequestId,BYTE reason )


0x16
send
udp server started
5 chunks:(DWORD ConnectionId, QWORD RequestId, BYTE AddrType, Array Addr, WORD Port)





Sent packets sample analysis


 * 
   
   
   Raw data
   
   
    packet[0:31]:
    6c 52 8c 08 3e 80 a9 3c 00 00 00 10 00 10 fa 51 
    04 dd b0 b4 9d 10 ec 42 c3 00 00 00 00 00 00 00
    header		--->packet[0:15]
    	xorkey		--->0x088c526c
    	msgcrc32	--->0x3e80a93c
    	msglen		--->0x00000010
    	msgcode		--->0x0010,check-in 
    	magic		--->0xfa51
    msg		--->packet[16:31]
    	1st chunk
    		chunktype	--->0x4
    		content		--->0xddb0b49d10ec42c3
    
   
   

 * 
   
   
   After XOR encryption
   
   
   6c 52 8c 08 36 0c fb 50 08 8c 52 7c 08 9c a8 3d 
   0c 51 e2 d8 95 9c be 2e cb 8c 52 6c 08 8c 52 6c
   
   

 * 
   
   
   After AES encryption
   
   
   c1 d3 78 71 2d f6 5b bb  16 ca ff 8b ef 69 bb 26
   3b 01 f0 22 70 09 38 dc  e7 06 89 de 2b 55 eb 8e
   
   


Received packets sample analysis


 * 
   
   
   Raw data
   
   
   c5 ad 4a bf 30 C2 3a 43 9b 6e 22 08 73 e0 b9 5d 
   3c e6 b7 f0 74 76 53 43 3a 79 0e 82 80 1a c3 84 
   ba a4 85 05 4a 63 b1 d6 d1 94 ad 53 be 7a 9a 88
   
   

 * 
   
   
   After AES decryption
   
   
   59 8b e5 6d 4a ee bf ef 6d e5 8b 79 7d f5 71 08
   69 b8 81 aa 92 ed 65 fb 29 e0 8b 59 6d e1 51 47
   19 e1 89 d8 29 e5 8b 59 6d e5 8b 59 6d e5 8b 59
   
   

 * 
   
   
   After XOR decryption
   
   
     packet[0:47]
       59 8b e5 6d 27 0b 34 b6 00 00 00 20 10 10 fa 51
       04 5d 0a f3 ff 08 ee a2 44 05 00 00 00 04 da 1e
       74 04 02 81 44 00 00 00 00 00 00 00 00 00 00 00
   
     header		--->packet[0:15]
       xorkey		--->0x6de58b59
       msgcrc32	--->0x270b34b6
       msglen		--->0x00000020
       msgcode		--->0x1010,set channel id
       magic		--->0xfa51
   
     msg			--->packet[16:47]
       1st chunk
           chunktype	--->0x04
           content		--->0x5d0af3ff08eea244
       2nt chunk
           chunktype	--->0x05
           content		--->len:0x00000004 buf:0xda1e7404
       3rd chunk
           chunktype	--->0x02
           content		--->0x8144
   
   



Stage-2 C2 association analysis


We obtained the following 6 Stage-2 C2 addresses by visiting the Stage-1 C2 URL (http://185.244.149.73:443/min.js).


5.135.58.119
5.135.58.121
5.135.58.123
5.135.58.124
91.134.157.11
193.70.73.115



We looked up this md5 (9017804333c820e3b4249130fc989e00) in our GraphicQuery platform and was able to find more IPs which host the same file, we then sent specific crafted packets to these IPs and was able to ID another 18 Stage-2 C2s.


5.135.35.160
5.196.194.209
51.254.57.83
54.36.244.84
54.36.244.85
54.36.244.91
91.121.36.212
91.121.236.219
92.222.151.63
145.239.108.241
163.172.201.184
163.172.202.116
178.33.101.176
178.33.101.177
178.33.101.178
178.33.101.182
188.165.5.123
188.165.163.20



We found that these Stage-2 C2 IP address are providing Socks5 proxy service by looking them up on free-socks.in





As we tested, all these Socks5 proxy IPs are properly functioning. Also, they accessed the C2 domain we own(enutofish-pronadimoful-multihitision.org) via the Stage-1 C2 protocol, so it can be said that they are all Linux.Ngioweb Bots.


root@localhost:~# curl --socks5 91.134.157.11:50880 ifconfig.me
31.170.123.49

root@localhost:~# curl --socks5 91.134.157.11:62012 ifconfig.me
208.113.197.88

root@localhost:~# curl --socks5 91.134.157.11:18278 ifconfig.me
45.58.190.100

root@localhost:~# curl --socks5 91.134.157.11:64380 ifconfig.me
72.29.64.29

root@localhost:~# curl --socks5 91.134.157.11:47067 ifconfig.me
54.38.101.17

root@localhost:~# curl --socks5 91.134.157.11:63862 ifconfig.me
88.99.212.97

root@localhost:~# curl --socks5 91.134.157.11:49475 ifconfig.me
23.91.65.240




Infected IPs information


By listening on C2 domain (enutofish-pronadimoful-multihitision.org), we have observed a total of 2692 Bot IPs.





The following is a detailed list of countries/regions with number of infected IPs:


US 1306
BR 156
RU 152
DE 133
FR 102
SG 98
NL 80
GB 66
CA 66
IT 64
VN 42
AU 36
PL 31
TR 28
JP 26
IN 26
ZA 21
ID 19
ES 18
UA 15



By probing the infected IPs, we found out that almost all Bot IPs are web servers and have WordPress programs deployed. We did not look into how the attacker took control of these WordPress sites though.


We contacted some infected users and found multiple WebShells on their Web servers.

These WebShells are highly obscured, but the techniques, encryption, and code share similar characters.

Combined with the accessing characteristics (such as time, order) the infected IPs made to the our sinkhole DGA domain, we speculate that the attacker will periodically issue commands to the WebShells on the victim websites, as well as running the Linux.Ngioweb program.



Solutions and Suggestions


We recommend that readers do not use the Socks5 proxy service provided by these Stage-2 C2 IP.


We recommend that WordPress users back up the website article database (delete backdoor users such as wp.service.controller.*), reinstall the latest version of WordPress program, enhance user password complexity, enhance WebShell detection capabilities, and disable PHP commands to execute related functions;


Contact us


Relevant security and law enforcement agencies are welcomed to contact netlab[at]360.cn for a list of infected IP addresses.


Readers are always welcomed to reach us on twitter, WeChat 360Netlab or email to netlab at 360 dot cn.


IoC list


Sample MD5


827ecf99001fa66de513fe5281ce064d



Stage-1 C2 (Hardcoded IP)


169.239.128.166     	South Africa        	ASN 61138           	Zappie Host LLC
185.244.149.73      	Romania             	ASN 60117           	Host Sailor Ltd.



Stage-2 C2


163.172.201.184     	France              	ASN 12876           	Online S.a.s.
163.172.202.116     	France              	ASN 12876           	Online S.a.s.
5.135.35.160        	France              	ASN 16276           	OVH SAS
5.135.58.119        	France              	ASN 16276           	OVH SAS
5.135.58.121        	France              	ASN 16276           	OVH SAS
5.135.58.123        	France              	ASN 16276           	OVH SAS
5.135.58.124        	France              	ASN 16276           	OVH SAS
5.196.194.209       	France              	ASN 16276           	OVH SAS
51.254.57.83        	France              	ASN 16276           	OVH SAS
54.36.244.84        	France              	ASN 16276           	OVH SAS
54.36.244.85        	France              	ASN 16276           	OVH SAS
54.36.244.91        	France              	ASN 16276           	OVH SAS
91.121.36.212       	France              	ASN 16276           	OVH SAS
91.121.236.219      	France              	ASN 16276           	OVH SAS
91.134.157.11       	France              	ASN 16276           	OVH SAS
92.222.151.63       	France              	ASN 16276           	OVH SAS
145.239.108.241     	Germany             	ASN 16276           	OVH SAS
178.33.101.176      	Ireland             	ASN 16276           	OVH SAS
178.33.101.177      	Ireland             	ASN 16276           	OVH SAS
178.33.101.178      	Ireland             	ASN 16276           	OVH SAS
178.33.101.182      	Ireland             	ASN 16276           	OVH SAS
188.165.5.123       	Ireland             	ASN 16276           	OVH SAS
188.165.163.20      	France              	ASN 16276           	OVH SAS
193.70.73.115       	France              	ASN 16276           	OVH SAS



Stage-1 C2 (DGA)


enutofish-pronadimoful-multihitision.org
exaraxexese-macrobacaward-exafosuness.net
nonafudazage.name
demigelike.net
emuvufehood.net
subolukobese.biz
inogepicor-prorarurument.biz
overahudulize-unazibezize-overuzozerish.org
imunolance-postodinenetn-antifipuketn.net
antizerolant-monogevudom.info
transavecaful-transinenation-transikaduhern.com
subogonance.info
inoxodusor-misehupukism.info
devikoviward-semibazegily-copaxugage.name
eniguzeless-inecimanable.net
subilebesion-irogipate.biz
colozosion-antigobunaful.name
inudiduty-dezaviness.org
irelizaring-enipulical-monovuxehossion.info
ilenudavous-monoxoxapal-semimihupution.info
ultrapadupize.biz
covategal-dezakedify-enebugassion.name
transivesudom-macropimuship.org
rezolezation-transapupirify-seminecation.name
macrolutoxous-overefimety.name
coxumumage-dexolalite.name
cotexafical-postirutuvian-emimimous.biz
copubuloness-misumusal-disokozian.com
nonecuzuking-enekopofen-imakozity.info
dezohipal-ultrazebebive.name
cosazalike-antifoxirer-subudikic.biz
underotutilism-monoceraretion-underosociful.name
overugiror.net
emuzixucize.biz
disicevament-desizigasion-recadihuful.biz
decehoward-microhikodely-overokerezant.com
microlasokadom-ultralarumous.info
minixecision-iruzaxuhood.net
profusonuty.info
multifipakency-conovofy-prorakikate.com
antiseramoment.info
postavutetn-emedarevous.biz
inolugoty-inidiverible.com
prodipamament.biz
overogobity-imivocurify-disovizution.biz
decozaness-antihazation-overetalovical.net
nonesolafy.com
unihatosancy.name
interiragocern-micropuxotion-transogorion.org
seminamatity-enogibely.name
inosebovion.net
exofifure-postirexument.info
transirirenern-semizafunic-nonivubed.biz
enegizize-microtizobity.name
macrohuseded-multipazaseship.com
imefihured-macrohixuhood.org
microlulition-macrokiguxable.biz
multizesumefy-emebefion.biz
underebelassion-postizoziless.info
dezuvazen.name
decotusion-exexavihood-exevozebant.name
disuzepuly.info
inuviging-antizoluly.biz
multisotiren-ilazufist.org
predepussion.info
inidozadom.name
interikuhaful.info
cozuheming.biz
multiruxuth.org
monozogeced.org
mononoredom.info
postarubixage-monocinamety-overogefesal.com
prebekokian-misadepepive-transilogify.com
monohatodom-cohotiship.com
exebasusion.org
unahodoness-emevuzeward-emuzeduness.com
exemidexous-underiposapite-unegatature.name
interocugopist-misugexadic-ilobipegency.org
monokifomancy-misagefism-macrobepoth.com
antizekussion-minipusaral-copofuxoship.com
relutodom-comakitize.name
multikezusion.org
emopumical-enohecical.org
semitegopish.net
recepatission.info
inoluvary.com
seminitotuful.info
interanubing-emelulotal-transugotuzern.com
subefehity-iledutession.name
ultrapapiten.biz
transuvarusish-prozumoxety.info
transisigern.org
imirotiship-microhopulive-emotomeship.com
presefavution.info
enevifaking.org
misidogive-coxecovor-dexefoxan.name
overazadudom-deliromohood.com
emakanuward.com
emitohage-overasuhorure-antitipenoless.info
ultrasesebible.biz
multihadekite.name
iluvused-iravoxish.info
postobagoly-detovaward-unixohible.biz
underasusogen.com
imovaman-multimihivoship-imeduxian.biz
dedunuguhood.com
prevukition.info
underehugavish.org
misoxomelical-iluxubism.net
microcolacoful-postabitition.name
overurohely-overadolure-iruraluness.org
unurodable-dekipuhic-postuxufous.org
unitucihern-postadagen-imupuduth.org
imukokuship.org
prenubocetion-ultrahahohood.com
monofugition-underefogukic.org
irofetufy.com
irobigelike.org
presifament.biz
overetigution.info
enuvopan-imixesoward-irarupipary.biz
inorofizian.com
monopadecotion-multicecihood-imuzicasion.com
exofosehance-minimezazofy.org
monokacofudom-inuvinable.com
emisucosion-prohosexite-imorekusion.net
semiledoduly.info
multivapufy-promumuly-enonuben.net
subebodency.info
cofexasish-inodehed.net
unutexupify-conofubusion.com
misebonure-iluborize-rezericify.com
exunaxian.info
colanizity-postosecive-nonuresible.info
dedaliward-imipusen-inacaliver.com
refusovize.org
monokuvission-transodigical-semihehamussion.biz
transalavudom-multilavezuhood.net
exusizeward.net
unisimor.name
minipihagaship.com
recusigetion-transubeviful.info
multixizitufy-microtomuly-multixoleward.com
microxulodish-semibahoty.biz
macrokunith-proxobivive.net
preginaxodom.name
transimapeful-cotalision.com
prefinazuly.name
inucasazing-microhesunian-semidikokement.biz
disitirotion-transekarenate.org
unehihify-antimepavable-nonubovafy.net
misunotelike-nonugidant.info
enogosudom-macrogekabive.biz
postozokipetn-microdomobaly.biz
interunavission-ininibecist.org
microhinoler.org
prosihamish-noneguhaness.com
preberekous-microkagibant-imemahal.name
iletegifage.org
emikuraran.biz
overokigoty-ilecavish.net
nonikofucable-postelihuzism-rexecigism.net
imixifure.info
minirabupeness-nonitefuward.org
misasugegify-underazosuzish-exuvexezical.info
multipocihood-monomuhunible.org
nonohacutancy-postuxikitan-microseditoless.info
overasobament.info
overulurotion.biz
disepadely-disuzirovor.net
repetepian-irelucify.biz
enikobadom-postolixement.name
inunatogite-imoboraness.net
irimarefy.net
monohiloless-demodefy.com
previbetian-misunohigate.info
multivunuhance-inabiber.com
semicasinaty-ilibaholy.biz
transupovetn-monozeruduless.biz
debapesetn-underisaxufical-imukugamism.info
multibibetefy.com
exanonish.name
interanulish-imazekalike-unisukugate.info
inokevidage.org
monofipuly-underubihal.net
profobekify-subebobefy-exozufous.name
macrovetecuship-emebudemical-underaxakament.biz
demeficiward-retitisily-macromuvaward.org
monosumuly-ilenusuty-dedabaness.net
exapofaran-postulusadify.com
microhobament-postevofafity.com
rebezusaly-overidirity-ultrahiseness.org
unafacigage-transihicical-prebokity.info
interazution-irudegufy-antinefoly.biz
minizecidish-macrolafukish-depovased.biz
derirepous-cosideship-semibiseless.biz
overupazadity-irativorical.name
coseviness-nonikunant-macrorasihood.net
nonesocern-macrotocipity.info
interuzoputy.info
inicinic-misuluzan-ultrakuxuness.com
sububesebism-ultrabutath.com
misacireship.org
exuxuburan-miniravuhood-exosoxen.info
macrozigahood-monosulopancy.com
unegoping-detunusion-antimuruseful.biz
macrozixaward-semivanimoly-underekutoty.biz
ultratipuxian-inosilission-multiridith.net
microtonagament.info
cobemesion-redacocoful.name
disicogure-seminedasoly.biz
dekacify.net
emegamilike-imupogazance-ultrapanacesion.org
unocelibable-underelatucance.com
irodetolike-imisocatite-inecolafian.com
antikuzucen-irokarance-transitupikible.org
semiralety-macrorobinant-ultrapixutency.biz
transisomuless.name
ilebigument-macroripakesion.org
profebarable.org
nonixigefy-protisumiless.biz
corahicohood.com
pretuvution-disafatutical-irehopuvese.name
miniregath-anticesuty-postudagily.biz
coguvilaship-recakubodom.name
overipugoful-interizihing.org
imipadaness-iralikoward-semitolicoly.info
interupefity-semigiduly.info
macromosoriship.net
antigizepist.net
subuluhic-disomokate.net
irunucudor-macrogocudern-comoxizish.name
underedofobate.net
prolapuzern-progobutiful-dehifasion.org
irucasian-macrofevasion.net
unogoxeness-semixocapency.org
rehofocese.org
exebutian-interomifenism.org
subihefahood-subenopure-ultramoherihood.net
nonezogeward.com
exasavate-minidevilefy-subanevous.biz
enodenission-overucelancy-microvitasission.info
ultrafakitesion-misesuzahical-transanafetion.biz
interinipoly-minimorovor-debininess.com
prenedelission-interugefable-repekosossion.name
postifozible-irololuship.com
unozolasion.org
unobelaness-prepifavety.info
cofukosable.info
iloletible-imakeben.info
ultraronupity.name
minikisision-monobavunism-micronepavage.org
unufepaness-misedepugance.biz
inafolage.com
semifolofic-unaraxal.biz
enerivosism-imenufanist-macrovonahood.org
monobocution.info
cosuzuness-prepurizor-unasulal.name
inopivic-antimaporary-subavocobive.biz
covogidish-iletinassion.biz
defizalike-unodatage-inarabevous.com
unuvirisern-interusalosize-misucakiness.org
ireninenish-multicemath-prezucetussion.biz
interodekive.com
iramilahood-antirotuxary-misobegesion.name
multidafadite-postagoker.org
monobagehance.net
emixuvidite-ilofikency-subolubify.biz
postugihucency-emademify.name
cotefehood-imocakitency.biz
enikavely-inosifuty-postaviraly.info
transabusossion.biz
interitebure.net
unehumugage-ultraburosion.com
subutavahen-inuhabish.org
subifefer-devufoward-probelalance.org
emefimafible.biz
ilibefudom.biz
postemivaxage.net
monofudumossion.info
inuxazodom-macrodexaxahood.org
semibugegetn-monohifutuly.biz
macromohazaship-subonohion-disonixucing.com
emosacekant-cokebohood-nonetakive.biz
interozecifist-antipinukity-multifekemath.net
refedomous-antifaliless.name
ultraxekevohood-nonizerosion-exovigant.name
interarogous-unuculuhood.org
semipulimian.com
monocalacaless.biz
disevolikency-retipegation.biz
cosituxath-misuxunor.info
ultraporader-conapefy-prolobeziless.info
ilucasure.com
reletohite-misosulahood-antitedudom.info
minivucilous-inafafomism.net
monorifutaless-ilocamussion.name
inohufohese-imufilahood-antifidupite.com
emegemaxed-transigifuty-multitumolith.net
exotacible-denitokolike.com


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"### Background\nOn May 27, 2019, Our Unknown Threat Detect System highlighted a suspicious ELF file, and till this day, the detection rate on VT is still only one with a very generic name. We determined that this is a Proxy Botnet, and it is a Linux version variant of the Win32.Ngioweb[[1\\]](https://research.checkpoint.com/ramnits-network-proxy-servers/) malware. We named it Linux.Ngioweb. It shares a lot of code with Win32.Ngioweb, except that it has DGA features. We registered one of the DGA C2 domain names (enutofish-pronadimoful-multihitision.org) and was able to observe the Bot connections.\n\nIn addition, we have observed that Linux.Ngioweb malware has been implanted into a large number of WordPress Web servers.\n\nAlthough the Bot program is loaded with the privilege of the user group corresponding to the Web container, it still works and runs as Rotating Proxy node[[2\\]](https://stormproxies.com/rotating_reverse_proxies.html).\n\nWe don’t know why the attacker runs this proxy botnet, but it is possible that everything goes through the proxy is being recorded by the attacker.\n\n### Overview of Linux.Ngioweb\n\nThe main functionality of the Linux.Ngioweb Bot sample is to implement Back-Connect Proxy[[3\\]](https://hide-ip-proxy.com/what-is-a-backconnect-proxy/).on the victim's machine. The attacker builds multiple Bots into a Proxies Pool and controls it through a two-tier C2 protocol, then provides a Rotating Proxy Service.\n\n<a href=\"__GHOST_URL__/content/images/2019/06/Linux.Ngioweb-1.png\"><img src=\"__GHOST_URL__/content/images/2019/06/Linux.Ngioweb-1.png\" class=\"kg-image\"/></a>\n\n### Reverse engineering on Linux.Ngioweb\n#### Basic information\n * MD5: 827ecf99001fa66de513fe5281ce064d\n > ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), statically linked, stripped\n \n \n#### Anti-reverse engineering technique\n- Uses a niche library named musl libc\n  <a href=\"__GHOST_URL__/content/images/2019/06/1.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/1.PNG\" class=\"kg-image\"/></a>\n\n- Stores its functions in the function table in advance\n  <a href=\"__GHOST_URL__/content/images/2019/06/2.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/2-3.PNG\" class=\"kg-image\"/></a>\n\n- Uses Stack Strings Obfuscation\n  <a href=\"__GHOST_URL__/content/images/2019/06/3.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/3-2.PNG\" class=\"kg-image\"/></a>\n\n- Generates constant table used by CRC and AES\n   <a href=\"__GHOST_URL__/content/images/2019/06/crypt-1.png\"><img src=\"__GHOST_URL__/content/images/2019/06/crypt-1.png\" class=\"kg-image\"/></a>\n\n- Uses a two-tier C2 protocol, where Stage-2 C2 is determined by the CONNECT instruction of Stage-1 C2\n\n- Stage-2 C2 uses a two-layer encrypted communication protocol\n\n#### Stage-1 C2 protocol analysis\n\nAt this stage, the main behavior of the sample is to establish communication with Stage-1 C2, and proceed to the next step according to the instructions returned by C2.\n\n###### Communication attempt\n\n* Try to establish communication with the following hardcoded C2 IP every 60 seconds\n    169.239.128.166:443 \n    185.244.149.73:443\n\n* Try to establish communication with the domain name generated by DGA (Domain Generation Algorithm) every 73 seconds. When the number of DGA domain names reaches 300, the Seed will be reset. So the total number of DGA domain names is 300.\n  <a href=\"__GHOST_URL__/content/images/2019/06/4.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/4-1.PNG\" class=\"kg-image\"/></a>\n\n\n###### DGA implementation\n  ```c\nuint64_t GenSeed(uint32_t& seed, uint32_t mod)\n{\n        uint32_t tmp = 0x41C64E6D * seed + 0x3039;\n        seed = tmp;\n        return tmp % mod;\n}\nstring dga(uint32_t& seed)\n{\n        char* HeadBuf[] = { \"un\", \"under\", \"re\", \"in\", \"im\", \"il\", \"ir\", \"en\", \"em\",\n                            \"over\", \"mis\", \"dis\", \"pre\", \"post\", \"anti\",\"inter\",\n                            \"sub\", \"ultra\", \"non\", \"de\",\"pro\", \"trans\", \"ex\",\n                            \"macro\", \"micro\", \"mini\",\"mono\", \"multi\", \"semi\", \"co\" };\n\n        char* BodyBufA[] = {\"able\",\"ant\",\"ate\",\"age\",\"ance\",\"ancy\",\"an\",\"ary\",\n                            \"al\",\"en\",\"ency\",\"er\",\"etn\", \"ed\", \"ese\",\"ern\",\"ize\",\n                            \"ify\",\"ing\",\"ish\",\"ity\",\"ion\",\"ian\",\"ism\",\"ist\",\"ic\",\"ical\",\n                            \"ible\",\"ive\",\"ite\",\"ish\",\"ian\",\"or\",\"ous\",\"ure\" };\n\n        char* BodyBufB[] = {\"dom\",\"hood\",\"less\",\"like\",\"ly\",\"fy\",\"ful\",\"ness\",\n                            \"ment\",\"sion\",\"ssion\",\"ship\",\"ty\",\"th\",\"tion\",\"ward\" };\n\n        char* TailBuf[] = { \".net\",\".info\",\".com\",\".biz\",\".org\",\".name\" };\n\n        string BlockBufA = \"aeiou\";\n        string BlockBufB = \"bcdfghklmnprstvxz\";\n        string domain;\n        uint32_t dashloop = GenSeed(seed, 3) + 1;\n        while (dashloop--)\n        {\n                domain += HeadBuf[GenSeed(seed, 0x1e)];\n                int flag = 0;\n                int i = 0;\n                if (BlockBufA.find(domain.back()) == string::npos)\n                        flag = 1;\n                int fillcnt = GenSeed(seed, 0x3) + 4;\n                while (fillcnt > i)\n                {\n\n                        if (flag + i & 1)\n                                domain += BlockBufA[GenSeed(seed, 0x5)];\n                        else\n                                domain += BlockBufB[GenSeed(seed, 0x11)];\n                        i++;\n                }\n                if (BlockBufA.find(domain.back()) == string::npos)\n                        domain += BodyBufA[GenSeed(seed, 0x23)];\n                else\n                        domain += BodyBufB[GenSeed(seed, 0x10)];\n                if (dashloop != 0)\n                        domain += \"-\";\n        }\n        return domain += TailBuf[GenSeed(seed, 0x6)];\n}\n\n  ```\n\n  \n\n###### Communication Protocol \n\nThis phase of communication is based on the HTTP protocol and the parameters are Base64 encoded.\n\n###### Packets overview\n\n<a href=\"__GHOST_URL__/content/images/2019/06/5.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/5-1.PNG\" class=\"kg-image\"/></a>\n\n###### Sent Packets decode\n\nAfter decoded the parameter content by Base64, we get the following information.\n<a href=\"__GHOST_URL__/content/images/2019/06/6.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/6-1.PNG\" class=\"kg-image\"/></a>\n\n* id=machine-id[0:15]\n\n  <a href=\"__GHOST_URL__/content/images/2019/06/7.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/7.PNG\" class=\"kg-image\"/></a>\n\n* v=x86_64, hardcoded, architecture\n\n* sv=5003, hardcoded, version number\n\n* &qlohmzalwdepupwf, random 16-byte data, the algorithm is as follows \n\n  <a href=\"__GHOST_URL__/content/images/2019/06/8.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/8-1.PNG\" class=\"kg-image\"/></a>\n\n* User-Agent, hardcoded\n\n  ```\n  Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0\n  ```\n\n###### Received Packets decode\n\n<a href=\"__GHOST_URL__/content/images/2019/06/a.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/a-1.PNG\" class=\"kg-image\"/></a>\n\nCommand Supported\n\n* WAIT\n* CONNECT\n* DISCONNECT\n* CERT\n\n#### Stage-2 C2 protocol analysis\n\nAt this stage, the main action of the sample is to establish communication with the C2 of Stage-2 and enable the Back-Connect Proxy function. C2 of stage-2 is specified by the CONNECT command.\n\n###### Communication Protocol \n\nAt this stage, the communication is combined by double-layer encryption. The inner layer is XOR and the outer layer is AES.\n\n###### Packets overview\n\n<a href=\"__GHOST_URL__/content/images/2019/06/b.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/b-1.PNG\" class=\"kg-image\"/></a>\n\n###### Encryption Algorithm\n\nThe XOR key is generated by a random algorithm:\n<a href=\"__GHOST_URL__/content/images/2019/06/d.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/d-1.PNG\" class=\"kg-image\"/></a>\n\n\nThe algorithm is:\n<a href=\"__GHOST_URL__/content/images/2019/06/c.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/c-1.PNG\" class=\"kg-image\"/></a>\n\nAES uses ECB mode, no padding. The key is:**qwerasdfzxcqwerasdftyuirfdsdsdss**\n\n\n###### Packet Structure\nThe packet consists of two parts: “header” and “msg”.\n\n“header” structure:\n\n```c\n#le->little endian\n#be->big endian\nstruct header\n{\n\tuint32_le xorkey;\n\tuint32_be msgcrc32;\n\tuint32_be len;\n\tuint16_be msgcode\n\tuint16_be magic\n};\n```\n\n\n“msg” consists of chunks, and the chunks supported by the sample are as follows:\n| Chunk  Type | Chunk Length | Description                                                  |\n| ----------- | ------------ | ------------------------------------------------------------ |\n| 1           | 1            | BYTE                                                         |\n| 2           | 2            | WORD big endian                                              |\n| 3           | 4            | DWORD big endian                                             |\n| 4           | 8            | QWORD big endian                                             |\n| 5           | N+4          | Bytes array.The first 4 bytes of chunk are the big endian-encoded length (N) of the array |\n\nA “msg” can have one or more chunks, and different “msg”s are made up by different chunks .\n\nThe “msg” types uses by this sample are “recv” and “send”.\n\n* recv\n  <a href=\"__GHOST_URL__/content/images/2019/06/msgrecv.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/msgrecv-1.PNG\" class=\"kg-image\"/></a>\n  \n* send\n  <a href=\"__GHOST_URL__/content/images/2019/06/msgsend.PNG\"><img src=\"__GHOST_URL__/content/images/2019/06/msgsend-1.PNG\" class=\"kg-image\"/></a>\n\nSee the table below for a summary of different “msg”s:\n| msgcode | Driection | Description         | Fromat                                                       |\n| ------- | --------- | ------------------- | ------------------------------------------------------------ |\n| 0x1010  | recv      | set channel id      | 3 chunks:(QWORD ConnId, Array IPAddr,WORD Port)              |\n| 0x1011  | recv      | start proxy request | 5 chunks:(QWORD RequestId, BYTE reason,BYTE AddrType,Array Addr, WORD port) |\n| 0x1012  | recv      | close connection    | 1 chunk:(QWORD ConnId)                                       |\n| 0x10    | send      | check-in            | 1 chunk:(QWORD BotId)                                        |\n| 0x11    | send      | set-channel ack     | 1 chunk:(DWORD VersionId)                                    |\n| 0x14    | send      | tcp server started  | 5 chunks:(DWORD ConnectionId, QWORD RequestId, BYTE AddrType, Array Addr, WORD Port) |\n| 0x15    | send      | error               | 2 chunks:(DWORD RequestId,BYTE reason )                      |\n| 0x16    | send      | udp server started  | 5 chunks:(DWORD ConnectionId, QWORD RequestId, BYTE AddrType, Array Addr, WORD Port) |\n\n###### Sent packets sample analysis\n\n* Raw data\n  ```\n   packet[0:31]:\n   6c 52 8c 08 3e 80 a9 3c 00 00 00 10 00 10 fa 51 \n   04 dd b0 b4 9d 10 ec 42 c3 00 00 00 00 00 00 00\n   header\t\t--->packet[0:15]\n   \txorkey\t\t--->0x088c526c\n   \tmsgcrc32\t--->0x3e80a93c\n   \tmsglen\t\t--->0x00000010\n   \tmsgcode\t\t--->0x0010,check-in \n   \tmagic\t\t--->0xfa51\n   msg\t\t--->packet[16:31]\n   \t1st chunk\n   \t\tchunktype\t--->0x4\n   \t\tcontent\t\t--->0xddb0b49d10ec42c3\n   \n  ```\n\n* After XOR encryption\n\n  ```\n  6c 52 8c 08 36 0c fb 50 08 8c 52 7c 08 9c a8 3d \n  0c 51 e2 d8 95 9c be 2e cb 8c 52 6c 08 8c 52 6c\n  ```\n\n* After AES encryption\n\n  ```\n  c1 d3 78 71 2d f6 5b bb  16 ca ff 8b ef 69 bb 26\n  3b 01 f0 22 70 09 38 dc  e7 06 89 de 2b 55 eb 8e\n  ```\n\n###### Received packets sample analysis\n\n* Raw data\n\n  ```\n  c5 ad 4a bf 30 C2 3a 43 9b 6e 22 08 73 e0 b9 5d \n  3c e6 b7 f0 74 76 53 43 3a 79 0e 82 80 1a c3 84 \n  ba a4 85 05 4a 63 b1 d6 d1 94 ad 53 be 7a 9a 88\n  ```\n\n* After AES decryption\n\n  ```\n  59 8b e5 6d 4a ee bf ef 6d e5 8b 79 7d f5 71 08\n  69 b8 81 aa 92 ed 65 fb 29 e0 8b 59 6d e1 51 47\n  19 e1 89 d8 29 e5 8b 59 6d e5 8b 59 6d e5 8b 59\n  ```\n\n* After XOR decryption\n\n  ```\n    packet[0:47]\n      59 8b e5 6d 27 0b 34 b6 00 00 00 20 10 10 fa 51\n      04 5d 0a f3 ff 08 ee a2 44 05 00 00 00 04 da 1e\n      74 04 02 81 44 00 00 00 00 00 00 00 00 00 00 00\n\n    header\t\t--->packet[0:15]\n      xorkey\t\t--->0x6de58b59\n      msgcrc32\t--->0x270b34b6\n      msglen\t\t--->0x00000020\n      msgcode\t\t--->0x1010,set channel id\n      magic\t\t--->0xfa51\n\n    msg\t\t\t--->packet[16:47]\n      1st chunk\n          chunktype\t--->0x04\n          content\t\t--->0x5d0af3ff08eea244\n      2nt chunk\n          chunktype\t--->0x05\n          content\t\t--->len:0x00000004 buf:0xda1e7404\n      3rd chunk\n          chunktype\t--->0x02\n          content\t\t--->0x8144\n  ```\n\n### Stage-2 C2 association analysis\n\nWe obtained the following 6 Stage-2 C2 addresses by visiting the Stage-1 C2 URL (http://185.244.149.73:443/min.js).\n```\n5.135.58.119\n5.135.58.121\n5.135.58.123\n5.135.58.124\n91.134.157.11\n193.70.73.115\n```\nWe looked up this md5 (9017804333c820e3b4249130fc989e00) in our GraphicQuery platform and was able to find more IPs which host the same file, we then sent specific crafted packets to these IPs and was able to ID another 18 Stage-2 C2s.\n\n```\n5.135.35.160\n5.196.194.209\n51.254.57.83\n54.36.244.84\n54.36.244.85\n54.36.244.91\n91.121.36.212\n91.121.236.219\n92.222.151.63\n145.239.108.241\n163.172.201.184\n163.172.202.116\n178.33.101.176\n178.33.101.177\n178.33.101.178\n178.33.101.182\n188.165.5.123\n188.165.163.20\n```\n\nWe found that these Stage-2 C2 IP address are providing Socks5 proxy service by looking them up on free-socks.in\n\n<a href=\"__GHOST_URL__/content/images/2019/06/free-proxy.png\"><img src=\"__GHOST_URL__/content/images/2019/06/free-proxy.png\" class=\"kg-image\"/></a>\n\nAs we tested, all these Socks5 proxy IPs are properly functioning. Also, they accessed the C2 domain we own(enutofish-pronadimoful-multihitision.org)  via the Stage-1 C2 protocol, so it can be said that they are all Linux.Ngioweb Bots.\n\n```bash\nroot@localhost:~# curl --socks5 91.134.157.11:50880 ifconfig.me\n31.170.123.49\n\nroot@localhost:~# curl --socks5 91.134.157.11:62012 ifconfig.me\n208.113.197.88\n\nroot@localhost:~# curl --socks5 91.134.157.11:18278 ifconfig.me\n45.58.190.100\n\nroot@localhost:~# curl --socks5 91.134.157.11:64380 ifconfig.me\n72.29.64.29\n\nroot@localhost:~# curl --socks5 91.134.157.11:47067 ifconfig.me\n54.38.101.17\n\nroot@localhost:~# curl --socks5 91.134.157.11:63862 ifconfig.me\n88.99.212.97\n\nroot@localhost:~# curl --socks5 91.134.157.11:49475 ifconfig.me\n23.91.65.240\n```\n\n\n\n### Infected IPs information\n\nBy listening on C2 domain (enutofish-pronadimoful-multihitision.org), we have observed a total of 2692 Bot IPs.\n\n<a href=\"__GHOST_URL__/content/images/2019/06/bot.png\"><img src=\"__GHOST_URL__/content/images/2019/06/bot.png\" class=\"kg-image\"/></a>\n\n\nThe following is a detailed list of countries/regions with number of infected IPs:\n```\nUS 1306\nBR 156\nRU 152\nDE 133\nFR 102\nSG 98\nNL 80\nGB 66\nCA 66\nIT 64\nVN 42\nAU 36\nPL 31\nTR 28\nJP 26\nIN 26\nZA 21\nID 19\nES 18\nUA 15\n```\n\nBy probing the infected IPs, we found out that almost all Bot IPs are web servers and have WordPress programs deployed. We did not look into how the attacker took control of these WordPress sites though.\n\nWe contacted some infected users and found multiple WebShells on their Web servers.\nThese WebShells are highly obscured, but the techniques, encryption, and code share similar characters.\nCombined with the accessing characteristics (such as time, order) the infected IPs made to the our sinkhole DGA domain, we speculate that the attacker will periodically issue commands to the WebShells on the victim websites, as well as running the Linux.Ngioweb program.\n\n\n\n### Solutions and Suggestions\n\nWe recommend that readers do not use the Socks5 proxy service provided by these Stage-2 C2 IP.\n\nWe recommend that WordPress users back up the website article database (delete backdoor users such as wp.service.controller.*), reinstall the latest version of WordPress program, enhance user password complexity, enhance WebShell detection capabilities, and disable PHP commands to execute related functions;\n\n\n\n#### Contact us\n\nRelevant security and law enforcement agencies are welcomed to contact netlab[at]360.cn for a list of infected IP addresses.\n\nReaders are always welcomed to reach us on [**twitter**](https://twitter.com/360Netlab), WeChat 360Netlab or email to netlab at 360 dot cn.\n\n\n#### IoC list\n\nSample MD5\n\n```\n827ecf99001fa66de513fe5281ce064d\n```\n\n\n\nStage-1 C2 (Hardcoded IP)\n\n```\n169.239.128.166     \tSouth Africa        \tASN 61138           \tZappie Host LLC\n185.244.149.73      \tRomania             \tASN 60117           \tHost Sailor Ltd.\n```\n\n\n\nStage-2 C2\n\n```\n163.172.201.184     \tFrance              \tASN 12876           \tOnline S.a.s.\n163.172.202.116     \tFrance              \tASN 12876           \tOnline S.a.s.\n5.135.35.160        \tFrance              \tASN 16276           \tOVH SAS\n5.135.58.119        \tFrance              \tASN 16276           \tOVH SAS\n5.135.58.121        \tFrance              \tASN 16276           \tOVH SAS\n5.135.58.123        \tFrance              \tASN 16276           \tOVH SAS\n5.135.58.124        \tFrance              \tASN 16276           \tOVH SAS\n5.196.194.209       \tFrance              \tASN 16276           \tOVH SAS\n51.254.57.83        \tFrance              \tASN 16276           \tOVH SAS\n54.36.244.84        \tFrance              \tASN 16276           \tOVH SAS\n54.36.244.85        \tFrance              \tASN 16276           \tOVH SAS\n54.36.244.91        \tFrance              \tASN 16276           \tOVH SAS\n91.121.36.212       \tFrance              \tASN 16276           \tOVH SAS\n91.121.236.219      \tFrance              \tASN 16276           \tOVH SAS\n91.134.157.11       \tFrance              \tASN 16276           \tOVH SAS\n92.222.151.63       \tFrance              \tASN 16276           \tOVH SAS\n145.239.108.241     \tGermany             \tASN 16276           \tOVH SAS\n178.33.101.176      \tIreland             \tASN 16276           \tOVH SAS\n178.33.101.177      \tIreland             \tASN 16276           \tOVH SAS\n178.33.101.178      \tIreland             \tASN 16276           \tOVH SAS\n178.33.101.182      \tIreland             \tASN 16276           \tOVH SAS\n188.165.5.123       \tIreland             \tASN 16276           \tOVH SAS\n188.165.163.20      \tFrance              \tASN 16276           \tOVH SAS\n193.70.73.115       \tFrance              \tASN 16276           \tOVH SAS\n```\n\n\n\nStage-1 C2 (DGA)\n\n```\nenutofish-pronadimoful-multihitision.org\nexaraxexese-macrobacaward-exafosuness.net\nnonafudazage.name\ndemigelike.net\nemuvufehood.net\nsubolukobese.biz\ninogepicor-prorarurument.biz\noverahudulize-unazibezize-overuzozerish.org\nimunolance-postodinenetn-antifipuketn.net\nantizerolant-monogevudom.info\ntransavecaful-transinenation-transikaduhern.com\nsubogonance.info\ninoxodusor-misehupukism.info\ndevikoviward-semibazegily-copaxugage.name\neniguzeless-inecimanable.net\nsubilebesion-irogipate.biz\ncolozosion-antigobunaful.name\ninudiduty-dezaviness.org\nirelizaring-enipulical-monovuxehossion.info\nilenudavous-monoxoxapal-semimihupution.info\nultrapadupize.biz\ncovategal-dezakedify-enebugassion.name\ntransivesudom-macropimuship.org\nrezolezation-transapupirify-seminecation.name\nmacrolutoxous-overefimety.name\ncoxumumage-dexolalite.name\ncotexafical-postirutuvian-emimimous.biz\ncopubuloness-misumusal-disokozian.com\nnonecuzuking-enekopofen-imakozity.info\ndezohipal-ultrazebebive.name\ncosazalike-antifoxirer-subudikic.biz\nunderotutilism-monoceraretion-underosociful.name\noverugiror.net\nemuzixucize.biz\ndisicevament-desizigasion-recadihuful.biz\ndecehoward-microhikodely-overokerezant.com\nmicrolasokadom-ultralarumous.info\nminixecision-iruzaxuhood.net\nprofusonuty.info\nmultifipakency-conovofy-prorakikate.com\nantiseramoment.info\npostavutetn-emedarevous.biz\ninolugoty-inidiverible.com\nprodipamament.biz\noverogobity-imivocurify-disovizution.biz\ndecozaness-antihazation-overetalovical.net\nnonesolafy.com\nunihatosancy.name\ninteriragocern-micropuxotion-transogorion.org\nseminamatity-enogibely.name\ninosebovion.net\nexofifure-postirexument.info\ntransirirenern-semizafunic-nonivubed.biz\nenegizize-microtizobity.name\nmacrohuseded-multipazaseship.com\nimefihured-macrohixuhood.org\nmicrolulition-macrokiguxable.biz\nmultizesumefy-emebefion.biz\nunderebelassion-postizoziless.info\ndezuvazen.name\ndecotusion-exexavihood-exevozebant.name\ndisuzepuly.info\ninuviging-antizoluly.biz\nmultisotiren-ilazufist.org\npredepussion.info\ninidozadom.name\ninterikuhaful.info\ncozuheming.biz\nmultiruxuth.org\nmonozogeced.org\nmononoredom.info\npostarubixage-monocinamety-overogefesal.com\nprebekokian-misadepepive-transilogify.com\nmonohatodom-cohotiship.com\nexebasusion.org\nunahodoness-emevuzeward-emuzeduness.com\nexemidexous-underiposapite-unegatature.name\ninterocugopist-misugexadic-ilobipegency.org\nmonokifomancy-misagefism-macrobepoth.com\nantizekussion-minipusaral-copofuxoship.com\nrelutodom-comakitize.name\nmultikezusion.org\nemopumical-enohecical.org\nsemitegopish.net\nrecepatission.info\ninoluvary.com\nseminitotuful.info\ninteranubing-emelulotal-transugotuzern.com\nsubefehity-iledutession.name\nultrapapiten.biz\ntransuvarusish-prozumoxety.info\ntransisigern.org\nimirotiship-microhopulive-emotomeship.com\npresefavution.info\nenevifaking.org\nmisidogive-coxecovor-dexefoxan.name\noverazadudom-deliromohood.com\nemakanuward.com\nemitohage-overasuhorure-antitipenoless.info\nultrasesebible.biz\nmultihadekite.name\niluvused-iravoxish.info\npostobagoly-detovaward-unixohible.biz\nunderasusogen.com\nimovaman-multimihivoship-imeduxian.biz\ndedunuguhood.com\nprevukition.info\nunderehugavish.org\nmisoxomelical-iluxubism.net\nmicrocolacoful-postabitition.name\noverurohely-overadolure-iruraluness.org\nunurodable-dekipuhic-postuxufous.org\nunitucihern-postadagen-imupuduth.org\nimukokuship.org\nprenubocetion-ultrahahohood.com\nmonofugition-underefogukic.org\nirofetufy.com\nirobigelike.org\npresifament.biz\noveretigution.info\nenuvopan-imixesoward-irarupipary.biz\ninorofizian.com\nmonopadecotion-multicecihood-imuzicasion.com\nexofosehance-minimezazofy.org\nmonokacofudom-inuvinable.com\nemisucosion-prohosexite-imorekusion.net\nsemiledoduly.info\nmultivapufy-promumuly-enonuben.net\nsubebodency.info\ncofexasish-inodehed.net\nunutexupify-conofubusion.com\nmisebonure-iluborize-rezericify.com\nexunaxian.info\ncolanizity-postosecive-nonuresible.info\ndedaliward-imipusen-inacaliver.com\nrefusovize.org\nmonokuvission-transodigical-semihehamussion.biz\ntransalavudom-multilavezuhood.net\nexusizeward.net\nunisimor.name\nminipihagaship.com\nrecusigetion-transubeviful.info\nmultixizitufy-microtomuly-multixoleward.com\nmicroxulodish-semibahoty.biz\nmacrokunith-proxobivive.net\npreginaxodom.name\ntransimapeful-cotalision.com\nprefinazuly.name\ninucasazing-microhesunian-semidikokement.biz\ndisitirotion-transekarenate.org\nunehihify-antimepavable-nonubovafy.net\nmisunotelike-nonugidant.info\nenogosudom-macrogekabive.biz\npostozokipetn-microdomobaly.biz\ninterunavission-ininibecist.org\nmicrohinoler.org\nprosihamish-noneguhaness.com\npreberekous-microkagibant-imemahal.name\niletegifage.org\nemikuraran.biz\noverokigoty-ilecavish.net\nnonikofucable-postelihuzism-rexecigism.net\nimixifure.info\nminirabupeness-nonitefuward.org\nmisasugegify-underazosuzish-exuvexezical.info\nmultipocihood-monomuhunible.org\nnonohacutancy-postuxikitan-microseditoless.info\noverasobament.info\noverulurotion.biz\ndisepadely-disuzirovor.net\nrepetepian-irelucify.biz\nenikobadom-postolixement.name\ninunatogite-imoboraness.net\nirimarefy.net\nmonohiloless-demodefy.com\nprevibetian-misunohigate.info\nmultivunuhance-inabiber.com\nsemicasinaty-ilibaholy.biz\ntransupovetn-monozeruduless.biz\ndebapesetn-underisaxufical-imukugamism.info\nmultibibetefy.com\nexanonish.name\ninteranulish-imazekalike-unisukugate.info\ninokevidage.org\nmonofipuly-underubihal.net\nprofobekify-subebobefy-exozufous.name\nmacrovetecuship-emebudemical-underaxakament.biz\ndemeficiward-retitisily-macromuvaward.org\nmonosumuly-ilenusuty-dedabaness.net\nexapofaran-postulusadify.com\nmicrohobament-postevofafity.com\nrebezusaly-overidirity-ultrahiseness.org\nunafacigage-transihicical-prebokity.info\ninterazution-irudegufy-antinefoly.biz\nminizecidish-macrolafukish-depovased.biz\nderirepous-cosideship-semibiseless.biz\noverupazadity-irativorical.name\ncoseviness-nonikunant-macrorasihood.net\nnonesocern-macrotocipity.info\ninteruzoputy.info\ninicinic-misuluzan-ultrakuxuness.com\nsububesebism-ultrabutath.com\nmisacireship.org\nexuxuburan-miniravuhood-exosoxen.info\nmacrozigahood-monosulopancy.com\nunegoping-detunusion-antimuruseful.biz\nmacrozixaward-semivanimoly-underekutoty.biz\nultratipuxian-inosilission-multiridith.net\nmicrotonagament.info\ncobemesion-redacocoful.name\ndisicogure-seminedasoly.biz\ndekacify.net\nemegamilike-imupogazance-ultrapanacesion.org\nunocelibable-underelatucance.com\nirodetolike-imisocatite-inecolafian.com\nantikuzucen-irokarance-transitupikible.org\nsemiralety-macrorobinant-ultrapixutency.biz\ntransisomuless.name\nilebigument-macroripakesion.org\nprofebarable.org\nnonixigefy-protisumiless.biz\ncorahicohood.com\npretuvution-disafatutical-irehopuvese.name\nminiregath-anticesuty-postudagily.biz\ncoguvilaship-recakubodom.name\noveripugoful-interizihing.org\nimipadaness-iralikoward-semitolicoly.info\ninterupefity-semigiduly.info\nmacromosoriship.net\nantigizepist.net\nsubuluhic-disomokate.net\nirunucudor-macrogocudern-comoxizish.name\nunderedofobate.net\nprolapuzern-progobutiful-dehifasion.org\nirucasian-macrofevasion.net\nunogoxeness-semixocapency.org\nrehofocese.org\nexebutian-interomifenism.org\nsubihefahood-subenopure-ultramoherihood.net\nnonezogeward.com\nexasavate-minidevilefy-subanevous.biz\nenodenission-overucelancy-microvitasission.info\nultrafakitesion-misesuzahical-transanafetion.biz\ninterinipoly-minimorovor-debininess.com\nprenedelission-interugefable-repekosossion.name\npostifozible-irololuship.com\nunozolasion.org\nunobelaness-prepifavety.info\ncofukosable.info\niloletible-imakeben.info\nultraronupity.name\nminikisision-monobavunism-micronepavage.org\nunufepaness-misedepugance.biz\ninafolage.com\nsemifolofic-unaraxal.biz\nenerivosism-imenufanist-macrovonahood.org\nmonobocution.info\ncosuzuness-prepurizor-unasulal.name\ninopivic-antimaporary-subavocobive.biz\ncovogidish-iletinassion.biz\ndefizalike-unodatage-inarabevous.com\nunuvirisern-interusalosize-misucakiness.org\nireninenish-multicemath-prezucetussion.biz\ninterodekive.com\niramilahood-antirotuxary-misobegesion.name\nmultidafadite-postagoker.org\nmonobagehance.net\nemixuvidite-ilofikency-subolubify.biz\npostugihucency-emademify.name\ncotefehood-imocakitency.biz\nenikavely-inosifuty-postaviraly.info\ntransabusossion.biz\ninteritebure.net\nunehumugage-ultraburosion.com\nsubutavahen-inuhabish.org\nsubifefer-devufoward-probelalance.org\nemefimafible.biz\nilibefudom.biz\npostemivaxage.net\nmonofudumossion.info\ninuxazodom-macrodexaxahood.org\nsemibugegetn-monohifutuly.biz\nmacromohazaship-subonohion-disonixucing.com\nemosacekant-cokebohood-nonetakive.biz\ninterozecifist-antipinukity-multifekemath.net\nrefedomous-antifaliless.name\nultraxekevohood-nonizerosion-exovigant.name\ninterarogous-unuculuhood.org\nsemipulimian.com\nmonocalacaless.biz\ndisevolikency-retipegation.biz\ncosituxath-misuxunor.info\nultraporader-conapefy-prolobeziless.info\nilucasure.com\nreletohite-misosulahood-antitedudom.info\nminivucilous-inafafomism.net\nmonorifutaless-ilocamussion.name\ninohufohese-imufilahood-antifidupite.com\nemegemaxed-transigifuty-multitumolith.net\nexotacible-denitokolike.com\n```\n\n"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}