Enemybot

It uses a list of hardcoded username/password combinations to login into devices in the attempt to access systems using weak or default credentials.

The bot also tries to run shell commands to infect misconfigured Android devices that expose Android Debug Bridge port (5555).

EnemyBot is selfpropagating by scanning pseudo-random IP ranges for known vulnerabilities.

Once exploited one of the above flaws, the bot runs a shell command to download a shell script from a URL that is dynamically updated by the C2 using the command LDSERVER.

CVE-2022-22954, a remote code execution (RCE) vulnerability due to server-side template injection in VMware Workspace ONE Access and Identity Manager, is trivial to exploit with a single HTTP request to a vulnerable device.

It uses a list of hardcoded username/password combinations to login into devices in the attempt to access systems using weak or default credentials.

The bot also tries to run shell commands to infect misconfigured Android devices that expose Android Debug Bridge port (5555).

It uses a list of hardcoded username/password combinations to login into devices in the attempt to access systems using weak or default credentials.

The message was stored as cleartext in earlier samples, new samples were released with the message encoded with an XOR operation using a multiple-byte key.

Each line of the script attempts to download (again using various methods), set permissions to execute (777), execute from /tmp/ and then delete the original ELF binary.

It uses a list of hardcoded username/password combinations to login into devices in the attempt to access systems using weak or default credentials.

Dynamic Analysis of the EnemyBot malware did not provide anything useful as the malware seems to have killed itself soon after execution. There appear to be some baked-in counter forensics that kill the application based on certain detected process names.

The malware also initiates system checks to determine whether or not the malware is already running. After the instance starts there are two possible outputs: “Determined we already have a instance running…” “Binded and listen on address %d.%d.%d.%d.\n”

At the same time, Mirai killed other processes running at TCP ports 23 and 2323 together with any possible competing Mirai variants.

Mirai attempted a brute-force attack with a pre-configured list of known factory defaults and most commonly used credentials.

“Stateless” TCP SYN probes to pseudorandom IPs on Telnet ports 23 and 2323 Once targets were identified, Mirai attempted a brute-force attack...

Scrubbing the file in a decompile, it appears to feature a host of networking options such as port scanners, TCP/UDP flood options and general system enumeration.

Dynamic Analysis of the EnemyBot malware did not provide anything useful as the malware seems to have killed itself soon after execution. There appear to be some baked-in counter forensics that kill the application based on certain detected process names.

The malware also initiates system checks to determine whether or not the malware is already running. After the instance starts there are two possible outputs: “Determined we already have a instance running…” “Binded and listen on address %d.%d.%d.%d.\n”

Mapped to MITRE ATT&CK The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques: TA0008: Lateral Movement: T1210: Exploitation of Remote Services T1021: Remote Services

Mapped to MITRE ATT&CK The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques: TA0008: Lateral Movement: T1210: Exploitation of Remote Services

Mapped to MITRE ATT&CK The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques: TA0011: Command and Control T1132: Data Encoding T1001: Data Obfuscation

Once the bot has been installed on a device, it connects to its C2 server and waits for further commands

it connects to a command-and-control (C2) server that is hidden in the Tor network, making its takedown more complicated.

Then the script downloads the actual Enemybot binary which is compiled for the target device’s architecture.

Mapped to MITRE ATT&CK The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques: TA0011: Command and Control T1132: Data Encoding

Once established and having removed all possible interference, it was ready to wait for C2 commands, while constantly scanning for new victims...

T1030: Proxy: 003: Multi-hop Proxy

The EnemyBot malware also appears to have the ability to steal data via HTTP POST, which in our case, the malware was sending the data back to the original IP address.

Mirai managed to keep 200,000 – 300,000 enslaved devices and peaked at an unbelievable 600,000... FBI special agents compared Mirai’s 1+ Tbps (1,000 Gbps)... The first Mirai incident was reported after the 18th Sep 2016 attack against popular Minecraft servers hosted on French service OVH.