MalwareExploits 5 CVEs

Rabbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

5 CVES

CVE-2018-1149Remote Code Execution in NUUO NVRMini2 cgi_systemExploited in the wild

This new campaign used a self-propagating worm called “Rabbot” that shared the same code base with Linux Rabbit... it can also target and infect Internet-of-Things (IoT) devices via known vulnerabilities. | The known vulnerabilities that Rabbot is capable of exploiting include the following: CVE-2018-1149 ...

via anomali bloganomali.com

CVE-2018-9866Remote Code Execution in SonicWall Global Management System XML-RPCExploited in the wild

The known vulnerabilities that Rabbot is capable of exploiting include the following: ... CVE-2018-9866 ... | This new campaign used a self-propagating worm called “Rabbot” that shared the same code base with Linux Rabbit... it can also target and infect Internet-of-Things (IoT) devices via known vulnerabilities.

via anomali bloganomali.com

CVE-2016-0792Jenkins Remote API XML Deserialization RCEExploited in the wild

via anomali bloganomali.com

CVE-2015-2051D-Link DIR-645 HNAP SOAPAction Command InjectionExploited in the wild

The known vulnerabilities that Rabbot is capable of exploiting include the following: ... CVE-2015-2051 ... | This new campaign used a self-propagating worm called “Rabbot” that shared the same code base with Linux Rabbit... it can also target and infect Internet-of-Things (IoT) devices via known vulnerabilities.

via anomali bloganomali.com

CVE-2017-6884Command Injection in Zyxel EMG2926 nslookup Diagnostic FunctionExploited in the wild

The known vulnerabilities that Rabbot is capable of exploiting include the following: ... CVE-2017-6884 ... | This new campaign used a self-propagating worm called “Rabbot” that shared the same code base with Linux Rabbit... it can also target and infect Internet-of-Things (IoT) devices via known vulnerabilities.

via anomali bloganomali.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

“Rabbot… can also target and infect Internet-of-Things (IoT) devices via known vulnerabilities… CVE-2018-1149, CVE-2018-9866, CVE-2017-6884, CVE-2016-0792, CVE-2015-2051 …”

Execution

1 technique

T1059.007JavaScriptEvidence1

“If the infected machine is a web server, the malware will inject CoinHive script tags into every HTML file… Rabbot… searching for ‘.HTML’ files and inserting JavaScript files into the browser.”

Persistence

1 technique

T1037.004RC ScriptsEvidence1

“gain persistence… through ‘rc.local’ files and ‘.bashrc’ files.”

Privilege Escalation

1 technique

T1037.004RC ScriptsEvidence1

“gain persistence… through ‘rc.local’ files and ‘.bashrc’ files.”

Stealth

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

“The first two authentication certifications are to ensure that the malware is not in a ‘honey pot’. This is likely to avoid static analysis of the malware.”

Credential Access

1 technique

T1110Brute ForceEvidence1

“SSH brute force… brute force SSH passwords… authentication utilizing a list of hard-coded credentials it has.”

Discovery

2 techniques

T1046Network Service DiscoveryEvidence1

“check to see if an SSH server is listening on Port 22. The malware will open a socket to see if it receives a response…”

T1497Virtualization/Sandbox EvasionEvidence1

“The first two authentication certifications are to ensure that the malware is not in a ‘honey pot’. This is likely to avoid static analysis of the malware.”

Command and Control

2 techniques

T1090.003Multi-hop ProxyEvidence1

“Establish a connection to the Command and Control (C2) server using Tor gateways… it utilizes Tor hidden services to act as contact points to access a Tor gateway… establish an active C2 URL. The payload… is then sent… as an encoded URL parameter.”

T1105Ingress Tool TransferEvidence1

“payload… sent from the C2 server as an encoded URL parameter… Rabbot will send all its payloads through an open port 80 to the Linux (web)servers”

Impact

1 technique

T1496Resource HijackingEvidence1

“goal… install cryptocurrency miners… attempts to install both ‘CNRig’ and ‘CoinHive’ Monero miners… inject CoinHive script tags into every HTML file…”

INDICATORS OF COMPROMISE

IOCs tracked for this family

35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

35 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app8 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

anomali blogNews

Dec 6, 2018

Pulling Linux Rabbit/Rabbot Malware Out of a Hat

Self-propagating worm sharing code with Linux Rabbit; targets Linux servers and IoT devices, delivers mining payloads over port 80, and injects CoinHive into web pages by modifying HTML/adding JavaScript. Unlike Linux Rabbit, it is not geolocation-restricted and can exploit multiple known vulnerabilities to spread.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching35

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities5

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 5 CVEs

Rabbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

5 CVES

CVE-2018-1149Remote Code Execution in NUUO NVRMini2 cgi_systemExploited in the wild

via anomali bloganomali.com

CVE-2018-9866Remote Code Execution in SonicWall Global Management System XML-RPCExploited in the wild

via anomali bloganomali.com

CVE-2016-0792Jenkins Remote API XML Deserialization RCEExploited in the wild

via anomali bloganomali.com

CVE-2015-2051D-Link DIR-645 HNAP SOAPAction Command InjectionExploited in the wild

via anomali bloganomali.com

CVE-2017-6884Command Injection in Zyxel EMG2926 nslookup Diagnostic FunctionExploited in the wild

via anomali bloganomali.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

“Rabbot… can also target and infect Internet-of-Things (IoT) devices via known vulnerabilities… CVE-2018-1149, CVE-2018-9866, CVE-2017-6884, CVE-2016-0792, CVE-2015-2051 …”

Execution

1 technique

T1059.007JavaScriptEvidence1

Persistence

1 technique

T1037.004RC ScriptsEvidence1

“gain persistence… through ‘rc.local’ files and ‘.bashrc’ files.”

Privilege Escalation

1 technique

T1037.004RC ScriptsEvidence1

“gain persistence… through ‘rc.local’ files and ‘.bashrc’ files.”

Stealth

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

“The first two authentication certifications are to ensure that the malware is not in a ‘honey pot’. This is likely to avoid static analysis of the malware.”

Credential Access

1 technique

T1110Brute ForceEvidence1

“SSH brute force… brute force SSH passwords… authentication utilizing a list of hard-coded credentials it has.”

Discovery

2 techniques

T1046Network Service DiscoveryEvidence1

“check to see if an SSH server is listening on Port 22. The malware will open a socket to see if it receives a response…”

T1497Virtualization/Sandbox EvasionEvidence1

“The first two authentication certifications are to ensure that the malware is not in a ‘honey pot’. This is likely to avoid static analysis of the malware.”

Command and Control

2 techniques

T1090.003Multi-hop ProxyEvidence1

T1105Ingress Tool TransferEvidence1

“payload… sent from the C2 server as an encoded URL parameter… Rabbot will send all its payloads through an open port 80 to the Linux (web)servers”

Impact

1 technique

T1496Resource HijackingEvidence1

“goal… install cryptocurrency miners… attempts to install both ‘CNRig’ and ‘CoinHive’ Monero miners… inject CoinHive script tags into every HTML file…”

INDICATORS OF COMPROMISE

IOCs tracked for this family

35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

35 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app8 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

anomali blogNews

Dec 6, 2018

Pulling Linux Rabbit/Rabbot Malware Out of a Hat

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching35

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities5

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.