Researchers Find Malware-Hosting Infrastructure by Revisiting Past Threat Reports
Summary
An investigation used IPs from historical threat reports to find open directories and malware-hosting infrastructure, including files associated with Empire, Meterpreter, PurpleFox, GhostRAT, and AsyncRAT.
Key points
- The investigation used IPs from an earlier report on Silver Fox to search networks in related ASNs for open directories.
- An open directory at 192.253.234[.]80 hosted a compressed PowerShell script detected as an Empire implant, plus obfuscated Python and ELF files associated with Meterpreter payloads.
- A server at 206.238.196[.]240 hosted an obfuscated Windows executable detected as PurpleFox that also executed GhostRAT.
- The same 206.238.196[.]240 IP was reported to have hosted AsyncRAT shortly before the investigation.
- The article says these findings may reveal other actors in the same network blocks and cautions that the analyzed files may not be directly linked to Silver Fox.
Article Details
- Attack Vectors
- Phishing campaigns targeting Chinese users and companies, including multiple email phishing campaigns.
- Malicious advertisements promoted through search results using SEO.
- Trojanized files disseminated to employees through WeChat groups.
- Exposed open directories and HTTP File Server instances hosted suspicious files and malware.
- Defensive Notes
- Revisit historical threat reports and correlate IP addresses, open directories, ports, and ASNs to identify potentially related infrastructure.
- Include HTTP File Server instances in open-directory research.
- The article cautions that files found on related infrastructure might not be directly linked to Silver Fox.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 192[.]253[.]234[.]80 | IP address hosting an open directory with files described as an Empire implant and Python and ELF payloads. |
| IPV4 | 206[.]238[.]196[.]240 | IP address hosting an open directory with a PurpleFox-detected executable that also executes GhostRAT; the article also reports it hosted AsyncRAT. |
| SHA1 | 981e6c1a002636b24810863357d7cc34b04e79c3 | SHA1 listed for 47477.py and 47478.elf, files found on the open directory. |
| SHA1 | 9fe8436f8e1f6198b883404f0b59256b4f08bbed | SHA1 hash of mngboot.exe, described as a PurpleFox-detected executable that also executes GhostRAT. |
| SHA1 | f20d5e4417061e5d86a11f601f2368a91cb7847c | SHA1 hash of 0.ps1, described as a PowerShell script detected as an Empire implant. |
MITRE ATT&CK
Threat Actors
Malware
AsyncRATthe exposed server querying the IP in Hunt, as recently as a few days ago, this same IP was also hosting AsyncRAT.Gh0st RATWith SEO, they used malicious ads and multiple email phishing campaigns to distribute Remote Administration Trojans (RATs) malwares (Gh0st RAT, ValleyRAT, and Sainbox RAT).GhostRATdetails a phishing campaign attributed to the Silver Fox group targeting Chinese users with the standard GhostRAT malware and a variant first introduced on the t00ls forum dubbed "winos."Meterpreterfiles, from a PurpleFox rootkit sample to a few obfuscated files that lead to Python and ELF-based Meterpreter payloads.PurpleFoxLtd., and TCloudnet, to host its infrastructure. The section below discusses several files, from a PurpleFox rootkit sample to a few obfuscated files that lead to Python and ELF-based Meterpreter payloads.Sainbox RATWith SEO, they used malicious ads and multiple email phishing campaigns to distribute Remote Administration Trojans (RATs) malwares (Gh0st RAT, ValleyRAT, and Sainbox RAT).ValleyRATWith SEO, they used malicious ads and multiple email phishing campaigns to distribute Remote Administration Trojans (RATs) malwares (Gh0st RAT, ValleyRAT, and Sainbox RAT).winosusers with the standard GhostRAT malware and a variant first introduced on the t00ls forum dubbed "winos."
Products
HTTP File ServerAlthough HTTP File Server (HFS) instances are not well known in open directory research, many contain a wealth of information, hosting some widely known malware and some less known. If you haven't added HFS servers toNullsoft Scriptable Install Systemof open directory at 206.238.196[.]240The file identified in this directory is a 32-bit Nullsoft Scriptable Install System (NSIS) Windows executable employing SEProtect for obfuscation. Although detected as
Tools
CyberChefFigure 6: Snippet of 47477.pyFigure 6 depicts the script in CyberChef. We can easily decode it. However, additional obfuscated code is also within the code, copied directly from the Metasploit GitHub.Metasploit FrameworkFigure 6: Snippet of 47477.pyFigure 6 depicts the script in CyberChef. We can easily decode it. However, additional obfuscated code is also within the code, copied directly from the Metasploit GitHub.