Researchers Trace Geacon_Pro Infrastructure and Linux and Windows Payloads
Summary
Hunt researchers analyzed suspected Geacon_Pro servers, exposed directories, deployment scripts, and Linux and Windows payloads, including a webshell. They caution that certificate matches alone cannot confirm malicious use.
Key points
- Researchers found 12 IPs matching Geacon_Pro’s default certificate fields, but warn that certificate matches alone do not establish that a server is running the tool.
- An exposed directory contained scripts that downloaded files from suspicious domains, installed a service disguised as the Zabbix Agent, and configured it to run with root privileges and restart automatically.
- The Linux ELF file alis was identified by some VirusTotal vendors as a Geacon/Cobalt Strike variant; analysis also linked it to Geacon_Pro and a command-and-control server.
- A separate server hosted Linux and Windows binaries with indicators associated with Geacon, including an ARM Linux sample detected as a Cobalt Strike variant.
- Researchers deobfuscated a JSP file and found a webshell designed to execute commands and upload files on remote servers.
- The investigation also observed rotating Geacon_Pro certificates alongside RedGuard and Cobalt Strike certificate indicators on another server.
- The researchers say security teams should monitor Linux systems as well as Windows for these tools and related activity.
Article Details
- Attack Vectors
- Bash scripts downloaded an ELF payload from a suspicious domain and installed it as a service masquerading as the Zabbix Agent.
- The scripts configured the service to run with root privileges, start automatically, and restart if it stopped.
- The article reports Cobalt Strike-related payloads communicating with command-and-control infrastructure.
- A Unicode-escape-obfuscated JSP webshell could execute commands and upload files after deployment to a remote server.
- Defensive Notes
- Do not attribute a server to Geacon_Pro solely because it uses the tool's default certificate; the certificate is publicly available and may be used for legitimate or unrelated software.
- Monitor exposed directories, suspicious service creation and persistence, and the indicators listed in the article.
- Investigate Linux and Unix systems as well as Windows endpoints for Geacon-related activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 0e6c770f37ce2aa7942dce5350ca1fe781e5f479 | SHA-1 hash of gslll.jsp, a Unicode-obfuscated webshell. |
| SHA1 | 20ebea093d50351f686fa80e64f9171e80bf50e8 | SHA-1 hash of grpc, described as a renamed fast reverse proxy binary for Linux. |
| SHA1 | 7fbfb47aee77fd965a5b703c12f5da7505af6fc6 | SHA-1 hash of m_arm64, identified by 20 security vendors as a Cobalt Strike variant. |
| SHA1 | cab73e5f990143ed8311d760ceca7bb12e33c0d2 | SHA-1 hash of alis, identified by the article as an ELF Golang variant of Cobalt Strike. |
| SHA1 | d2746e2a30719760583c62b034312e16565e652e | SHA-1 hash of s2, a script that downloads the alis payload. |
| SHA1 | fa21b1c5063d296d3402ff94a34b6b3a9285e59b | SHA-1 hash of s1, a script in the open directory that installs a masquerading service. |
| SHA1 | ffc4f2996cca934185bf36355fc4c09aef871435 | SHA-1 hash of ha.exe, a Windows executable flagged as malicious by five VirusTotal vendors. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JSP webshell used Unicode escape encoding to obscure its contents.T1105 · Ingress Tool TransferThe s1 and s2 scripts downloaded scripts and an ELF payload from a suspicious domain.T1505.003 · Web ShellThe Unicode-obfuscated JSP file was identified as a webshell for remote command execution and file uploads.T1543.002 · Systemd ServiceThe scripts created and enabled a systemd service that ran the downloaded payload and restarted automatically.
People
Vendors
AliyunOur next IP, 120.55.74_104, is hosted in China on the Aliyun Computing network and also has an exposed directory on port 8000. This server serves as a prime example of why we cannot rely solely on certificates to drawCloudflarevaluable comments and insights for additional verification. The command-and-control (C2) server is a CloudFlare IP address linked to another suspicious domain, api.chinaunion_info.Host PapaFigure 5: Screenshot of the initial server in our research. Try it out!Located in the US on the Host Papa ASN, IP address 172.245.53_132 contained an unusual folder named 'dkxtzLeppoUwg676m9Am5gJ'. This directoryTencentDuring our research, we observed IP address 43.136.38_59 hosted in China and part of the Tencent Cloud Computing network. This server hosted a redirect to the domain 360.net, an antivirus company, on port 8443 (as shown
Products
Go CLRHowever, we did uncover Linux and Windows binaries with indicators similar to standard Geacon payloads and some variants utilizing Go CLR, a package that allows .NET execution from Go.Zabbix AgentThis script proceeds to create a service that masquerades as the Zabbix Agent, a legitimate network monitoring tool. It then re-initializes the systemctl service, starts the newly created service, and finally removes
Tools
Cobalt StrikeThe red-teaming tool Cobalt Strike has long been a staple for simulating attacks, predominantly targeting Windows platforms. However, its reach has expanded with Golang implementations known as Geacon and Geacon_Pro.Geacontargeting Windows platforms. However, its reach has expanded with Golang implementations known as Geacon and Geacon_Pro. Our research team identified several servers using the default certificate for the latterGeacon_Plusversion was described as a co-developed project with Z3ratu1, who is also credited with developing Geacon_Plus. According to the developers, Geacon_Pro was transitioned into a private project—potentially forGeacon_ProWindows platforms. However, its reach has expanded with Golang implementations known as Geacon and Geacon_Pro. Our research team identified several servers using the default certificate for the latter tool, whichRedGuard16: Redirect on port 8443 to 360.net. Check it outIn April, we published a blog post on detecting the RedGuard C2 redirector, which is commonly used with Cobalt Strike to conceal malicious infrastructure. Noticing a