Time to have a look into these executables from an assembly language perspective,Īnd see if we can determine exactly what these binaries do. The compiler is a bit more older, and doesn’t seem to be an Ubuntu Of them, but are mostly going to be library functions that have been statically This malware has something to hide, thats for sure. Very new as well, with the first submission only being 4 days ago: 08:40:27. Interesting again, only 6 / 61 virus engines detect this as malware. Init7: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped These files are interesting, as all the following samples that were collected: It seems the attacker compiled on Ubuntu 16.04, using the gcc-5 packageĪt the latest version. Which have been linked into the base executable. We have 6416 functions, which is large,Īlthough this is statically linked, so we need to include the various libraries The engines seem to class this as some sort of cryptocurrency miner, so we will Submitted on 23:23:39, meaning that this executable has been compiled Scanning engines detect the binary as a virus, and interestingly, it was first It seems we have a match, and only very recently too. Statically linked executable built for 64 bit Output to evade detection, and are placed throughout the disk to gain redundantĪt this point, I asked for samples to be collected for the following files: These executables are obviously wanting to hide their

The cronjobs are particularly alarming, since there are multiple executables,Īll located in world writable places, such as /tmp, /var/lock, /var/tmpĪnd /dev/shm, and all use the same discard to /dev/null string: Poorly written, or that it was trying to link to a system library it was notĬompiled for, or if it was statically linked, something went wrong in the Itself segfaulting in libnss_files-2.27.so means that dovecat was either Here’s whatįirstly, looking at ps aux, we can see that dovecat is indeed running fromĬRON: (daemon) CMD (/var/lock/bash7 > /dev/null 2>&1 &^M)ĬRON: (CRON) info (No MTA installed, discarding output)ĬRON: (daemon) CMD (/var/tmp/sh7 > /dev/null 2>&1 &^M)ĬRON: (daemon) CMD (/tmp/bash7 > /dev/null 2>&1 &^M)ĬRON: (root) CMD (command -v debian-sa1 > /dev/null & debian-sa1 1 1)ĬRON: (daemon) CMD (/dev/shm/bash7 > /dev/null 2>&1 &^M)ĬRON: (daemon) CMD (/tmp/init7 > /dev/null 2>&1 &^M)ĭovecat was indeed running directly from /tmp as /tmp/dovecat. It looks like it hasn’t been patched in 1 - 2 years. The system itself is Ubuntu 18.04, but it is massively We needed more information, so we asked for a sosreport. Malware only use /tmp since any user has the ability to Malware? No legitimate programs place files in /tmp for anything other than Is the dovecatĮxecutable itself in /tmp? Are the files in /tmp configuration, or more Now, the description alone raises a bunch of red flags. It all looked rather suspicious, and a case was filed. Mentions that a process called dovecat was using a large amount of CPU timeĪnd most of the system’s memory, and was causing the machine to run slowly.ĭovecat did not seem to match any service the system was running, and thereĪre files in the /tmp directory owned by the service which is running theĭovecat process. This case caught my eye as soon as I saw it in the queue. Real life stuff pulled directly from a production machine, so it still has its I’m pretty excited, as I haven’t analysed any Linux malware before, and this is Turned out to be a cryptominer, and hy4, which is a IRC botnet malware In this post, we are going to look into the malware called dovecat, which That the system was compromised, and was now running some interesting malware. Processes using high amounts of CPU and memory, and running from the /tmpĪfter asking for some logs, and some samples of the binaries, it became obvious A few days ago, a case came in which had some rather odd symptoms, such as

Minetest blocks download