The "Hajime" botnet network 6 years ago..

This post I have written and saved for quite a long time, and I think it is save to publish it now for the educational and knowledge purpose in Linux malware analysis field.
One we might think this infection is low in priority, but I just want to share what I saw back then and you may want to re-consider about that thought.
By the way, I will update with more IOC but right now kindly please bear with a good reading. This is a true story, true situation and analysis. Better late then never..

The infection was this bad (see picture below):

Evasion techniques

Evasion points:

• Hexstring-pushing scheme to do initial execution on a pushed binary
• The pushed binary is not compromising payload host info
• Usage of socketcall is evading tracing scanner scheme
• Socket level operation to download payload is not necessary to HTTP servers
• Downloader is deleted after dropping payload
• Packed payload with custom packer
• Modular config for general operational purpose (undisclosed)
• Usage of "*atk" spread module (undisclosed)
• Three methods in propagation with P2P method (undisclosed)
• Better design flow than skids IoT malware (undisclosed)

The downloading process in detail

The infection

Three methods propagation with (1) tftp and (2) wget http (IP and port are visible), and (3) the hexstring-pushing method for small downloader. (1) and (2) is obviously direct packed payload downloading, this TLP RED report will elaborate the (3)rd method.

The hexstring-pushed binary, 480 bytes

Its ELF header

Sections shows how it built

Socketcall trick & C2 IP/port is non-textual(hex)

Cracking C2 info

How to check payloads & PoC of downloading stream

Socketcall is avoiding ptrace too

And the payloads is..

The ELF in 80280 bytes, packed :) here we go again!

Understanding how it is packed..okay, R2CON2018 ways is effective.

Unpacked it as per R2CON2018,here we are..BEFORE (see no strings intact) and AFTER..

It shows itself, the Hajime :) #w000t!

The unpacked ELF strings are these:

0x1ea28 24 5 des
0x2797b 9 8 6:nodes6
0x27984 8 7 4:wantl
0x2798c 7 6 1:y1:r
0x27993 7 6 1:y1:e
0x2799a 7 6 1:y1:q
0x279a1 10 9 1:q4:ping
0x279ab 15 14 1:q9:find_node
0x279ba 15 14 1:q9:get_peers
0x279c9 20 19 1:q13:announce_peer
0x279dd 28 27 Get_peers with no info_hash
0x279f9 32 31 Announce_peer with no info_hash
0x27a19 31 30 Announce_peer with wrong token
0x27a38 41 40 Announce_peer with forbidden port number
0x27a61 13 12 d1:rd2:id20:
0x27a72 8 7 0.0.0.0
0x27a7d 5 4 6881
0x27a82 16 15 /proc/net/route
0x27a92 43 42 %8s %8s %8s %d %*d %*d %*d %8s %*d %*d %*d
0x27ac5 45 44 iptables -I INPUT -p %s --dport %s -j ACCEPT
0x27af2 5 4 %02x
0x27af7 18 17 %d-%d-%d-%d-%d-%s
0x27b09 9 8 [%s]:%hu
0x27b12 7 6 %s:%hu
0x27b19 18 17 
0x27b2d 7 6 /proc/
0x27b34 7 6 [1-9]*
0x27b62 5 4 8IXr
0x27b75 8 7 ./.p/%s
0x27b7d 12 11 ./.p/config
0x27b89 7 6 upload
0x27b94 5 4 ./.p
0x27b99 13 12 pool.ntp.org
0x27baa 7 6 ./fifo
0x27d11 17 16 expand 32-byte k
0x280b8 15 14 /proc/%u/fd/%s
0x280c7 9 8 socket:[
0x280d0 8 7 [0000]:
0x280d8 17 16 /proc/%s/cmdline
0x280ec 78 77 %*d: %*[0-9A-Fa-f]:%X %*[0-9A-Fa-f]:%X %*X %*lX:%*lX %*X:%*X %*X %*d %*d %lu
0x2813a 7 6 sermgr
0x28141 6 5 /proc
0x28147 14 13 /proc/net/tcp
0x28155 15 14 /proc/net/tcp6
0x28164 55 54 iptables -A INPUT -p tcp --destination-port %d -j DROP
0x2819b 29 28 iptables -D INPUT -j CWMP_CR
0x281b8 20 19 iptables -X CWMP_CR
0x281cc 18 17 /tmp/ftpupdate.sh
0x281de 10 9 /dev/null
0x281e8 18 17 /tmp/ftpupload.sh
0x281fa 14 13 /dev/watchdog
0x28208 19 18 /dev/misc/watchdog
0x2821b 11 10 telnetd
0x28226 5 4 ./.i
0x2822b 7 6 config
0x282e2 37 36 modules]\n[peers]\nrouter.utorrent.com
0x28308 5 4 8bit
0x2831f 6 5 %s.%d
0x28325 5 4 arm7
0x2832a 5 4 ./%s
0x2832f 10 9 [modules]
0x28339 8 7 [peers]
0x28341 7 6 [info]
0x2834c 8 7 ./.p/.d
0x28462 16 7 \a\b\t\n\v\f\r
0x28494 192 95  !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~
0x28654 16 15 POSIXLY_CORRECT
0x28664 6 5 alnum
0x2866a 6 5 alpha
0x28670 6 5 blank
0x28676 6 5 cntrl
0x2867c 6 5 graph
0x28682 6 5 lower
0x28688 6 5 print
0x2868e 6 5 punct
0x28694 6 5 space
0x2869a 6 5 upper
0x286a0 7 6 xdigit
0x286a7 73 72 SunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDec??? ??? 0\f 0\b:0
0x286f3 7 6  ????\n
0x28710 16 15 ,M4.1.0,M10.5.0
0x28720 16 15 ,M3.2.0,M11.1.0
0x28730 8 7 /etc/TZ
0x28738 15 14 /etc/localtime
0x28747 5 4 TZif
0x28770 12 11 ""##$$$%%&&
0x2877e 6 5 \b\n\n\n+
0x2878e 6 5 (nil)
0x28794 7 6 (null)
0x2879c 9 8 hlLjztqZ
0x287fe 21 20 npxXoudifFeEgGaACScs
0x28813 8 7  +0-#'I
0x2881b 22 21 Unknown error Success
0x28831 24 23 Operation not permitted
0x28849 26 25 No such file or directory
0x28863 16 15 No such process
0x28873 24 23 Interrupted system call
0x2888b 19 18 Input/output error
0x2889e 26 25 No such device or address
0x288b8 23 22 Argument list too long
0x288cf 18 17 Exec format error
0x288e1 20 19 Bad file descriptor
0x288f5 19 18 No child processes
0x28908 33 32 Resource temporarily unavailable
0x28929 23 22 Cannot allocate memory
0x28940 18 17 Permission denied
0x28952 12 11 Bad address
0x2895e 22 21 Block device required
0x28974 24 23 Device or resource busy
0x2898c 12 11 File exists
0x28998 26 25 Invalid cross-device link
0x289b2 15 14 No such device
0x289c1 16 15 Not a directory
0x289d1 15 14 Is a directory
0x289e0 17 16 Invalid argument
0x289f1 30 29 Too many open files in system
0x28a0f 20 19 Too many open files
0x28a23 31 30 Inappropriate ioctl for device
0x28a42 15 14 Text file busy
0x28a51 15 14 File too large
0x28a60 24 23 No space left on device
0x28a78 13 12 Illegal seek
0x28a85 22 21 Read-only file system
0x28a9b 15 14 Too many links
0x28aaa 12 11 Broken pipe
0x28ab6 33 32 Numerical argument out of domain
0x28ad7 30 29 Numerical result out of range
0x28af5 26 25 Resource deadlock avoided
0x28b0f 19 18 File name too long
0x28b22 19 18 No locks available
0x28b35 25 24 Function not implemented
0x28b4e 20 19 Directory not empty
0x28b62 34 33 Too many levels of symbolic links
0x28b85 27 26 No message of desired type
0x28ba0 19 18 Identifier removed
0x28bb3 28 27 Channel number out of range
0x28bcf 25 24 Level 2 not synchronized
0x28be8 15 14 Level 3 halted
0x28bf7 14 13 Level 3 reset
0x28c05 25 24 Link number out of range
0x28c1e 29 28 Protocol driver not attached
0x28c3b 27 26 No CSI structure available
0x28c56 15 14 Level 2 halted
0x28c65 17 16 Invalid exchange
0x28c76 27 26 Invalid request descriptor
0x28c91 14 13 Exchange full
0x28c9f 9 8 No anode
0x28ca8 21 20 Invalid request code
0x28cbd 13 12 Invalid slot
0x28ccb 21 20 Bad font file format
0x28ce0 20 19 Device not a stream
0x28cf4 18 17 No data available
0x28d06 14 13 Timer expired
0x28d14 25 24 Out of streams resources
0x28d2d 30 29 Machine is not on the network
0x28d4b 22 21 Package not installed
0x28d61 17 16 Object is remote
0x28d72 22 21 Link has been severed
0x28d88 16 15 Advertise error
0x28d98 14 13 Srmount error
0x28da6 28 27 Communication error on send
0x28dc2 15 14 Protocol error
0x28dd1 19 18 Multihop attempted
0x28de4 19 18 RFS specific error
0x28df7 12 11 Bad message
0x28e03 38 37 Value too large for defined data type
0x28e29 27 26 Name not unique on network
0x28e44 29 28 File descriptor in bad state
0x28e61 23 22 Remote address changed
0x28e78 39 38 Can not access a needed shared library
0x28e9f 37 36 Accessing a corrupted shared library
0x28ec4 32 31 .lib section in a.out corrupted
0x28ee4 48 47 Attempting to link in too many shared libraries
0x28f14 38 37 Cannot exec a shared library directly
0x28f3a 50 49 Invalid or incomplete multibyte or wide character
0x28f6c 44 43 Interrupted system call should be restarted
0x28f98 19 18 Streams pipe error
0x28fab 15 14 Too many users
0x28fba 31 30 Socket operation on non-socket
0x28fd9 29 28 Destination address required
0x28ff6 17 16 Message too long
0x29007 31 30 Protocol wrong type for socket
0x29026 23 22 Protocol not available
0x2903d 23 22 Protocol not supported
0x29054 26 25 Socket type not supported
0x2906e 24 23 Operation not supported
0x29086 30 29 Protocol family not supported
0x290a4 41 40 Address family not supported by protocol
0x290cd 23 22 Address already in use
0x290e4 32 31 Cannot assign requested address
0x29104 16 15 Network is down
0x29114 23 22 Network is unreachable
0x2912b 36 35 Network dropped connection on reset
0x2914f 33 32 Software caused connection abort
0x29170 25 24 Connection reset by peer
0x29189 26 25 No buffer space available
0x291a3 40 39 Transport endpoint is already connected
0x291cb 36 35 Transport endpoint is not connected
0x291ef 46 45 Cannot send after transport endpoint shutdown
0x2921d 35 34 Too many references: cannot splice
0x29240 21 20 Connection timed out
0x29255 19 18 Connection refused
0x29268 13 12 Host is down
0x29275 17 16 No route to host
0x29286 30 29 Operation already in progress
0x292a4 26 25 Operation now in progress
0x292be 22 21 Stale NFS file handle
0x292d4 25 24 Structure needs cleaning
0x292ed 28 27 Not a XENIX named type file
0x29309 30 29 No XENIX semaphores available
0x29327 21 20 Is a named type file
0x2933c 17 16 Remote I/O error
0x2934d 20 19 Disk quota exceeded
0x29361 16 15 No medium found
0x29371 18 17 Wrong medium type
0x293a6 14 13 /etc/gai.conf
0x293b4 11 10 precedence
0x293c6 17 16 0123456789abcdef
0x293f8 25 24 %u.%u.%u.%u.in-addr.arpa
0x29411 7 6 %x.%x.
0x29418 9 8 ip6.arpa
0x29425 11 10 /proc/stat
0x29430 14 13 /proc/cpuinfo
0x2943e 10 9 processor
0x29448 24 23 /sys/devices/system/cpu
0x29460 8 7 /bin/sh
0x2946b 7 6 exit 0
0x297f5 5 4 O8M2
0x29807 5 4 uinf
0x29820 8 7 hlLjztq
0x2984a 24 23 npxXoudifFeEgGaACSnmcs[
0x29869 8 7 nfinity
0x29880 14 13 /etc/services
0x2988e 5 4 # \t/
0x298a4 17 16 /etc/resolv.conf
0x298b5 11 10 nameserver
0x298c0 7 6 domain
0x298c7 7 6 search
0x298ce 8 7 options
0x298d6 8 7 timeout
0x298de 9 8 attempts
0x298ec 10 9 \ninfinity
0x298fc 11 10 /etc/hosts

Many evasion & more advanced than youngster made malware :)
No wonder way back then grew to be a big botnet.

(bows)

@unixfreaxjp - malwaremustdie.org