Huntress Analyzes Malichus Malware Linked to Cleo Software Exploitation
Summary
Huntress analyzes Malichus, malware delivered through exploitation of a Cleo software vulnerability, detailing its staged loaders, Java backdoor, custom C2 protocol, command execution, configuration access, and file exfiltration capabilities.
Key points
- Huntress links Malichus delivery to exploitation of Cleo software vulnerability CVE-2024-55956.
- A PowerShell loader retrieves a second-stage Java archive; that downloader decrypts and loads the final Java payload.
- The modular Java framework supports Windows and Linux, though Huntress observed it being used on Windows.
- The implant connects to a C2 server over port 443 using a custom protocol with encrypted packets and multiple command types.
- Operators can run commands through an interactive shell, inspect Cleo configuration and directory settings, and queue files for exfiltration.
- Huntress says the malware's creators and purpose remain uncertain.
Article Details
- Attack Vectors
- The malware was delivered through exploitation of a zero-day vulnerability in Cleo software, identified in the article as CVE-2024-55956.
- A PowerShell loader established a TCP connection to a C2 server and retrieved a second-stage payload.
- The second stage decrypted and downloaded a third-stage Java backdoor and post-exploitation framework.
- The framework supported remote command execution, interactive shell access, and reading Cleo configuration files.
- The malware could package local files into ZIP archives and send them to the C2 server.
- Defensive Notes
- Huntress published YARA rules for the Cleo malware analysis at https://github.com/huntresslabs/threat-intel/tree/main/2024/2024-12/Cleo.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0b7b1b24f85a0107829781b10d08432db260421a7727230f1d3caa854370cb81 | SHA-256 of the Malichus Mos malware component. |
| SHA256 | 0c57b317b572d071afd8ccdb844dd6f117e20f818c6031d7ba8adcbd32be0617 | SHA-256 of the Malichus Cli malware component. |
| SHA256 | 1ba95af21bac45db43ebf02f87ecedde802c7de4d472f33e74ee0a5b5015a726 | SHA-256 of the Malichus Proc malware component. |
| SHA256 | 1e351bb7f6e105a3eaa1a0840140ae397e0e79c2bdc69d5e1197393fbeefc29b | SHA-256 of the Malichus Slot malware component. |
| SHA256 | 429d24e3f30c7e999033c91f32b108db48d669fde1c3fa62eff9da2697ed078e | SHA-256 of the Malichus Dwn malware component. |
| SHA256 | 57ec6d8891c95a259636380f7d8b8f4f8ac209bc245d602bfa9014a4efd2c740 | SHA-256 of the Malichus SFile malware component. |
| SHA256 | 6705eea898ef1155417361fa71b1078b7aaab61e7597d2a080aa38df4ad87b1c | SHA-256 of the cleo.2607 first-stage payload identified in the Malichus IOC table. |
| SHA256 | 87f7627e98c27620dd947e8dd60e5a124fdd3bb7c0f5957f0d8f7da6d0f90dee | SHA-256 of the Malichus ScSlot malware component. |
| SHA256 | f4e5a6027b25ede93b10e132d5f861ed7cca1df7e36402978936019930e52a16 | SHA-256 of the Malichus SrvSlot malware component. |
| SHA256 | f80634ce187ad4834d8f68ac7c93500d9da69ee0a7c964df1ffc8db1b6fff5a9 | SHA-256 of the Malichus DwnLevel malware component. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware reads files and directories from the compromised host for collection.T1027 · Obfuscated Files or InformationThe first-stage PowerShell loader is stored as a Base64 blob.T1041 · Exfiltration Over C2 ChannelThe malware uploads archived files to its C2 server over its custom C2 channel.T1059.001 · PowerShellA PowerShell loader sets up the host and is also used to delete the first-stage payload.T1059.003 · Windows Command ShellThe framework supports interactive shell command execution; Huntress reported observing an nltest command run interactively on a Windows host.T1059.004 · Unix ShellThe malware uses Bash to delete the first-stage payload when the system is not identified as Windows.T1070.004 · File DeletionThe framework deletes the first-stage downloader from disk after loading.T1082 · System Information DiscoveryThe malware retrieves the hostname and checks whether the host is running Windows.T1083 · File and Directory DiscoveryThe framework parses Cleo configuration files to identify configured hosts, mailboxes, and file directories.T1105 · Ingress Tool TransferThe PowerShell loader retrieves a second-stage payload from C2, and the Java downloader retrieves the third-stage payload.T1140 · Deobfuscate/Decode Files or InformationThe loader decodes Base64 data, and the Java downloader decrypts the downloaded archive before repairing and extracting it.T1560.002 · Archive via LibraryMalichus packages collected files into ZIP archives using its archive-handling classes.T1573.001 · Symmetric CryptographyMalichus encrypts and decrypts custom C2 packets using synchronized client and server state.
CVE
Malware
Vendors
Products
Cleo Harmonywithin the Cleo software, and was interested in understanding what types of trading relationships a Cleo Harmony, VLTrader, or LexiCom instance had been configured with in addition to where payload files such asLexiComand was interested in understanding what types of trading relationships a Cleo Harmony, VLTrader, or LexiCom instance had been configured with in addition to where payload files such as files sent or receivedVLTraderCleo software, and was interested in understanding what types of trading relationships a Cleo Harmony, VLTrader, or LexiCom instance had been configured with in addition to where payload files such as files sent or