Dota

Below are the Outlaw TTPs identified from our malware analysis. Persistence Scheduled Task/Job: Cron T1053.003

After the initial SSH compromise, the threat actor downloads the first-stage script, tddwrt7s.sh, using utilities like wget or curl... Below is the sequence of commands performed by the attacker to obtain and decompress this file...

Below are the Outlaw TTPs identified from our malware analysis. Persistence Scheduled Task/Job: Cron T1053.003

We identified an odd authorized SSH key... For persistence purposes, the attackers used the following command to wipe the existing SSH setup, create a clean .ssh folder, add a new public key for SSH access, and lock down permissions.

Below are the Outlaw TTPs identified from our malware analysis. Persistence Scheduled Task/Job: Cron T1053.003

We identified an odd authorized SSH key... For persistence purposes, the attackers used the following command to wipe the existing SSH setup, create a clean .ssh folder, add a new public key for SSH access, and lock down permissions.

The next-stage malware is a Base64-encoded string inside the b/run script that, once decoded, reveals another level of obfuscation: this time an obfuscated Perl script.

Another file from the hidden directory, a/kswapd0, is an ELF packed using UPX...

For persistence purposes, the attackers used the following command to wipe the existing SSH setup... cd ~ && rm -rf .ssh && mkdir .ssh ...

After the decompression, a hidden directory, named '.configrc5', was created in the user’s home directory...

...add a new public key for SSH access, and lock down permissions... chmod -R go= ~/.ssh

Outlaw... typically takes advantage of weak or default SSH credentials for its operations... Since Outlaw exploits weak or default SSH passwords... rate limiting adds another solid layer of protection against brute force.

Below are the Outlaw TTPs identified from our malware analysis... Discovery System Owner/User Discovery T1033

Below are the Outlaw TTPs identified from our malware analysis... Discovery System Network Connections Discovery T1049

The script also monitors running processes, identifies any that use 40% or more CPU by executing the command ps axf -o "pid %cpu"...

Below are the Outlaw TTPs identified from our malware analysis... Discovery System Information Discovery T1082

Below are the Outlaw TTPs identified from our malware analysis... Discovery Account Discovery T1087

Outlaw... typically takes advantage of weak or default SSH credentials for its operations... After the initial SSH compromise...

Below are the Outlaw TTPs identified from our malware analysis... Collection Data from Local System T1005

This Perl script is an IRC-based botnet client... By default, it connects to a hardcoded IRC server over port 443 using randomly generated nicknames, joining predefined channels to await commands...

After the initial SSH compromise, the threat actor downloads the first-stage script, tddwrt7s.sh, using utilities like wget or curl. This artifact is responsible for downloading the dota.tar.gz file from the attackers’ server.

The bot supports a range of malicious features including command execution, DDoS attacks, port scans, file download, and upload via HTTP.

Interestingly enough, one of the first execution steps is checking if other known miners are present on the machine... If any miners are found, the script tries to kill and block their execution.

...this binary is a malicious modified version of XMRig (6.19.0), a cryptocurrency miner... configured to mine Monero using the CPU only... The miner runs in the background, configured for high CPU usage.