Exposed BYOB C2 Server Reveals Multistage Malware Campaign Across Windows, Linux, and macOS
Summary
Researchers found an exposed directory on an active BYOB command-and-control server and analyzed a multistage malware deployment with cross-platform persistence, surveillance capabilities, and infrastructure also hosting XMRig miners.
Key points
- An exposed directory on a live C2 server at 38.255.43[.]60:8081 contained BYOB droppers, stagers, payloads, and post-exploitation modules.
- The three-stage infection chain uses a small obfuscated Python dropper, a stager, and a roughly 123 KB remote-access payload.
- The payload supports Windows, Linux, and macOS and implements seven persistence methods across the platforms.
- Capabilities include keylogging, screenshots, packet capture, process manipulation, Outlook email collection, and encrypted HTTP-based C2.
- Researchers identified five infrastructure nodes across the United States, Singapore, and Panama; two also hosted XMRig miners.
- The article recommends monitoring unusual outbound HTTP ports, Python network activity, persistence artifacts, and Outlook COM automation, alongside containment and cleanup measures.
Article Details
- Attack Vectors
- A 359-byte Python dropper uses Base64 decoding, Zlib decompression, Marshal deserialization, and in-memory execution to retrieve and run a stager from the exposed C2 server.
- The stager retrieves and executes the main RAT payload over HTTP, with optional XTEA decryption.
- The payload establishes persistence through Windows Registry Run keys, Startup-folder shortcuts, scheduled tasks, WMI subscriptions, hidden files, Linux crontab entries, and macOS LaunchAgents.
- Post-exploitation capabilities include keylogging, process enumeration and termination, Outlook email collection, raw-socket packet capture, screenshots, and attempted Windows privilege elevation through a user-approved UAC prompt.
- Defensive Notes
- Restrict unauthorized Python execution through application control or allowlisting, and use EDR capable of detecting in-memory loaders.
- Monitor outbound HTTP to uncommon ports such as 8080–8083, newly observed hosts running Python SimpleHTTP, and Python processes making direct external requests.
- Monitor Registry Run keys, Startup-folder .url files, scheduled tasks, WMI event subscriptions, keyboard-hook activity, and Outlook COM automation initiated by non-Outlook processes.
- Apply outbound network controls, monitor WMI activity, and reinforce user awareness of unexpected UAC prompts and disguised installers.
- If activity is identified, block the reported C2 infrastructure, isolate affected systems, preserve memory, validate and remove persistence mechanisms, and review network logs for further communication or lateral movement.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 108[.]230[.]121[.]11 | BYOB infrastructure node also reported to host XMRig. |
| IPV4 | 15[.]235[.]186[.]150 | BYOB infrastructure node also reported to host XMRig. |
| IPV4 | 38[.]255[.]43[.]60 | Exposed BYOB C2 server and payload-distribution host. |
| MD5 | 3544b6c28d2812d09677b07ead503597 | MD5 hash of the malicious persistence.py artifact. |
| MD5 | 3c5a52efd0c08f92bc31be4b31afb2e5 | MD5 hash of the malicious byob_tLD.py dropper. |
| MD5 | 5c61a8720aa0b9a28973be3f0eedf042 | MD5 hash of the malicious kxe.py stager. |
| MD5 | 72caa7b8bb22c80a2bc77c17d1a35046 | MD5 hash of the malicious kxe.py payload. |
| MD5 | 76e8ff3524822f9b697af1b7f9a96712 | MD5 hash of the malicious byob_kxe.py dropper. |
| MD5 | cd06fc1d25a5636a7e953c672e1fa3ba | MD5 hash of the malicious keylogger.py artifact. |
| URL | hxxp[:]//38[.]255[.]43[.]60:8081////clients/payloads/kxe[.]py | Malicious RAT payload URL fetched by the stager. |
| URL | hxxp[:]//38[.]255[.]43[.]60:8081////clients/stagers/kxe[.]py | Malicious stager URL fetched and executed by the dropper. |
MITRE ATT&CK
T1040 · Network SniffingThe packet-sniffer module captures and parses network traffic using raw sockets.T1041 · Exfiltration Over C2 ChannelThe article's ATT&CK mapping reports uploading data over the C2 channel to port 8083.T1053.005 · Scheduled TaskThe deployment creates an hourly Windows scheduled task.T1056.001 · KeyloggingThe keylogger uses pyHook on Windows and pyxhook on Linux and macOS to capture keystrokes.T1057 · Process DiscoveryThe process module enumerates running processes and can search and monitor them.T1059.006 · PythonThe dropper, stager, and payload are Python components that execute code.T1071.001 · Web ProtocolsThe payload uses HTTP for C2 communications and modular payload delivery.T1082 · System Information DiscoveryThe payload collects platform, IP, hostname, username, architecture, and privilege information.T1113 · Screen CaptureThe article identifies screenshots as a payload capability and refers to an mss screenshot module.T1114.001 · Local Email CollectionThe malware accesses Outlook through COM automation and searches and collects inbox messages.T1140 · Deobfuscate/Decode Files or InformationThe dropper reconstructs its next-stage loader through Base64 decoding, Zlib decompression, and Marshal deserialization.T1497.001 · System ChecksThe stager contains checks for virtualization-related environment variables and processes, although the article says the check is commented out in this sample.T1543.001 · Launch AgentThe deployment creates a macOS LaunchAgent plist for persistence.T1546.003 · Windows Management Instrumentation Event SubscriptionThe malware establishes WMI persistence using an event filter and consumer.T1547.001 · Registry Run Keys / Startup FolderThe malware creates a Java-Update-Manager value under the Windows HKCU Run key.T1547.009 · Shortcut ModificationThe malware creates a disguised .eu.url shortcut in the Windows Startup folder.T1548.002 · Bypass User Account ControlThe Windows module calls ShellExecuteEx with the runas verb to request elevation; the article says this prompts for user approval rather than silently bypassing UAC.T1573.001 · Symmetric CryptographyThe article's ATT&CK mapping reports AES-256-CBC encryption for C2 communications.
Malware
Vendors
Products
Tools
Hunt.io AttackCaptureUsing open directory intelligence surfaced through the Hunt.io AttackCapture tooling, our team identified an exposed directory on a command and control server at IP address 38[.]255[.]43[.]60 on port 8081. The server,pyHookThe Windows-specific implementation uses the pyHook library to intercept keyboard events at a low level. It creates a HookManager object, assigns the _event callback to the KeyDown event, and calls HookKeyboard() topyxhookFor Linux and macOS, the module uses pyxhook, which provides similar functionality by hooking into X11 keyboard events.
Countries
PanamaTotal C2 Nodes 5 Across US, Singapore, PanamaSingaporeTotal C2 Nodes 5 Across US, Singapore, PanamaUnited Statesand control server at IP address 38[.]255[.]43[.]60 on port 8081. The server, hosted by Hyonix in the United States, was actively serving malicious payloads associated with the BYOB (Build Your Own Botnet) framework.