Outlaw

Following successful SSH brute-force authentication, the malware replaces the existing SSH authorized_keys file with a new version containing a malicious SSH public key... The malware then changes the user credentials for the authenticated account by entering a new password using the passwd utility.

In both scripts, the malware installs cron jobs that execute its binaries at regular intervals and on system reboots.

The attack starts when tddwrt7s.sh downloads the dota3.tar.gz package from a C2 server. The extracted initall.sh script executes, kicking off the infection chain.

The run script contains three base64-encoded blobs, which are piped to perl ... Upon base64 decoding, obfuscated perl scripts are identified.

In both scripts, the malware installs cron jobs that execute its binaries at regular intervals and on system reboots.

Following successful SSH brute-force authentication, the malware replaces the existing SSH authorized_keys file with a new version containing a malicious SSH public key... The malware then changes the user credentials for the authenticated account by entering a new password using the passwd utility.

Once access is gained, it changes the user’s password for persistent access.

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions.

If the file does not exist, it enables MSR writes through the modprobe msr allow_writes=on command.

In both scripts, the malware installs cron jobs that execute its binaries at regular intervals and on system reboots.

Following successful SSH brute-force authentication, the malware replaces the existing SSH authorized_keys file with a new version containing a malicious SSH public key... The malware then changes the user credentials for the authenticated account by entering a new password using the passwd utility.

Once access is gained, it changes the user’s password for persistent access.

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions.

If the file does not exist, it enables MSR writes through the modprobe msr allow_writes=on command.

These init scripts all use variable-based string concatenation obfuscation, where commands are split into small variable fragments that are dynamically concatenated and executed.

The malware's binaries are packed with UPX, reducing their size and altering their signature to evade traditional malware detection.

Following successful SSH brute-force authentication, the malware replaces the existing SSH authorized_keys file with a new version containing a malicious SSH public key... The malware then changes the user credentials for the authenticated account by entering a new password using the passwd utility.

The run script contains three base64-encoded blobs, which are piped to perl.

The primary execution path installs the malware in the hidden directory ~/.configrc6.

The script ends off with installing its own SSH public key for persistent access, setting restrictive permissions, and making the directory immutable to prevent modification through chattr.

The script grants execution permissions to the upd file and '777' permissions to all files in its folder. The malware also uses chattr +ia to prevent modification.

OUTLAW gains initial access through opportunistic SSH brute-forcing, targeting systems with weak or default credentials. The malware employs its blitz component... to perform high-volume scanning and password-guessing attempts.

OUTLAW gains initial access through opportunistic SSH brute-forcing, targeting systems with weak or default credentials.

Once access is gained, it executes system reconnaissance commands, collecting user privileges.

The malware scans the local subnet of newly compromised systems, identifying additional SSH-accessible machines to attack.

The attacker immediately performed basic reconnaissance by running the w command to check who was logged in and then executing ps to see what processes were running.

The malware executes various commands to collect details about the system’s CPU, user privileges, operating system, memory usage, and available binaries.

BLITZ systematically scans for and compromises systems with weak or default SSH credentials.

Upon successful authentication, Blitz logs attack details into a 'v' file.

This data is stored in a simple text file before being uploaded to a C2 server... Upon successful authentication, Blitz logs attack details into a 'v' file.

SHELLBOT scripts operate as IRC-based backdoors, allowing attackers to remotely control infected machines via predefined commands sent through an IRC channel.

STEALTH SHELLBOT for remote control via IRC C2... SHELLBOT scripts operate as IRC-based backdoors, allowing attackers to remotely control infected machines via predefined commands sent through an IRC channel.

kswapd01 establishes a new connection by launching a fresh socat process to listen on the local machine and forward traffic to a remote server, typically on port 4444.

tddwrt7s.sh downloads the dota3.tar.gz package from a C2 server.

Exfiltration occurs when OUTLAW initiates an outbound SSH connection via sftp-server to transfer the collected information to a predefined C2 server.

kswapd0 is a maliciously modified copy of the legitimate XMRig cryptocurrency miner.

The malware ensures dominance by killing competing brute-forcers and miners... the run script will start the stop script, which is a typical script that bring down the defenses of any known miner configurations any known miner configurations and kill any known miner processes

The run script will start the stop script, which is a typical script that bring down the defenses of any known miner configurations and kill any known miner processes.