[toc]

# What ?

This is a malware analysis report from this [Excercise](https://docs.google.com/document/d/1SB9yzvTTLzN-Re-sgegL2xsgimOM9g2SvDauj_K-WJo/edit?tab=t.0#heading=h.yijxjuljd1pa) - Class 7 LATERAL MOVEMENT, VIRTUALIZATION, AND THREAT INTELLIGENCE

As described in the following video -

[Class 7 - Dr.S.García: Introduction to Computer Security (B4M36BSY)](https://youtu.be/mguCzX7Ynv0?si=8ahnR9oyViQeOkY7&t=7315)

## Abbreviations used in this note

Abb | Expansion
:---: | :---:
MW | Malware
MWA | Malware Analysis

# HUH ?

The MW which used during the execrcise has been downloaded and a simple analysis on it has been done.

## Setup

1. Downoad the MW

wget --no-check-certificate "https://docs.google.com/uc?export=download&id=1gZo-841lZ83Lb8qYKGpoMZH1VhSL92EB" -O suspiciousfile

:::danger
Pushing the MW to github will lead your account to be flagged or disabled
:::

2. Run analysis inside a docker container

# Findings

## Infection Flow Diagram

sequenceDiagram
    participant Victim
    participant Server

    Victim->>Server: Gather System Info and send
    Server->>Victim: Get data and stream random info
    Victim->>Server: Binary in infinite loop until terminated

## Summary

Description | Details
:---: | :---:
Type | Linux Binary
Encryption | None
Activity | Info Stealer

## Static Analysis

> A variety of open source tools were used for these findings

### Encryption None

- C program
- With No Encryption

### IP found in binary - `139.59.213.4`

# Nmap 7.80 scan initiated Fri Nov  8 17:10:57 2024 as: nmap -script default -oN n.txt 139.59.213.4
Nmap scan report for 139.59.213.4
Host is up (0.14s latency).
Not shown: 995 closed ports
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
465/tcp  filtered smtps
587/tcp  filtered submission
4444/tcp open     krb524

# Nmap done at Fri Nov  8 17:11:10 2024 -- 1 IP address (1 host up) scanned in 13.83 seconds

More detailed nmap vulnerability scan - https://pastebin.com/raw/ZLLVtVAD - The following discussion is based on sections extracted from here.

From the above scan we can see that there is a vulnerable OpenSSH Server

PORT     STATE    SERVICE    VERSION
22/tcp   open     ssh        OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)

- But after several attempts it appears that a connection was no possible

4444/tcp open     krb524?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, LDAPSearchReq, NCP, SSLSessionReq, SSLv23SessionReq, WMSRequest: 
|     netstat -anp
|   GenericLines, NotesRPC: 
|     whoami
|   GetRequest, NULL, SMBProgNeg, TerminalServerCookie: 
|     hostname
|   HTTPOptions, Kerberos, LANDesk-RC, RPCCheck, SIPOptions, TLSSessionReq, ms-sql-s, oracle-tns: 
|     uptime
|   Help, JavaRMI, LDAPBindReq: 
|     cat /proc/meminfo
|   TerminalServer, X11Probe: 
|     uname -a
|   afp, giop: 
|_    ifconfig

- L1 - Indicates its a kreberos authentication server. It is possible to telnet to this server, but there are delayed responses. with random text beinge generated
- L2-L16 - These strings get printed to the console when connected to the server, entering these commands doent seem to do anything.

:::warning
Due to the random text being generated. This ip maybe a honeypot. Since connecting to it is possible, but no further actions could be performed
:::

### Functions


**Important Files Description**

File | Function
:--: | :--:
`_start` | Entry point into the function
`main` | Main Function called on entry
`gather_system_info` | Info Stealing Function
`execute_and_send_command` | Function that steals information and send to the server `139.59.213.4`, which then intiates a stream of information to send back.

:::info
gather_system_info is the information stealing function
:::

// Pseudo Code - Generated from Ghidra

void gather_system_info(char *param_1,size_t param_2)

{
  __uid_t __uid;
  passwd *ppVar1;
  char *param8;
  long in_FS_OFFSET;
  utsname local_198;
  long local_10;

  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  uname(&local_198);
  __uid = getuid();
  ppVar1 = getpwuid(__uid);
  if (ppVar1 == (passwd *)0x0) {
    param8 = "unknown";
  }
  else {
    param8 = ppVar1->pw_name;
  }
  snprintf(param_1,param_2,"OS:%s|Node:%s|Release:%s|Version:%s|Machine:%s|User:%s",
           local_198.sysname,local_198.nodename,local_198.release,local_198.version,
           local_198.machine,param8);
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return;
}

- L24 - the types of information that is being gathered from the system and sent to the server -

Variable | Information
:---: | :---:
`sysname` | Operating System Name
`nodename` | Network node hostname
`release` | OS Release Info
`version` | OS Vesion level
`Machine` | Machine hardware Identifier

#### Python Representation

For testin the equivalent in python would be

import os
import platform
import pwd

def gather_system_info():
    # Gather system information using platform module
    sysname = platform.system()         # Equivalent to `uname.sysname`
    nodename = platform.node()          # Equivalent to `uname.nodename`
    release = platform.release()        # Equivalent to `uname.release`
    version = platform.version()        # Equivalent to `uname.version`
    machine = platform.machine()        # Equivalent to `uname.machine`
    
    # Get the current user ID and username
    user_id = os.getuid()               # Equivalent to `getuid()`
    try:
        username = pwd.getpwuid(user_id).pw_name
    except KeyError:
        username = "unknown"

    # Format the system information string
    system_info = f"OS:{sysname}|Node:{nodename}|Release:{release}|Version:{version}|Machine:{machine}|User:{username}"
    
    return system_info

# Example usage
info = gather_system_info()
print(info)