sec-chick Blog

サイバーセキュリティブログ

【ハニーポット簡易分析】Honeypot簡易分析(383日目:9/18)

ハニーポットの簡易分析となります。特に大きな変化はなしでした。

◾️Honeytrap
※80ポートは除く
＜国別検知数および検知数＞

f:id:one-chick-sec:20190919083610p:plain

＜ポート検知数（前日比）＞
◾️Honeytrap
※80ポートは除く
 
＜国別検知数および検知数＞
 
＜ポート検知数（前日比）＞
ポート番号 サービス 件数 前日比
1433 ms-sql-s 12215 -10757
445 smb 4256 -209
22 ssh 2914 -1145
23 telnet 1378 -213
3306 mysql 340 283
5900 vnc 329 -64
3389 rdp 327 196
2323 telnet 201 11
9022   196 193
8080 proxy 174 53
 
 
＜新規マルウェアダウンロード＞
malware_url VT_link status code hash total positives VT_malware
hxxp://lsd[.]systemten[.]org https://www.virustotal.com/file/b0b835a18624a2b57f7847c3d1d47d367ca1735bb4a9408ca1d7722f4201d034/analysis/1568970635/ 200 b8db8b4a1b28fe78e53d2579549248bbf4af0f6d 56 0  
hxxp://174[.]128[.]226[.]101/mips https://www.virustotal.com/file/c51c776b3aff1533eaf680473d5292cee0fc6d7a8c2821971fc56a781ead56e6/analysis/1568738331/ 200 81542728b7d0ed176f7e9e965880c661ebe72bb0 57 26 MicroWorld-eScan:Gen:Variant.Backdoor.Linux.Tsunami.1,

FireEye:Gen:Variant.Backdoor.Linux.Tsunami.1,

Symantec:Linux.Backdoor.Kaiten,

ESET-NOD32:a variant of Linux/Tsunami.NDJ,

TrendMicro-HouseCall:Backdoor.Linux.BASHLITE.SMJC10,

Avast:ELF:DDoS-Y [Trj],

Kaspersky:HEUR:Backdoor.Linux.Tsunami.cb,

BitDefender:Gen:Variant.Backdoor.Linux.Tsunami.1,

Tencent:Backdoor.Linux.Tsunami.x,

Ad-Aware:Gen:Variant.Backdoor.Linux.Tsunami.1,

Emsisoft:Gen:Variant.Backdoor.Linux.Tsunami.1 (B),

DrWeb:Linux.BackDoor.Tsunami.239,

TrendMicro:Backdoor.Linux.BASHLITE.SMJC10,

Sophos:Linux/Tsunami-A,

Ikarus:Trojan.Linux.Gafgyt,

Fortinet:ELF/Tsunami.NDJ!tr,

Arcabit:Trojan.Backdoor.Linux.Tsunami.1,

AhnLab-V3:Linux/Tsunami.Gen3,

ZoneAlarm:HEUR:Backdoor.Linux.Tsunami.cb,

Avast-Mobile:ELF:Tsunami-EQ [Trj],

ALYac:Gen:Variant.Backdoor.Linux.Tsunami.1,

MAX:malware (ai score=94),

Rising:Backdoor.Tsunami!1.A1B2 (CLASSIC),

GData:Gen:Variant.Backdoor.Linux.Tsunami.1,

AVG:ELF:DDoS-Y [Trj],

Qihoo-360:virus.elf.tsunami.gen
hxxp://35[.]195[.]111[.]236/zehir/z3hir[.]mips https://www.virustotal.com/file/40ecaec792a18e4c85630ff7bd1b1312b0cde47edd816593910bde478045eada/analysis/1568882712/ 200 6c846e2fe0ecb6ccf1598480fd2d1e9bf00d80ba 58 25 Symantec:Linux.Mirai,

ESET-NOD32:Linux/Mirai.AHI,

Avast:Other:Malware-gen [Trj],

ClamAV:Unix.Dropper.Mirai-7135899-0,

Kaspersky:HEUR:Backdoor.Linux.Mirai.b,

NANO-Antivirus:Trojan.Mirai.fzjwmw,

AegisLab:Trojan.Linux.Mirai.K!c,

Tencent:Backdoor.Linux.Mirai.wao,

F-Secure:Malware.LINUX/Mirai.xdjvu,

DrWeb:Linux.Mirai.671,

TrendMicro:Trojan.Linux.ZYX.USELVIE19,

McAfee-GW-Edition:GenericRXIA-VD!BA139CAE680F,

Sophos:Linux/DDoS-CI,

Cyren:ELF/Trojan.KAGD-22,

Jiangmin:Backdoor.Linux.byly,

Avira:LINUX/Mirai.xdjvu,

Fortinet:ELF/DDoS.CIA!tr,

ZoneAlarm:HEUR:Backdoor.Linux.Mirai.b,

Microsoft:Trojan:Win32/Ditertag.A,

AhnLab-V3:Linux/Mirai.Gen10,

McAfee:GenericRXIA-VD!BA139CAE680F,

Ikarus:Trojan.Linux.Mirai,

GData:Linux.Trojan.Agent.KOBW43,

AVG:Other:Malware-gen [Trj],

Qihoo-360:Win32/Backdoor.6f4
hxxp://188[.]209[.]52[.]11/curl[.]sh https://www.virustotal.com/file/aa607b23d9af9c826134867193f43a4d90754718af217fb0279af267907e9bae/analysis/1569027701/ 200 65a3fb231475dc4bd489f5304a721a37336dea3d 55 2 Kaspersky:Trojan-Downloader.Shell.Agent.bi,

ZoneAlarm:Trojan-Downloader.Shell.Agent.bi
hxxp://pm[.]cpuminerpool[.]com/pm[.]sh https://www.virustotal.com/file/81de9fc33ab05928f9abca627435b3fa40a3470e01dc435dddae0e7bec640274/analysis/1568621852/ 200 cd3af8bc58dc26936a02e1598992dffe586b3475 55 0  
hxxp://185[.]181[.]10[.]234/E5DB0E07C3D7BE80V520/init[.]sh https://www.virustotal.com/file/c523bb5d3985c966fe761f89315f5fa240b328e51700ec91b60f1f0a1bef3594/analysis/1568201583/ 200 773ab67d9863878552a504d4144ebaf6dfc49f56 56 22 McAfee:Linux/CoinMiner.x,

Symantec:Trojan.Gen.NPE,

TrendMicro-HouseCall:Possible_MINERDLOD.SMLBOB,

Avast:BV:Miner-BR [Drp],

ClamAV:Txt.Coinminer.Downloader-6811173-0,

GData:Script.Trojan.Agent.7JIURA,

Kaspersky:HEUR:Trojan-Downloader.Shell.Miner.gen,

AegisLab:Trojan.Shell.Miner.4!c,

Tencent:Heur:Trojan.Linux.Downloader.i,

DrWeb:Linux.BtcMine.222,

TrendMicro:Trojan.Linux.PUAMSON.USNELEO19,

McAfee-GW-Edition:Linux/CoinMiner.x,

Cyren:Trojan.DGIS-4,

Jiangmin:Trojan.GenericKD.bju,

Antiy-AVL:Trojan[Downloader]/Shell.Miner,

ZoneAlarm:HEUR:Trojan-Downloader.Shell.Miner.gen,

Microsoft:Trojan:Win32/Mamson.A!ml,

AhnLab-V3:Shell/Agent,

Ikarus:Trojan.Script.Agent,

MaxSecure:Trojan.Malware.74320078.susgen,

AVG:BV:Miner-BR [Drp],

Qihoo-360:Win32/Trojan.Downloader.7dd
hxxp://103[.]83[.]157[.]41 https://www.virustotal.com/url/493ca61c8f8d6ef7b58604e577661cfa6f2ea6b6738a30f4d78683f1f373dda5/analysis/1562037370/ Unknown        
hxxp://188[.]241[.]73[.]110 https://www.virustotal.com/file/d01984d5f581bbb2100fe65e5c677563a9150fe22edbdf875601d86c63862f3d/analysis/1568618881/ 200 042f495f7f6adefc7b376f9d00f9e64f04cadcee 50 0  
hxxp://142[.]11[.]199[.]235/mips https://www.virustotal.com/file/af18cd19287cdf764418b4212cbcd64e5bba8e8632a3990026f6f5c0b54f3fce/analysis/1567916002/ 200 8bc0fcd0b5f456938cf6db535316146359ea02a8 56 19 ESET-NOD32:a variant of Linux/Mirai.AEL,

TrendMicro-HouseCall:Backdoor.Linux.MIRAI.SMMR1,

Avast:ELF:Hajime-R [Trj],

ClamAV:Unix.Trojan.Gafgyt-6748839-0,

Kaspersky:HEUR:Backdoor.Linux.Mirai.ad,

Rising:Backdoor.Mirai/Linux!1.BAF6 (CLASSIC),

DrWeb:Linux.Mirai.1443,

TrendMicro:Backdoor.Linux.MIRAI.SMMR1,

McAfee-GW-Edition:Linux/Mirai-FDXO!249E607F736C,

Sophos:Mal/Generic-S,

Fortinet:ELF/Mirai.AE!tr,

Microsoft:DDoS:Linux/Gafgyt.YA!MTB,

ZoneAlarm:HEUR:Backdoor.Linux.Mirai.ad,

Avast-Mobile:ELF:Mirai-UM [Trj],

AhnLab-V3:Linux/Exploit.Gen2,

McAfee:Linux/Mirai-FDXO!249E607F736C,

Tencent:Backdoor.Linux.Mirai.wao,

GData:Linux.Trojan.Mirai.E,

AVG:ELF:Hajime-R [Trj]
hxxp://50[.]3[.]82[.]135/mips https://www.virustotal.com/url/67fda5ce9e43f72de70279bf5b7a281867753667281c78444e8e388944800a57/analysis/1568815584/ Unknown        
hxxp://195[.]231[.]6[.]216/htp/ab[.]arm4 https://www.virustotal.com/url/85a648a5e6401d1c0fcddfbd3e26816b08b2231b5d0327f3380be63c80701df9/analysis/1569028142/ Unknown        
hxxp://31[.]13[.]195[.]109/jaws[.]sh https://www.virustotal.com/url/bdd12fe0171ecb51d25443c0c09f183b134a8271022b7e9651866e9742eca0c6/analysis/1568526339/ 404        
hxxp://31[.]13[.]195[.]49/x https://www.virustotal.com/url/65071584ab70a5353da1eeec090311e3fb8c2c1de103387b2c94cb29d32ac4b3/analysis/1568512414/ Unknown        
             
 

◾️WoWHoneypot
＜国別検知数および検知数＞

f:id:one-chick-sec:20190919084055p:plain



＜マルウェアダウンロード＞
 
◾️WoWHoneypot
＜国別検知数および検知数＞

f:id:one-chick-sec:20190919084723p:plain


＜検知パス一覧＞
特に新たな脆弱性を狙った通信は検知していませんでした。

wow_path target CVE reference count
/ - - - 25
/wp-login.php WordPress - - 16
/admin/assets/js/views/login.js FreePBX - https://git.freepbx.org/projects/FREEPBX/repos/framework/browse/amp_conf/htdocs/admin/assets/js/views/login.js?at=bfb36fa7ac70c2e642257dbcd99a1799e19ea743 8
/xmlrpc.php WordPress - - 8
/TP/public/index.php ThinkPHP - - 3
/shell Webshell - - 2
/160.16.145.183/ - - - 1
/admin/ajax.php
WordPress
 - https://nelog.jp/attacked-php-files 1
/cpanel phpMyAdmin - - 1
/index.php - - - 1
/manager/html Tomcat - - 1
/phpmyadmin/index.php phpMyAdmin - - 1
/robots.txt - - - 1
 
＜マルウェアダウンロード＞
なし

以上となります。