Open Directory Exposes SuperShell Payloads and a Cobalt Strike Beacon
Summary
An investigation of an exposed server uncovered two SuperShell payloads and a Linux Cobalt Strike beacon, along with associated command-and-control infrastructure and an ARL service.
Key points
- The exposed directory was found while searching for copies of the IOX proxy and port-forwarding tool.
- Two UPX-packed 64-bit Linux ELF files were identified as SuperShell, also known as GOREVERSE; both connected to 124.70.143[.]234 over port 3232.
- A SuperShell administrative panel was hosted on port 8888; the server also exposed ARL on port 5003.
- A separate UPX-packed ELF file was identified as a Cobalt Strike beacon, connecting to 8.219.177[.]40 over port 443 with a self-signed certificate.
- The Cobalt Strike team server had been taken down by the time investigators checked it.
Article Details
- Attack Vectors
- An exposed open directory contained SuperShell payloads and a Linux ELF Cobalt Strike beacon.
- The SuperShell backdoor communicated with 124.70.143[.]234 over port 3232.
- The Cobalt Strike beacon connected to 8.219.177[.]40 over port 443 using a self-signed certificate.
- Defensive Notes
- SuperShell login panels can be identified by looking for the URI pattern /supershell/login together with 'supershell' in the HTTP response.
- The article reports that the Cobalt Strike teamserver at 8.219.177[.]40 had already been taken down when Hunt checked it.
- The article says ARL was detected on the SuperShell C2 infrastructure and suggests it may indicate reconnaissance after initial access; this is presented as a possibility.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 123[.]60[.]58[.]50 | Listed as an open directory in the article's network indicators. |
| IPV4 | 124[.]70[.]143[.]234 | SuperShell panel and C2 infrastructure; the backdoor communicates with this IP. |
| IPV4 | 8[.]219[.]177[.]40 | Cobalt Strike C2 address used by the beacon. |
| MD5 | 0095c9d4bc45fed4080e72bd46876efd | MD5 listed for the iox.exe file in the file indicators. |
| MD5 | 6dcfd2dd537b95a6b9eac5cb1570be27 | MD5 listed for the vagent.jar file in the file indicators. |
| MD5 | 770a2166ff4b5ece03a42c756360bd28 | MD5 listed for the Cobalt Strike beacon file test. |
| MD5 | 8e732006bd476ce820c9c4de14412f0d | MD5 listed for the SuperShell payload file ps2. |
| MD5 | 8f2df5c6cec499f65168fae5318dc572 | MD5 listed for the winlog2.exe file in the file indicators. |
| MD5 | 91757c624776224b71976ec09034e804 | MD5 listed for the SuperShell payload file ps1. |
Malware
GOREVERSEtool, we stumbled upon an exposed server containing two SuperShell payloads, also referred to as GOREVERSE by Google/Mandiant, and a Linux ELF Cobalt Strike beacon.SupershellIOX, an open-source proxy and port forwarding tool, we stumbled upon an exposed server containing two SuperShell payloads, also referred to as GOREVERSE by Google/Mandiant, and a Linux ELF Cobalt Strike beacon.
Tools
ARLincluding 5003, already detected by Hunt (the red bug image next to the magnifying glass) as ARL or Asset Reconnaissance Lighthouse, a tool designed to assist red teamers in discovering weak points in aCobalt Strikecontaining two SuperShell payloads, also referred to as GOREVERSE by Google/Mandiant, and a Linux ELF Cobalt Strike beacon.IOXWhile searching for open directories hosting copies of IOX, an open-source proxy and port forwarding tool, we stumbled upon an exposed server containing two SuperShell payloads, also referred to as GOREVERSE by