3 ms·
~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed 's/[][]//g'|sort -u|grep -f exits -c 191 ~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed
by ryanlol 10y ago
~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed 's/[][]//g'|sort -u|grep -f exits -c
191
~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed 's/[][]//g'|sort -u|wc -l
876
At least 191 of the IOC IPs are (probably random) Tor exit nodes :) The actual number may very well be higher, I just grabbed current exit node list from https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses
Here's the PHP backdoor the YARA rule is for http://sprunge.us/ReFg http://sprunge.us/ReFg I'll probably put up the rest of the samples in a sec.
Edit: Here, I uploaded most of the samples listed in the csv http://www.filedropper.com/samples_5 http://www.filedropper.com/samples_5
Edit 2: The obfuscation used in the russian PHP shells looked awfully familiar, I think the shell they're using could very well be this one http://profexer.name/pas/download.php http://profexer.name/pas/download.php originally shared on a .ru hacker forum.
- grandalf 10y agoWow, this should be the top comment.
- deleted 10y ago[deleted]
- codedokode 10y ago> The obfuscation used in the russian PHP shells looked awfully familiar I have seen similar obfusaction many times before. Generally most PHP backdoors look like eval($_POST['something']) and here eval is replaced with create_function (by the way I know several other functions that can be used instead of eval). This method of obfuscation (eval + gzip/base64_decode and other functions) is also sometimes used in legitimate scripts.
- ryanlol 10y ago>I have seen similar obfusaction many times before. If you look at it carefully you'll very quickly realize that you haven't. This isn't at all like your typical base64 silliness, and it's certainly very uncommon. This actually uses a cookie to decrypt the encrypted shell before executing it. Pretty obvious, but very few things actually do it.
- rokosbasilisk 10y agohasnt this tech been known for a year now. https://www.fireeye.com/blog/threat-research/2015/12/uncovering_activepower.html https://www.fireeye.com/blog/threat-research/2015/12/uncover... Its been taught in my security class.
- ryanlol 10y agoI'm not sure if I'd describe encrypting and decrypting data as a "tech" :) And it's certainly been known for longer than a year, it's just very rare to see PHP shells doing it like this.
- codedokode 10y agoYou are right, I didn't look carefully, this is not simply eval(POST) backdoor, it has a payload and it is encrypted with an external key that is provided via POST or COOKIE; but I see some weak points and will try to guess the key. Maybe this code is encrypted using some generic obfuscation tool and the file at github matches the rule at report because their payload was encrypted with the same tool? I'll also add some thoughts under @wongarsu's comment.
- Natsu 10y agoFascinating stuff, thank you for sharing.
- nkadri1 10y agoThere is at least one IP that belong to Microsoft .... 65[.]55[.]252[.]43,IPV4ADDR,,IP_WATCHLIST,C2,,TLP:WHITE,This IP address is located in the United States. https://virustotal.com/en/ip-address/65.55.252.43/information/ https://virustotal.com/en/ip-address/65.55.252.43/informatio...