Open Directories Used to Deliver AsyncRAT and Cobalt Strike-Linked Malware
Summary
Hunt describes two open-directory malware delivery cases: one involving AsyncRAT and BITS, and another using a Python executable and Fernet-encrypted shellcode detected as Cobalt Strike-related.
Key points
- One open directory hosted AsyncRAT and a VBScript that used Microsoft BITS to download f.jpg from the same server.
- The f.jpg file was identified as a ZIP archive containing nine additional files.
- A second open directory hosted a Supershell login page and files including a 10 MB executable and encrypted or encoded data.
- Analysis of the executable found compiled Python code using Fernet to decrypt data and a function that downloaded a.txt.
- The decrypted Python script decrypts shellcode in memory and executes it.
- VirusTotal and Triage detected the executable and shellcode as part of the Cobalt Strike penetration testing tool.
- The article notes that exposed directories can serve as an initial malware-delivery point and lists additional IP-and-port examples for hunting.
Article Details
- Attack Vectors
- Open directories hosted malware and related files for download.
- A VBScript-created XML file runs a PowerShell command that uses Microsoft BITS to download f.jpg from the same server.
- The article says the text file could be delivered through a crafted email or other means; phishing is also discussed as a possible delivery method for 1.exe.
- 1.exe downloads a.txt from the open directory; the resulting Python script decrypts shellcode in memory and executes it.
- Defensive Notes
- Monitor exposed open directories for suspicious files and malware-delivery activity.
- Inspect scripts and files hosted in open directories before opening or executing them; the article describes crawling and reading files for analysis.
- Investigate the listed IP addresses as hunting leads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 111[.]230[.]26[.]98 | Address listed by the article as an example for further hunting. |
| IPV4 | 121[.]37[.]21[.]229 | Malicious IP address reported as hosting a Supershell login page and files in an open directory. |
| IPV4 | 167[.]235[.]78[.]69 | Address listed by the article as an example for further hunting. |
| IPV4 | 172[.]232[.]207[.]208 | Address listed by the article as an example for further hunting. |
| IPV4 | 185[.]241[.]208[.]159 | Address listed by the article as an example for further hunting. |
| IPV4 | 185[.]81[.]157[.]103 | Address listed by the article as an example for further hunting. |
| IPV4 | 185[.]81[.]157[.]12 | Address listed by the article as an example for further hunting. |
| IPV4 | 185[.]81[.]157[.]244 | Address listed by the article as an example for further hunting. |
| IPV4 | 185[.]81[.]157[.]252 | Address listed by the article as an example for further hunting. |
| IPV4 | 207[.]32[.]217[.]21 | Malicious IP address reported as hosting AsyncRAT and an open directory containing delivery files. |
| IPV4 | 35[.]225[.]65[.]204 | Address listed by the article as an example for further hunting. |
MITRE ATT&CK
T1059.001 · PowerShellThe VBScript-created XML file contains a PowerShell command.T1059.005 · Visual BasicThe VBScript in xx.txt creates an XML file containing a PowerShell command.T1105 · Ingress Tool TransferThe described code downloads f.jpg and a.txt from open directories.T1197 · BITS JobsThe VBScript uses Microsoft BITS to download f.jpg from the same server.
Malware
Tools
Cobalt StrikeVirusTotal and Triage detect 1.exe and the shellcode as part of the Cobalt Strike penetration testing tool.Detect It EasyFigure 3: Detect it Easy results of f.jpgf.jpg is a zip file containing 9 additional files. We'll keep digging from here, unzip the file, and see what we find.SuperShellThe second case is a malicious IP Hunt detected as hosting a login page for Supershell, an open-source C2 platform, and two more files in an open directory.