From website-locker to ddos_ rex ! _ this is security __ by stormshield websites that use bitcoin

From website-locker to ddos_ rex ! _ this is security __ by stormshield websites that use bitcoin In May 2016, Softpedia wrote an article about a Drupal web ransomware. Bitcoin price speculation This malware exploits an SQL Injection on CMS Drupal, changes admin credentials and asks for bitcoins to unlock content. After locking the website, a malware is executed on the server: After this ends, the last uploaded file is a binary file written in the Go programming language, which is the actual ransomware.

Bitcoin usd graph This Go binary deletes the file upload form and replaces it with the ransom note seen above. 3 months after this article, there was no available sample of this malware on public repositories.


Bitcoin register So, it’s time to try to find one. Bitcoin homepage We only know that the malware is developed in Go and exploits Drupal vulnerabilities. Bitcoin price right now Thanks to @DlBlind, we also know that it uses P2P to communicate.

Please note that this article is not a reverse of the malware but tries to explain the attack vector and some interesting key features. Learn bitcoin Sample Hunting Googling « Website is locked.

Bitcoin share price Please transfer 1.4 BitCoin to address », we can found a lot of hacked Drupal. Price of bitcoin usd After a quick look, we retrieved an unknown sample executed as: ./G2eCM9jUiz -elevate.

skip -wait 20619 2>/tmp/l *rpc.Service.SetBinary &{Platform:linux-386 Binary:0x1901ae40} The above snippet shows that the sample uses P2P communication. A quick analysis of the sample shows that it is developed in GO and compressed with UPX. Bitcoin sign in As shown below, it is not known by any anti-virus on VT: We found our sample and it’s an interesting one. Value of the bitcoin Actually, Drupal-locking is a very small part of the available feature of the self-called “Rex” malware which is still in evolution.

Newsweek bitcoin We found many different variants from April to August 2016. Rex is made of 5 different parts.

Price of bitcoin in usd Some of them seem to be still in development: Hereafter, we will look into details for each of this part. Bitcoin value in 2015 Attack vector Depending of the variant, Rex malware scan Internet for different vulnerable services.

Who created the bitcoin The kill chain is simple: Hereafter, a non exhaustive list of exploits used by different variants of Rex malware. Bitcoin 1 year chart Drupal It’s not something new, Rex can exploit an SQL injection on Drupal 7 via CVE-2014-3704. Bitcoin price chart live The malware adds a new admin account, locks all blogposts with website-locker notes, uploads and executes Rex. Bitcoin exchange australia WordPress Rex is able to infect other CMS. Bitcoin cost WordPress plugins are mainly targeted. What is the price of bitcoin today At least 8 exploits are available: • Plugin Revslider RCE – https://www.exploit-db.com/exploits/35385/ • Plugin Woocommerce RCE – https://cxsecurity.

com/issue/WLB-2016040066 • Plugin Robo Gallery RCE – http://www.vulnerability-lab.com/get_content.php?id=1822 • Plugin WP-squirrel RCE – https://packetstormsecurity.com/files/134688/wpsquirrel-rfi.txt • Plugin Gwolle Guestbook RCE – https://www.htbridge.

com/advisory/HTB23275 • Plugin Site Import 1.0.1 LFI – https://www.exploit-db.com/exploits/39558/ • Plugin Brandfolder 3.0 LFI/RFI – https://www.exploit-db.com/exploits/39591/ • Plugin Issuu Panel 1.6 RFI & LFI – https://packetstormsecurity.com/files/136398/wpissuupanel-rfilfi.txt We have found some infected WordPress websites but we didn’t see any of them locked. Bitcoin value graph Magento The botnet scans for Magento eCommerce too. Whats bitcoin It looks for ShopLift RCE – https://www.exploit-db.com/exploits/37977/.

Bitcoin exchange sites The attack is similar to the Drupal attack. Bitcoin price 2013 A new admin account is created and a Webshell is used for executing Rex. Bitcoin value evolution Misc • Apache Jetspeed – CVE-2016-0710 http://haxx.

ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and • Exagrid – CVE-2016-1560 – https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/exagrid_known_privkey.rb • AirOS RCE – https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/ubiquiti_airos_file_upload.

rb The above list confirms that Rex does not focus on website locking but tries to build a P2P botnet. What is 1 bitcoin worth Bitcoin mining As lots of malware, Rex has bitcoin mining capabilities.

Bitcoin prize We won’t dig into details for this. Bitcoin exchange wallet C&C communication We haven’t looked deeper in the network part but thanks to @ silascutler @ DlBlind, we know that this botnet use Kademlia P2P network (“/home/user/src/rex/dht/” https://github.

com/nictuku/dht ) on port 5099 with TLS enabled. It seems that all aforementioned weapons are available through the P2P network.

Bitcoin login Ransom – Armada Collective The most curious feature of the malware is called RansomScanner. All about bitcoin It is used to retrieve admin contacts of the infected website, and send a DDoS threat email. Rate of bitcoin Below, the email template: FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY AND CAN MAKE DECISION!

All your servers will be DDoS-ed starting {{ .Time.

Weekday.String }} ({{ .

Time.Format “Jan 2 2006” }}) if you don’t pay {{ .Amount }} Bitcoins @ {{ .Address }} When we say all, we mean all – users will not be able to access sites host with you at all. If you don’t pay by {{ .Time.Weekday.

String }}, attack will start, price to stop will increase by {{ .Step }} BTC for every day of attack. If you report this to media and try to get some free publicity by using our name, instead of paying, attack will start permanently and will last for a long time.

Our attacks are extremely powerful – sometimes over 1 Tbps per second. Bitcoin companies So, no cheap protection will help.

Do not reply, we will probably not read. Bitcoin chart api Pay and we will know its you. Bitcoin value history graph AND YOU WILL NEVER AGAIN HEAR FROM US! It’s a well-known template used by the crooks of Armada Collective. What is bitcoin used for Lot of people have received this kind of email. Bitcoin price today Cloudflare wrote a blogpost about this ransom note.

There is a supposed gang that sends extortion email to online businesses but nobody has seen any real DDoS. Bitcoin price stability Unfortunately, this kind of scam seems works.

In spite of the lack of actual DDoS follow through, it appears that many victims are paying the extortion fee. Bitcoin spot A security analyst from the Bitcoin analysis firm Chainalysis studied payments sent to the Armada Collective’s Bitcoin addresses and concluded that more than USD$100,000 has been sent to the attackers by victims. Armada Collective emails look like hoax, BUT, we have seen infected servers that actually run real DDoS attacks! Armada collective seems to start a new strategy and try to launch real attacks.

Bitcoin value uk The “1Tbps” threat seems ridiculous but If the botnet grows leveraging on fresh vulnerabilities, it may become more harmful. In the recent versions of Rex, the ransom note has been updated: FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY AND CAN MAKE DECISION! All your servers will be DDoS-ed starting {{ .Time.

Weekday.String }} ({{ .

Time.Format “Jan 2 2006” }}) if you don’t pay {{ .Amount }} Bitcoins @ {{ .

Address }} When we say all, we mean all – users will not be able to access sites host with you at all. Right now we will start 15 minutes attack on your site’s IP {{ .IP }}. Bitcoin value calculator It will not be hard, we will not crash it at the moment to try to minimize eventual damage, which we want to avoid at this moment. Bitcoin price 2016 It’s just to prove that this is not a hoax. 1 bitcoin cost Check your logs! If you don’t pay by {{ .Time.

Weekday.String }}, attack will start, price to stop will increase by {{ .Step }} BTC for every day of attack.

If you report this to media and try to get some free publicity by using our name, instead of paying, attack will start permanently and will last for a long time. Our attacks are extremely powerful – sometimes over 1 Tbps per second. Bitcoin rate history So, no cheap protection will help.

Do not reply, we will probably not read. How much is bitcoin today Pay and we will know its you. Bitcoin historical prices AND YOU WILL NEVER AGAIN HEAR FROM US! Now, crooks talk about a 15 minutes testing DDoS. Bitcoin price They ask checking logs as a proof. Bitcoin exchange us dollar They want to be taken seriously.

Rex looks like a kind of strange webserver-ransomware that didn’t encrypt files but lock access to administration page and threat to DDoS. Bitcoin payment address Conclusion Linux botnets continue to evolve and become very interesting.

Whats a bitcoin In this case, what looks like at first sight a Drupal locker is in fact a complete botnet, still in development, with many features. In the nexts write-ups we will try to explain each module of this botnet. As usual the attack vector is not 0day but well known vulnerabilities, so I’ll conclude this article like other: If you are a website administrator, DO NOT LEAVE OUT OF DATE SERVICE ON THE INTERNET.

9070f56651f44ec722e17df67b8a954888e387a8f2574594c80937d0f39c471a .0LD5dVbuo9 bf211d46551079e7f7646ffd6bfda065f1307ea81508d1625b5c65005d929cb3 .0OHjeERDbv 550b9b4c5b2dbe83fa3e227cca65b9b9768e2ea597c2e109205dba51faee5869 .0OhoU6US1m 677464da2fcf73b9793daca3191501da02957af08a6471a047410ce99ea49405 .0r4mKMUlJ6 69402f4bd7718a3403f1caaaa387edc70b299f6aecc06de39e3a9ac28873a184 .0rqNlrPujv 32c921dd4b755af519f648102098735a569a0326a79a911eb47174bd058e5c43 .0YOtp0GQMk 52bf6ae8fe7a0a59ca8d089444207c173e20a7a11c8b5e815b937e2f4224da4f .1ZRhWKqTlY 950cd068d9c51b941bdfe4721a3156af15dc408d2df23c1f2bc41b87159b109e .3v0UwARWmv 1f4d876b17a6d786aa793b9c529235f9f9e164d70a74d8d26ca850d18f1329a7 .3weUyhjJZe 09f1967e97a97a1d0963a84823fa2611b9555866f09d7a04bb69bc4d877f9631 .42wVPcdaFD 3e4cebd60a1d6a6b29bac68ace2547c2e3894a0e5865dd90aff5764f8e7dc16d .4JkeqTzZSX dcd0e1586630bc8c50fe600899bee76b853057fd9158ed541d7ddec53c8f2186 .5Ygi9nGrHn cb42573e36fb148bc1109229a1025cdcb375c166361605f0681da9e54e3ef81d .5ZFxAbOeBY 08ab4abd017568142d061ffd5a2592a491730dddb4485211fda53f39d43e3efb .7RCBTpSOUh ac36c87cacbe1b8327fae3084ebd1740a3a5c6c6f208c1c77da56932a9ca3be6 .7tsPagH3FM d67ae5639618a3409711377e124ef2c6293200aa3026b8b2996654db63645481 .9bKas738kc a1610e735042ce0197859e6fd7772039e63efce78d6c9cf642492d1c8f1d7540 .9G97ZhwNer 07dd2c7be7a0becb178967c43684c1a687deb217e87575d18fd6b73dc988bd78 .9MgvdLBtL0 dbc3f96fcbbfd90f877dc11fcdedca1c1e574b951ac70edc3160ed9f389c3fd3 .aH7HRrz554 8e7eaed42f50c865f72f7351b87a988de5aa94781b4dab4ddbe993872435f293 .bM04ITZnuq 97c1ed3d52d663f9bad2eef716169f06053dc2bcf8e3d857b0a702e8fae546c9 .C91EZKVz6Q a1000d4cb81cfb7dfac660722938f3d9c7cb6e36c33e129097ddd29f3dfd1890 .

cOVyPvf01L 9f568df46838872b389628b665940415d897823b2e1804e2625c3dfb0b6850b4 .D90yb8KdDV cc01ba0825208402b0fc2eb62146e856f69d1e9f53b745d8f068f0d09e6170c0 .E61NBnYjak 40c882738ea1e01cc4e8027dd6ce5d55552e5630c8f65e86db630fca09d85fa9 .

EETl2pJOf9 0e6c53797964b611c867cb5e5b492d45edf5472924c9a60a99433240f1712f15 .eLBaxwiu2d c79d7b2a8caf5cc19a019772053c54d1ec02f8ae15b577bbbbd9bf82f19caedb .fkmJQOIqYB d097f55f82e88a32b057010c96f553aa7c8ccef12c2a8484aab0fb3dab9d4a0f .H4g8bASf8Y c058d576a108bdcf637a6ed399b4d9a1e3bbb6f194882ffada01b85e79109f65 .

HdUykUNGy8 339eaabda43fbf0ee0caa6021a999d383713498911523d2b21e2ee2f1541f78f .Ju7XqX36yy 3dee377037f7fcfd6539c23bb1cdc6eda46680c8773525b784150c1237788965 .KDnA4yWrGc 9d41dc182dee0690e5c5f08f9276548a85f4b986478fd30ec4208d95d54cffeb .KzmJO5vHRQ b30dfa13f8dc7162f3edb43dff8507f82c01bd5bd6e5a1ae2e3b2e55dd6b10c0 .

LqZzmAJcjo f7bc5d56312ae6205b21aa4c72708383716907754b037013f47bc88203fbb450 .Oer60jCsoB 9909910d6e008e15c98d26e214f619a7a82787137158784998d99b5c03cbe8f2 .

OiZhEG9cEu 2549560970bb8ebca0136f7d6c8111196295d083c6fd6101a7f9178089502cc0 .q7hsioOPWv fe2c837d1662ca47ebd86c0cf0a3a382ee589bce6b77dabae30801d71a7d280f .rG47yPBz5p 67a3b5d1fb946daccd7f3562e35b90537f9032184a0605cc9b8613c91a4ea1be .

RnKtruJM9f 22a578f2d30f316d441b73efbeaa0b53641686d2fa75ad44d4d3992da9ceaf5f .SzIYofKRTz 0723de24bc86eedde149c53e0f93a18596bed424e823f1b46c2f97e358931b83 .

YPuels1RDm 6b46b6eff4be06d47284492fed7f71c53103bfaa610952151bddebb8046a34f1 .yYRSdRs6kH 9bd1d3a567e2036f8e57745dd81333911b06a34f4ed6d7d68daa674aac0d7b96 .Zw64nQ52IX Site: https://thisissecurity.net/2016/08/17/from-website-locker-to-ddos-rex/