cyber.hendryadrian.com
Threat Research · hunt.io

Rekoobe Backdoor Found on Open Servers Alongside TradingView Lookalike Domains

· Original article ↗

Summary

Researchers found two Rekoobe samples on open servers, traced related infrastructure through shared SSH keys, and identified inactive domains resembling TradingView. Their connection to a campaign targeting TradingView users remains unconfirmed.

Key points

  • Two Rekoobe binaries were exposed in an open directory at 27.124.45[.]146; both attempted to contact the same server on port 12345.
  • Analysis found one sample changed its process name and copied itself to /tmp/CCCCCCCC before execution; similarities to NoodRAT/Noodle RAT were not enough to confirm that identification.
  • Researchers found TradingView lookalike domains that could support phishing or social engineering, but could not confirm their use in the activity.
  • Three additional IPs were linked to the original server through a shared SSH key; another server hosted duplicate Rekoobe samples in an open directory.
  • The researchers describe the potential targeting of TradingView users as unconfirmed and say the infrastructure warrants further investigation.

Article Details

Attack Vectors
  • Rekoobe samples were exposed in open directories and attempted to communicate with the hosting IP on port 12345.
  • TradingView-lookalike domains were identified as possible typosquatting infrastructure for phishing or social engineering; the article does not confirm they were used in an attack.
Defensive Notes
  • The article recommends hunting open directories and pivoting across infrastructure to identify additional malware-hosting servers.

Indicators of compromise

TypeIndicatorContext
DOMAIN390698[.]ruDomain listed on a server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
DOMAIN49246[.]sxDomain listed on a server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
DOMAIN56204[.]sxDomain listed on a server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
DOMAIN70332[.]clubDomain listed on a server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
DOMAIN734439[.]comDomain listed on a server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
DOMAIN836833[.]ccDomain listed on a server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
DOMAIN94783[.]clubDomain listed on a server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
DOMAIN953388[.]ccDomain listed on a server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
DOMAIN963388[.]ccDomain listed on a server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
DOMAINtradingviewll[.]comTradingView-lookalike domain identified as possible typosquatting infrastructure; malicious use was not confirmed.
DOMAINtradingviewlll[.]comTradingView-lookalike domain identified as possible typosquatting infrastructure; malicious use was not confirmed.
HOSTNAMEadmin[.]tradingviewlll[.]comTradingView-lookalike hostname identified as possible typosquatting infrastructure; malicious use was not confirmed.
IPV41[.]32[.]253[.]2Server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
IPV427[.]124[.]45[.]146Open-directory server hosting Rekoobe samples; the samples attempted to communicate with this IP on port 12345.
IPV427[.]124[.]45[.]211Linked server with an open directory hosting duplicate Rekoobe-detected files.
IPV427[.]124[.]45[.]231Server linked to the Rekoobe-hosting infrastructure by shared SSH keys.
SHA25628382231cbfe3bf7827c1a874b3d7f18717020ced516b747a2a1bb7598eabe0bSHA-256 hash of a binary identified as Rekoobe.
SHA256a1c0b48199e8a47fe50c4097d86e5f43a1a1c9a9c1f7f3606ffa0d45bb4a2eb3SHA-256 hash of a binary identified as Rekoobe.

Threat Actors

APT31Identified in the article as a previous deployer of Rekoobe.ZirconiumThe article identifies Zirconium as another name for APT31.

Malware

RekoobeRekoobe is a versatile backdoor previously deployed by APT31, also known as Zirconium, amongst other adversaries involved in cyber espionage and data theft. With code partially based on the publicly available Tiny

Products

TradingViewinto the hosting IP. Upon further analysis, we discovered a handful of domains resembling TradingView, a widely used platform for worldwide charting, trading, and sharing financial insights traders use.

Tools

Huntshared SSH keys, suggesting a connection to our original server. This relationship was uncovered using the Hunt's Association tab, as shown in Figure 6.NucleiWe previously wrote about Yakit, an all-in-one cybersecurity application that integrates tools like Nuclei and includes features such as man-in-the-middle (MiTM) interception and web fuzzing.Yakit.211--are the only servers hosting these Rekoobe samples. Interestingly, our scanners also detected the Yakit Security Tool on 27.124.45[.]211

Countries

Hong KongLike the original open directory, these servers are also hosted in Hong Kong, indicating they are likely part of the same operational setup.

Industries

Financial Services

Related Articles