Ebury

Senakh admitted that he supported the criminal enterprise by creating accounts with domain registrars which helped build the Ebury botnet infrastructure

allowing Senakh and his co-conspirators to create and operate a botnet comprising tens of thousands of infected servers throughout the world

We’ve seen that the servers we’ve fixed have been misused for distribution of malware, SPAM and, in some cases, to steal credit cards on compromised web servers used for e-commerce.

used the Ebury botnet to generate and redirect internet traffic in furtherance of various click-fraud and spam e-mail schemes

We’ve seen that the servers we’ve fixed have been misused for distribution of malware, SPAM and, in some cases, to steal credit cards on compromised web servers used for e-commerce.

Redirected requests would hit DNS servers under the control of Windigo’s operators... These usually hosted exploit kits. Upon successful exploitation, Glupteba would be installed.

One can use the following command to determine if the server he is on is compromised: ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected" | At the time of writing, the following command starts a shell free from the Ebury rootkit: H=1 LD_DEBUG="" LD_PRELOAD="" "$SHELL"

Trojanized sshd, ssh, ssh-add and the target of the libkeyutils.so.1 symbolic link.

Ebury uses an abstract UNIX socket to communicate with an external process that will be responsible for data exfiltration.

Trojanized sshd, ssh, ssh-add and the target of the libkeyutils.so.1 symbolic link. | Replacing libkeyutils.so, a library loaded by OpenSSH, with a trojanized version... Patching libkeyutils.so to load libXXX.so instead of the libc.so.6 library.

Replacing libkeyutils.so, a library loaded by OpenSSH, with a trojanized version.

The permanently running process listening to this UNIX socket is started by loading the Ebury payload into a legitimate executable using LD_PRELOAD. | Since Ebury inject itself using the dynamic linker LD_PRELOAD environment variable... If libkeyutils is loaded in some process where it shouldn’t be, it is very likely that the system is infected with a rootkit-enabled version of Ebury.

Senakh and his co-conspirators used the Ebury botnet to generate and redirect internet traffic in furtherance of various click-fraud and spam e-mail schemes

It goes through many evolutions, including our joint analysis of CDORKED on 2013 and the SSH backdoors.

Ebury starts a process to keep state information and perform credential exfiltration... Ebury operators are known to connect daily to compromised systems using the Ebury backdoor to retrieve stolen credentials.

Attackers can introduce custom modules or modify existing configurations to manipulate authentication flows, capture credentials, grant unauthorized access, or execute malicious code.

To determine whether a system is compromised by Ebury, make sure you do so from a trusted shell. At the time of writing, the following command starts a shell free from the Ebury rootkit: | In case your machine is infected with an Ebury version with the userland rootkit...

An SSH connection enabling the Ebury backdoor contains hexadecimal-encoded data (for Ebury before version 1.7) or base64-encoded data (for Ebury version 1.7 and later, first seen in 2019). Since version 1.8, spaces are ignored.

The permanently running process listening to this UNIX socket is started by loading the Ebury payload into a legitimate executable using LD_PRELOAD. Abused legitimate processes include: /bin/hostname, /bin/sync, /sbin/auditd, /sbin/rsyslogd... | Abused legitimate processes include: /bin/hostname, /bin/sync, /sbin/auditd, /sbin/rsyslogd, /sbin/udevd...

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

Senakh and his co-conspirators used the Ebury botnet to generate and redirect internet traffic in furtherance of various click-fraud and spam e-mail schemes

Trojanized sshd, ssh, ssh-add and the target of the libkeyutils.so.1 symbolic link. | Replacing libkeyutils.so, a library loaded by OpenSSH, with a trojanized version... Patching libkeyutils.so to load libXXX.so instead of the libc.so.6 library.

Replacing libkeyutils.so, a library loaded by OpenSSH, with a trojanized version.

The permanently running process listening to this UNIX socket is started by loading the Ebury payload into a legitimate executable using LD_PRELOAD. | Since Ebury inject itself using the dynamic linker LD_PRELOAD environment variable... If libkeyutils is loaded in some process where it shouldn’t be, it is very likely that the system is infected with a rootkit-enabled version of Ebury.

Ebury starts a process to keep state information and perform credential exfiltration... Ebury operators are known to connect daily to compromised systems using the Ebury backdoor to retrieve stolen credentials.

Attackers can introduce custom modules or modify existing configurations to manipulate authentication flows, capture credentials, grant unauthorized access, or execute malicious code.

HTTP POST requests made to, and from, the servers are leveraged to steal financial details from transactional websites.

the malware, which is known as Ebury, harvested log-on credentials from infected computer servers

Ebury starts a process to keep state information and perform credential exfiltration... Ebury operators are known to connect daily to compromised systems using the Ebury backdoor to retrieve stolen credentials.

Attackers can introduce custom modules or modify existing configurations to manipulate authentication flows, capture credentials, grant unauthorized access, or execute malicious code.

Another interesting method is the use of adversary in the middle to intercept SSH traffic of interesting targets inside data centers and redirect it to a server used to capture credentials.

Ebury operators leverage existing Ebury-compromised servers in the same network segment as their target to perform ARP spoofing.

Since Ebury version 1.5, Ebury starts a process to keep state information and perform credential exfiltration.

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Among the targets are Bitcoin and Ethereum nodes. Ebury automatically steals cryptocurrency wallets hosted on the targeted server once the victim types the password to log into it.

Another interesting method is the use of adversary in the middle to intercept SSH traffic of interesting targets inside data centers and redirect it to a server used to capture credentials.

Ebury operators leverage existing Ebury-compromised servers in the same network segment as their target to perform ARP spoofing.

Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.

The Ebury backdoor is activated by including specific information in the SSH client identification string... An SSH connection enabling the Ebury backdoor contains hexadecimal-encoded data... or base64-encoded data. | The Ebury backdoor is activated by including specific information in the SSH client identification string... Since it is sent before the SSH handshake and key exchange are performed, it is unencrypted.

APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.

Ebury operators are known to connect daily to compromised systems using the Ebury backdoor to retrieve stolen credentials and system information such as known hosts and users who last connected to the system. | The following domains are used to exfiltrate HTTP POST requests over HTTP or HTTPS.

The following domains are used to exfiltrate HTTP POST requests over HTTP or HTTPS.

To find the server to send this data to, a DNS request is made for the TXT record of a subdomain... The IP address is decrypted from the TXT record. | Linux/Onimiki is a DNS server backdoor. These rules will alert on either inbound or outbound DNS requests with the specific Linux/Cdorked URL pattern... Since Perl/Calfbot uses HTTPS... these rules will match specific DNS requests.

Senakh and his co-conspirators used the Ebury botnet to generate and redirect internet traffic in furtherance of various click-fraud and spam e-mail schemes

To find the server to send this data to, a DNS request is made for the TXT record of a subdomain of one of the following domains... First domain of the sixth iteration of the DGA. | First domain of the sixth iteration of the DGA... First domain of the fifth iteration of the DGA... Below is the list of domains generated by the DGA for each seed by DGA generation.

Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

ADVSTORESHELL exfiltrates data over the same channel used for C2.

Ebury can exfiltrate SSH credentials through custom DNS queries.

Under certain circumstances, Ebury tries to exfiltrate intercepted credentials by sending an encrypted UDP packet using port 53 (conventionally DNS) as the destination port.