Mozi Malware - Finding Breadcrumbs...

Hello everybody and welcome back. Welcome back to another Jon Hammond YouTube video on the Jon Hammond channel. I'm your host, Jon Hammond. That makes sense, that math checks out. So here we go. Hopefully we're gonna have some fun today. Hopefully, fingers crossed. I'm super excited about this one. I started to kind of pull the thread and I thought it seemed kind of fun and kind of interesting and kind of cool. So I wanted to showcase it. I don't know how far we're gonna go with it, but today's video is coming to you hot off the press by a wonderful anonymous donator that was sending me a message. He said, hey Jon, hey, what's going on? I don't know a whole lot about reverse engineering. Look, me either. I've been following your videos though. You're pretty entertaining to watch. Thank you. I super appreciate that. Thanks so much. Anyway, I got a juicy request to my HTTP server with the juicy ELF payload and I thought I would send it along to you. Hey, my bad if this isn't appropriate. Look, bro, people, everybody, I can't say this enough. Like I am loving this. I think this is hilarious and awesome. By the way, keep growing the content farm, please. I'm gonna have it like on my tombstone. It's gonna be my yearbook quote. I'm gonna have to just say my mantra like please send me malware. Please send me malware. We're gonna have some fun, ladies and gentlemen. So take a look at this request. I think this is kind of neat. This is supposedly maybe a spooky wookie attacker IP address so we could totally go look that up. Today, today, hey, I got a get request to a setup.cgi. I'm assuming a CGI file extension. Maybe, maybe the attacker or whatever bad guy might be thinking like, oh, is there shell shock? Is there any availability for me to run commands? I don't have obviously no purview as to what is running on this fellow server. Thank you, anonymous donator, for anything that you're willing to offer here. But it includes these arguments, these HTTP arguments that say, hey, let's get a file netgear.cfg, netgear config. And to do is a syscmd, probably a system command, right? And the command is rm tech rf temp. Everything in the temporary directory is going to be removed and deleted. And then we will wget down this IP address, 211.36.174.137. Okay, and that is the same IP address here. So that must be our bad guy. On that port, 4379.mozy.m, mozy, mozy? I don't know if I'm pronouncing that right. Tech capital O flag, right, to save that output into a file with wget. And it throws it into temp, netgear, and then we try and run netgear with sh. And we have the current path being root and current settings.htm equals one. It looks like this returns a 301 response code, which I think is HTTP response codes. Pretty sure that's a redirect, right? Let's just take a quick look. Yeah, 301, move permanently. This and all future requests should be directed to the given URI, which I think is just included in it. So it must have been a redirect, but that straight up tells you like, hey, let's, I don't know if that command would have succeeded but we still got some pretty interesting artifacts and kind of telltales to explore and take a look at. So the interesting thing here now that I want to know about is, is that file still live? Is that, does that exist? Is that a thing? So let's grab this and I'll hop over to my little Linux virtual machine here. There we go. I got my XFCE rolling back up in here. So I'll zoom in and I got a directory malware that I like to keep all my personal documents in. So let's make a directory for mozi, mozi.m. You guys are gonna yell at me in the comments about how I pronounce that, but that's okay. You yell at me for everything, the way that I pronounce everything. Let's try and wget this down, shall we? Let's wget that guy. It's cruising, we got it. All right, so the generous anonymous emailer told me that that was an L file. So we're gonna get to do some Linux stuff today but let's take a look at really what this is. It is an L file, right? As they say, 32 bit MIPS. I thought it was kind of interesting. So the MIPS architecture. Now I am not educated whatsoever, but some of you folks that may have sat through a computer science degree, you're probably a little bit more familiar with MIPS than I am. So, hey, I'm putting this video out there so I can learn it just as much as you can, maybe, if you do. But knowing what that thing is, now let's just kind of experiment with it and explore it. I'm not positive though, is like, is this already going to set off the alarm bells and whistles like, yo, this is a virus. This is malware. So let's just toss the thing the way that it stands right now into like VirusTotal. So let me get there to virustotal.com and we can upload a file that I have this malware and it lights up like a Christmas tree. That's pretty slick. Obviously horrendous and bad, but also kind of slick. Linux Trojan. Oh, a lot of community posts. 21 minutes ago. Dude, this is like hot off the press, guys. Taking it right out of the oven. Yep. More shady IP addresses. Oh, we should look at that IP. We should, we should do it. I'm going to have to like blur it out when it shows my IP address again. IP locator. I'm pretty sure I used this one, did I? No, no, don't show my IP address, you crazy fools. All right, IP lookup. I pasted it in. Ooh, that IP address is country Korea and city is Seoul. Take that for what you will, ladies and gentlemen. Let's close out of that tab before I accidentally leak my IP address repeatedly as I produce public videos on malware analysis and just general malware things. I don't know if I'd go so far to say malware analysis because I don't know what I'm doing. So we've got this file here, right? It's a MIPS compiled binary, 32 bit. Let's just kind of, you know, do the only thing that we know how to do. Run strings. So I'll pass that in. And I immediately see some oddballs of UPX. Let's pipe that to less and see if there's any goodness in there. Yep, immediate header with UPX. Scrolling down, down. Baby, you're going down swinging. I don't know how that song goes. It's Sugar We're Going Down Swinging by Green Day. The greatest crossover between Green Day and Beyonce. Lot of nonsense in here, ladies and gentlemen. And nothing actually interesting so far. However, we did see UPX. So I'm waiting for that like UPX telltale that like, hey, this is packed with UPX. Just letting you know. I love that it's just so generous and tells us like, hey, okay. Seriously, where is the good stuff? Where? All right, I promise we'll get to something soon. If not, I'll skip ahead. Whoa. I saw like a lot of quotes in there. This is kind of what I do though. I'll just pipe the strings output to less and then just scroll through all of it no matter how awful and bad it is. Because you might find some good stuff in there at some point. You could obviously like trim this output down. If you were to use like a strings tack N, you can specify like the number of characters that strings will return to you or like the minimum number of characters. So if you were to say strings tack N eight, then you could only get things that are eight characters in length or longer. And that is typically good. And you can kind of CDN CGI HTTP with the little user agent header. Socket RAR, which means a var directory. I'm assuming that's half of the word config. Some of these things might be kind of broken because of the way that it's packed. Yeah. All right, so I see a by UW. It looks like, this looks like seemingly a schema like a colon slash slash. It's like an HTTP schema maybe. Is it trying to go to a website? Are there any dot coms around? We could like use a forward slash while we're searching through less or something if we really wanted to. But good old letters. The old alphabet. My attention span is falling down. So I would assume that yours is too. So let's scoot on ahead here. I see a new, I see a search. Oh, that's gotta be like a post. That OST must have been a post. GPON form diag, and a host. Looks like it's going to be the start of local host. One, two, seven, zero, zero, one. Connection keep alive. Hello, name, more HTTP schemas. This is something that XML. This is packed. So honestly, we should just probably unpack it. Hawaii, whoa. What did I just see? Okay, okay. We'll take that for what it's worth. Dot com, et cetera, et cetera, et cetera. Oh, there we go, there we go, there we go. The smoking gun. Prot exec and prot write failed. So are there like messages to like explain how it's going to end up allocating memory? If it does. Some proc self exe, some proc self in there. So it might be doing some interesting stuff. But okay, if you weren't aware, by the way, before I just immediately steamroll right over that, the slash proc file system, that portion of the file system in Linux, if you go into self, you can get some kind of neat and interesting, peculiar, as you guys know is my favorite word, you can see some really interesting stuff on like the current running process. So if you have local file inclusion, if you're doing some like red teamy pen test CTF bug bounty stuff, you can kind of get an idea of like what is the command line that was used to invoke this process? What does that look like? You can get like look into memory sometimes, you can look into the exe or the current directory, et cetera, et cetera. But this file is packed with the UPX executable packer that you can go find online. So we should go do that. I do already have UPX already downloaded and installed. But if you don't, I'll just kind of cruise through how you can get it, Google it, and then go to the website, get the source on GitHub, and then you can like download any of the releases if you want. I think the webpage actually, yeah, there's a button to download the latest release, which is what you want to do. So grab whatever operating system architecture thing that you're working on. That was a AMD 64 on Linux. So in my op directory, I have a good old UPX program in the UPX folder. So I could, let's actually make a copy of it because I don't want to clobber the original. So let's copy mozi to spooky.elf because I think that's appropriately named. UPX, UPX. Tack D to unpack or like decompress, right? Spooky.elf. I'm gonna zoom out real quick because I realized that output is kind of getting clobbered. Can't unpack exception. P info is corrupted. So it tried to unpack it, but it errored. I have never seen that happen. Why? Why did you do that? Why did you fail? Is this, is that because it's like MIPS or something? What is that error? Google that. You can see that my links are purple here because I have recently visited these pages. So this is what I said. I kind of like pulled the thread on here. I kind of like just wanted to see, hey, is this gonna have some really good runway? Turns out it does. So you can see that I've gotten this far. But let me explore through some of these articles because actually this is where I cut myself off. I saw this and I was like, oh, we have something here, boys. An elf file was recovered from the following GPON router authentication bypass and command injection attempt. So we saw that GPON reference in the strings and take a look at this. The wget is kind of the exact same structure in a weird way. I mean, I guess, whatever. You could really say that, oh yeah, they're just running a wget command. The syntax for that's not really gonna vary. It's a wget httpx, the URL on a port to download a mozi.m. But it was the exact same file name, exact same location. Outputted to another temporary directory and invoked with sh. The same thing ours was. Neat. That upact elf file has 36 out of 58 detections on virus total. And what did ours have? Like 40 out of a gajillion? No, 40 out of 62. Everyone's like, that's bad. Hey, if you don't know, that's a bad one. Some cool details though, like shot hashing, et cetera. Anyway, let's get back to the good stuff. They decided that they would do the exact same thing that I did. And I haven't fully read through this. I just kind of saw like, oh, that's enough breadcrumbs for me to realize we're looking at the same thing here. Threat analysis TSR Vinny. Kudos to you and thank you. I don't see a date on this article yet. But I think you might help me here because when you try to unpack this executable, this elf file with upx, you get the same error, P info corrupted. Turns out, and this is me learning, right? I haven't done this yet, but I want to see if I can unpack it the same way that they do. P info is a 12 byte section in the upx pack program header. Below it can be observed filled with zeros. So that's going to be at hex offset 80 to about the last four bytes at the end there. So let's see if ours has the exact same setup. I will hex edit, excuse me. I don't think I even have hex edit installed here. This is the virtual machine on my new rig. So I'm a little, I'm kind of a fish out of water right now. But we're still making content. We're still hanging out on the YouTubes. Okay, so they didn't exactly order the hex edit. Decided not to give me the flat nice ranges here that I would have liked. Maybe I need to zoom in or out a little bit more. No, it's just going to do whatever. Let's just get to hex 80. You can see it kind of down on the bottom there. Let's go to hex 80. Also filled with zeros, 12 sections. Aha! Okay, so we know what we're up against. Let's get back to that article here. P info is the size of the unpacked file. P info and P file size contain the same value. P file size is found at the end of the file shown in blue. Hex, is that a location? No, no, no, that is the, those are the bytes that I find. Okay, so five through 12 in P info, the last eight need to be the exact same value that we would find in the P file size at the bottom, right? That's the way I'm understanding this so far. So if I go down to the very, very bottom of the file, look for that hex 50, kind of denoting that end there. And then let's see the four bytes before it. They use a, and then it's going to be an endianness, so. All right, let's go to the very end of the program. How do I get, can I get to the end here? Yeah, new position, the very end, thanks. Oh, come on, seriously? Let's just, can I just go? Nine, nine, nine, nine, nine, nine. Come on. My alt end, my alt is not working. We're almost at the end. We'll just, whatever. We're at the end. Okay, so they have these zeros up to an 80, right? Good, and then this tech A and then three, no, that three. They only have a two, two zeros there and then a 50. So I don't have a 50. Do you have a 50? If you have a 50, go fish or like bingo, whatever. So the bytes there, I'm assuming are the size. So C8E30500, let's keep track of that. Boom, giant terminal. Let's just get nano open. And it should be, now that I've totally resized my screen, C8E3, and like, this is a guess. I could be wrong and if I am, I'm sure you guys are screaming at your computer as you always do to tell me that I'm wrong. But now let's go back to the very, very top and get back to our hex 80 where the P info starts. And the five through 12, so the last ones here need to match what we just saved, right? That's exactly what they had done. Yep, 7C2A0400, they added that there. There's a four background there. So let's try it. Let's do a C8E30500, C3, oh, no, I was wrong. I caught myself though. That's what they say. If you fail, try, try again and fail again. I've saved it. And now those values are there. Let's try to unpack it again. Ladies and gentlemen, dual UPX, UPX-D, spooky. Unpacked one file, we did it, success. I like doing the like Super Smash Brothers. I like their voice, success. That makes me laugh. All right, so now we got spooky and we don't need that nano over there on the side anymore. So he can die. Let's check out what we got. Now, oh, okay. Now we should not have any of those obfuscated or like the crazy pack random strings. So now we should be able to at least kind of make sense of it a little bit more or be able to see those other strings like as they are in plain text. Obviously, I'm just looking at strings right now. Like if I were to hop this open, if I were to crack this open like hopper or something, then maybe we could understand it a little bit more. I don't know exactly how much of that I wanna dive into because we have yet to research what this thing is, truthfully. If there are already blog posts examining how to open this up with UPX, what we just did, I'm sure there's gonna end up being some other research on like what this thing is, especially if it keeps distributing itself with this name mozy.m or again, pronounce it however you want. But we can see the post requests there. Clear, plain as day. Var.ipds.config. Host here. Some other, I mean, Google DNS, what is this? Is that a DNS resolver? Uh, DNS. What the F? That's going to Baidu.com. I'm in the spooky part of the internet again, guys. All I did was Google. Is that like their own DNS? Warning notification regarding the abnormal operation of, how do I get to Amazon customer support? Did I click, oh, no. That's genuine, what? What is this? Is that, let me read this to you. Let me put a quick bedtime story on this one. Can you explain why the camera sends data and sends back to Chinese servers via IP address 114.114.114 almost all the time? Asked on July 13th, 2017. Answer, because the Chinese camera hard-coded this feature into the cameras. This is a UDP DNS server. That's what it's supposed to be. You can mask port 53 to do anything, even provide data such as video to an application server in China. I don't want to panic that the Chinese are watching us since they have sold so many of these cameras to the US consumer, but I'm not sure what data these cameras are sending back to China or whoever is behind this product. To test and see what IPs are being used, put the camera behind a firewall and check the firewall logs, et cetera, et cetera. Did you find this helpful? So look, look, let me add my disclaimer. Let me say, this is all for educational awareness. Helping cybersecurity professionals become less professional. I don't know. I don't have the answers. I have no idea what this is or what it's doing yet. So I'm going to learn. I'm here to learn. We're still following along. What is this thing? Ant pool? What is ant pool? Mining devices worked abnormally due to the failure of the mining address resolution. I don't know about that one. Nor do I exactly care, in all honesty. Ant pool? World-leaning Bitcoin mining pool. Did you see my title up there just change to something completely different? I saw some, I saw some peculiar characters. Let me go back to that. Can I, can I like follow that request? If I hit F12, can I see like where that might take me? Go. I didn't, I didn't look. I didn't see it. I didn't, I didn't stop to see how it looked. But I think, you know what? I don't want to go down this rabbit hole. Truth be told, I'm not, I'm not exactly positive, but I swear to goodness, we can like replay the video in freeze frame slow motion or something. Like did my, did my HTTP title there change into something really wonky? Anyway, we don't need to be mining any Bitcoin in today's video. So let's keep going. File system stuff. Downloading binaries. Octet stream. Potentially looking. Oh, I just dragged myself away on accident. Okay, crisis averted. I was just trying to like highlight this. Potentially anyway, getting our IP address. What else we got? GPON 8080. Real tech. Are these like a list of default passwords or something? I don't know. I might just like have that thought in my head. Maybe I'm a bad guy. Potentially persistent stuff. Stuff to kickstart right when the computer begins. CFG tool. Internet gateway. What is this? Again, I'm literally just looking at strings. This is not taking any skills whatsoever. I just tend to do this to explore. Equip.sh. Wi-Fi.sh. Wi-Fi performance.sh. All these other files, are they being referenced or like called and included? Destination port. Is it just turning on? Turning off firewall rules? Dropping those ports? Removing a web shell CMD. Send commands. I assume that that is functionality that we just have baked in via this malware to set, manage. What? To set like command and control stuff? I don't know. Either way, it's spooky. Hence the name spook. Hence the name spooky.elf. Data stuff, et cetera. Opening up firewall. Actually that time though, accept, accept, accept. Passing in the port via some format. This node doesn't accept announces. All these other potential callbacks. Timeout. This is just straight HTML and JavaScript though. What is that doing? Is it genuinely gonna end up doing some like mining stuff? Like crypto mining? I don't know. Speculation. I'm over here in speculation corner, everybody. Turning on IP address forwarding. I'm assuming that's why they would have that path. Again, I still don't know what they're doing with it yet. Everyone's screaming at me like, John, just open the thing in Hopper or Ghidra or something other than strings in your terminal. No. Dad, you're not my real dad. Busy box. What is it doing? Is it like destroying files? No. What? Busy box DD block size 52, count of one. Input file is bin ls. Or busy box cat bin ls. Or wow read I do print F I. These are all just to get the, just to get the ls command. Or wow read I do print F I done busy box. Why are you doing that? Why are you getting the contents of the ls binary? Whatever. Lot of wgats. Blah, blah, blah, blah, blah, blah, blah. Wait, what is all this? Telnet session now in established state. Remote management console. Some other potential routers. Host name stuff. Telnet sessions, telnet sessions. Samsung Electronics, Comtrend, Gigabit, DDWRT. What is all this? Maintenance shell. Welcome visiting Hawaii home. Yeah, is that so? List of potential usernames and potential passwords. I'm thinking again. Ooh, ooh, don't show those. Why are these in the binary? I mean it makes sense, right? It makes sense. Let's get mozi.6. What, is that a thing? And mozi.7? What? Let's, I wanna see if those exist real quick. Do I still have that wgat? Ah, sorry. Is there a mozi.6? Is it the exact same thing? Let's do a SHA-256 sum on mozi everything. They are, they are the exact same hash. How about a good old mozi.7? Do you exist? Why are there like duplicates? What? Is it mozi.like anything? Is there a mozi.z or f? F in the chat. Oh, sorry, f. Okay, you know what? We're moving on. How much further am I in this? Yeah, there's a mozi.a and a mozi.s and r and b. Why are these all here? They're all the same file. Okay, okay. Let's, let me put my money where my mouth is, right? Sorry for that. Oh, ooh, ooh. That's the exact same syntax we saw in the article. User agent is hello world. Let's echo death. That's a lot of echo deaths. It's probably something to do with that SOAP protocol. HTTP, pure networks, HNAPI. I was getting to an idea. I genuinely was. I was genuinely thinking to myself, I should put my money where my mouth is. Look at all these get requests. I keep getting distracted, I'm sorry. I was genuinely thinking, I should just open this up in Hopper. Although I don't think I actually have Hopper like installed and downloaded on this box yet. But okay, we're at the end. We're just about at the end. We're literally at the end. I'm pretty sure we did it. We successfully scrolled through all of the strings output of that malware sample. Let's find out if this is going to actually get more or less detections. 39. What's that community tab say? Dora signature match, Thor APT scanner. Yeah. Oh, it's all right. He's a cool dude. Yeah, let's get Hopper. Hopper app, try free, please. Actually, I think I still have a Hopper license. Let's get the dev package. Yeah. That's downloaded. Capital H for that Hopper. And we're cruising. No, we're not. There was an error. You need Python 2? What are all these things that you need? Why? Is it fix broken? Fix actually spelled out broken that I need to do? Yeah, let's do it. I think someone told me that at one point and they were like, John. And they whacked me across the face through the internet. To see like, you idiot. You need to run this exact command after you see those errors. And I'm like, okay, I'll never forget. Please put the belt away, dude. Okay, Hopper's installed now. That's all we needed to do. Control shift O is to open a binary. Let's get our spooky.elf going on in here. And yeah, just disassemble it, dude. It's not hard. Oh, look at that string. That's lovely. Procedures. Is there an entry point or anything immediately worthwhile that I could use? Maybe Gijo would be able to do a good analysis on this too. Probably better than, maybe better than what Hopper is trying to do because I would like to be able to see if anything else comes from this. But all of these strings. I think I told it like, hey, it was an Intel processor when I think I should have told it it was MIPS. I don't know if that'll actually do anything or not though. And I realize this is kind of hard to see. So forgive me. Does that have an href? Is it actually being called anywhere or used? Hey, John Hammond from the future here. I was editing this video and I thought, you know what? I should really kind of do the due diligence to open this up in Ghidra and see if I can get anything out just to showcase it. So it obviously is a MIPS thing, it's a MIPS processor and I don't actually like have that on my desktop computer, I think. So maybe I'm again wrong in that. So I would appreciate your input, your feedback, your constructive criticism, constructive criticism in the comments. But I don't know if I'd really be able to showcase that. Look, look at this, look at this. I don't know if, all right, yeah, my face is somewhat visible. So I got all my Java, like you need to install the Java JDK to be able to run Ghidra. And then I fire up Ghidra run. So the crazy cool Ouroboros comes out and load it up here. I create a little project here with Mozi and trying to open up this Mozi, right? For the malware itself. It tells me like, look, I don't have actually a provider for that. So big sad, the big cry. Anyway, that's kind of just me wanting to cover my bases before everyone's like, John, you didn't do, whatever. I'm sorry, I'm sorry. Maybe this video was stupid just looking at strings, but for real, dude, strings is OP. It is overpowered. The power level is over 9,000. Thanks so much, everybody. Let me get you back to the video, peace. Again, I don't know exactly how far down the rabbit hole I wanna go in this and Hopper right now, because I think the more fun, yeah. I think the more fun and cool and interesting stuff is going to be that what comes from the research, truthfully, because I think this is already a well-known. So I'm just clicking around in Hopper to say that I did. Great, we did. I should get Ghidra on this box though at some point. I'll do that after this video, because for those of you that want it, you can probably download this still. You can probably download that binary. I don't know how long it's gonna be up. Let me finish up this article here. Yep, they checked it in VirusTotal. They checked their unpacked version and they found the same domains that I had with Floss, just looking at strings. That's really the only malware analysis route that there is. I'm kidding, I'm kidding, that's a joke. Please, IP addresses, those commands that we saw. Yeah, dude, we saw that same not-ITMS. We saw that same one for the management server. Was our password the same? Let me look for that. We had strings on Spooky. Let's go for less one more time. Was our password not-ITMS? Yep. Where's the password? Does it not include it in this sample? Because those are the same exact commands. No, no, no, no, they were using config tool. CFG tool? Is that referenced? Yeah. Create request password ACS mozi, and that is the same. Nice. See how much you can pillage just with strings? Okay, so GPON, Realtek, Netgear, all those exploits are the same things that we had seen. We saw the IP tables commands to open the firewall, and that's craziness. Literally just running strings. Don't obfuscate malware authors. Who cares? What else have we got here? Mozi, yep. Everyone knows about this thing. This is back in like, what, 2019? UPX. Okay, cool, so we all ran into the exact same wall. That must be like a known trick. That must be some of their TTPs, their Tradecraft Techniques and Procedures. They fix it up. Boy, they did it in a crazy way with Digital Studio. Oh, no, no, no. Now they know. They just kinda actually figured out what UPX is doing. Smarter than me. Okay. Yeah, MalShare has it too? Is that the MalShare one? No, it's a different one. Let's check out Malware. Operators have moved away from using UPX for obfuscation, or this was just uploaded without being packed by mistake. YAR rules to detect this sort of stuff. Okay. Okay, that's enough on that one. MalShare.com has a secure connection field. I don't know if I like that. That's giving me the uneasy feeling. Primer on packing. This is basically doing everything that we had just done as well. Yep. Info corrupted and corrected. Yep, yep, yep. Mosey. Okay, this is a prevalent IoT malware in 2020. I mean, obviously, it's still going on because we found this thing today. Thank you, anonymous donator. Please send me malware. Not that I've really done anything interesting with this. I just kinda wanted to put it in the spotlight. Oh, they're using Radare, too? Oh, these guys are late. Okay, that's the way. This still spooks me. Mosey Mosaic Malware. What do we got? A lot of, there's a lot of stuff out here for this thing. I just kinda wanna scroll through some of these. What did this get released, 2020? Is there anything that's recent? September, still 2020. Oh, Tara Seals. I know her. She, we were gonna make some content. I was gonna write some nerd stuff. Mosey Bot, taking over Netgear, D-Link, and Hawaii routers. It's still blowing up. Well, now you see proof. Ladies and gentlemen, you saw it here. We saw it today, March 1st, 2021. It's still alive and well. Peer-to-peer botnets are still kicking it. Oh, God, that title. A new botnet just moseyed into town. Oh, I wanna pry my eyes out. Hey, Jon Hammond from the future again. I actually went back to go take a look at that security intelligence article, the one with the funny name that I was laughing at. That actually has some really cool and good behavior analysis and breakdown, much better than kinda I did in this video. So if you're interested, you can go take a look. Hitting that continue reading button will give you a little bit more technical depth as to what the thing does. You can see kinda that original stager that we had found to begin with. And then it sort of breaks down into the other CVEs or vulnerabilities that thing tries to take advantage of across all these different devices. You can see some of the actual file paths that we saw and what it would end up doing with those. Hey, it'll try to kill the things that are using the ports that it might end up using later on. Looks for Python, changes process name, SSHD, which is kinda interesting, and DropBear as another kinda ad hoc in place SSHD. It's service. It does some elliptic curve digital signature algorithm cryptography, which is interesting. And then you can see, again, that list of indicators or those URLs it might reach out to. It does list for files and stuff, or I think that's just their, yeah, yeah, yeah. That's just their analysis of some of the files, hashes, et cetera. But the peculiar things that it will get into actual Ghidra code that I was unable to. Truthfully, that's because I suck and I'm bad, and I just kinda wanna showcase and put this in the limelight for you all. Those IP tables commands that we saw, right, which I think is crazy cool. Grabbing those ports that it might end up using. And there's some other neat stuff in here. Yeah, the static analysis, you can see the config file and how it's gonna end up putting that together. It actually uses XOR to kind of somewhat obfuscate some things, but of course, it's a hard-coded key, so you could see really the same thing. Honestly, I think we saw at least the structure, like those beginning and ending tags in our string output. And yeah, those multiple commands that it could end up using within that. Neat, neat stuff, that XOR key yet again. And the telnet login information, or the enumeration that I ended up grabbing, actually does have that hard-coded list of credentials. So that was right on the money of what we were thinking earlier. Kinda neat to see all these in here. And hopefully that goes to show, it just, we'll try to brute force these and see what more it could get into. Those other different file names that we saw, mozi.a, mozi.m, et cetera, et cetera. Once it's unpacked, you can see all these different user agents that it might end up using. Other interesting strings, that's config file that it creates, et cetera, et cetera, et cetera. So that was super cool, that was super good, and I would just steamroll right through it. But I did wanna bring that to your attention, because truthfully, that did much, much more than what I was able to showcase in this video. But hey, I'm all for it. I just wanna put this in the limelight. I just wanna showcase, I just wanna bring this and unearth this. Even if this is September 17th, 2020, there's some really great stuff in that. So thanks. Back to the video. Wow. Oh yeah, Malware's been active since late 2019. Oh, he's still active. I mean, supposedly. It's not, I don't know. I can't say like, hey, I see this one server that got hit with it, and now I know that it's a widespread attack. The world is in chaos. I can't say that. It's just, we kinda stumbled across this sample. Ladies and gentlemen, if you want, host some HTTP servers, and just see if you get hits on them. Just throw out your honeypots and see if the bees come. All right. I think that's all I'm gonna end up doing in this video. We've been cruising for a little bit, and truthfully, I didn't end up doing anything new or innovative other than that UPX trick. But it's kinda interesting to see the conversations and the discussion around this yet. So we saw some Yara signature, or something we could do about those UPX tricks. We kinda understood what this thing was. It told us right away. It all seemed to be using similar tradecraft in the way that it's downloading itself and other. We could see remnants of persistence in the strings. So there was a lot, I think, still interesting in this. I hope. Hopefully you're not gonna scream at me for like, John, you're just using the strings command. Look, dude, if it's not obfuscated, you can at least get a lot of potential insight as to what that thing is doing. So that's it. That's it. That's all. Yeah. What else do we do now, ladies and gentlemen? I don't think that there's anything left. I think we just kick it to the outro. So hey, thank you so much for watching this video. If you guys like this video, please do all those YouTube algorithm things. Please do like the video. Please do type in the comments, you know. I would super appreciate that. It helps the YouTube algorithm engagement stuff. And subscribe, if you'd be willing. If you actually click the bell, hit the bell, smash that bell, destroy, literally annihilate the bell. It will notify you when I post new videos like this. So if you're interested, if you're having fun with these, if these are entertaining and educational and, I don't know. I really would appreciate that. And thanks for helping the channel grow, so. That's it. Thanks, everybody. I love you. I'll see you in the next video. Take care. Bye.