Gateway to Intrusion: Malware Delivery Via Open Directories

Published on

Published on

Published on

Oct 31, 2023

Oct 31, 2023

Oct 31, 2023

Gateway to Intrusion: Malware Delivery Via Open Directories
Gateway to Intrusion: Malware Delivery Via Open Directories
Gateway to Intrusion: Malware Delivery Via Open Directories
Gateway to Intrusion: Malware Delivery Via Open Directories

Gateway to Intrusion: Malware Delivery Via Open Directories

Attackers constantly devise new and sophisticated methods of delivering malware to infiltrate systems and exfiltrate data. For some actors, these threats lurk in dark corners of the internet, behind multiple proxies, or even utilizing previously compromised hosts to initiate attacks.

In other cases, these threats hide in plain sight, using open directories as a gateway to deliver malware to their victims.

Hunt constantly crawls the internet for open directories, downloading every file on the server, including scripts, which defenders can read (thanks to Hunt) without opening the file.

In this post, I'll provide two recent examples exploring how threat actors leverage open directories to deliver malware to computer systems.

AsyncRAT & BITS

Recently, Hunt identified a malicious IP address serving AsyncRAT that hosted two files in an open directory.

httpshuntioimagesblogsblog-8img-1-2xwebpFigure 1: Results of Hunt crawling the open directory at 207.32.217[.]21.

Little thought went into naming the files, which could have given us an idea of the actor's intent.

Clicking on the magnifying glass under the "Actions" tab will open a smaller window, allowing us to read the file.

httpshuntioimagesblogsblog-8img-2-2xwebpFigure 2: Contents of xx.txt

xx.txt contains VBScript, which does the following:

1 Creates an XML file containing a PowerShell command, saving the file to the system as "temp.xml."

2 Extracts the content within the "" section of the XML file and uses Microsoft BITS (Background Intelligent Transfer Service) to download the file "f.jpg" from the same server.

3 Remove all traces of "temp.xml" from the system using the FileSystemObject command

Naming a file "xx.txt" presumably indicates a placeholder, which the actor may rename uniquely for each campaign or target. Likely, delivery methods could include attaching the text file in a crafted email or as a series of files offered to the victim by other means.

Let's move to a VM and see what's behind f.jpg.

httpshuntioimagesblogsblog-8img-3-2xwebpFigure 3: Detect it Easy results of f.jpg

f.jpg is a zip file containing 9 additional files. We'll keep digging from here, unzip the file, and see what we find.

httpshuntioimagesblogsblog-8img-4-2xwebpFigure 4: Contents of f.jpg

Let's wrap up this first example. If you are analyzing the files at home, let me know what you found.

Python Executable Wrapped in Fernet

The second case is a malicious IP Hunt detected as hosting a login page for Supershell, an open-source C2 platform, and two more files in an open directory.

httpshuntioimagesblogsblog-8img-5-2xwebpFigure 5: Hunt results of open directory at 121.37.21[.]229

Once again, we have some rather dull file names. 1.exe is rather large at 10 MB, but let's look at a.txt.

httpshuntioimagesblogsblog-8img-6-2xwebpFigure 6: Encoded/encrypted data of a.txt.

The text in the file is encoded or encrypted; we just don't know with what algorithm yet.

Even with a 10MB file, phishing remains a viable delivery method, in addition to hosting the file somewhere as a popular tool for download.

Moving back to our VM, let's look at 1. exe.

httpshuntioimagesblogsblog-8img-7-2xwebpFigure 7: Detect it Easy results of 1.exe

Let's skip forward and cover the compiled Python files extracted from the executable.

httpshuntioimagesblogsblog-8img-8-2xwebpFigure 8: Decompiled code of b.pyc and interesting stringhttpshuntioimagesblogsblog-8img-9-2xwebpFigure 9: decrypted code from a.txt

From Figures 8 & 9, we can see that 1.exe:

  1. Defines a key using the Fernet encryption scheme to decrypt "sectr" stored in "destr."

  2. The inner function, "A" executes the "destr" value.

  3. "T2" Base64 encodes a message in Chinese twice.

  4. "T1" implements the QuickSort algorithm.

  5. Function "00619654()" makes a GET request and downloads a.txt from the open directory, then tries to run the "06936762() function.

From Figures 8 & 9, we can see that 1.exe:

Note: I couldn't find the message in string "t2" used in other malicious code. If you've seen it used before, feel free to reach out on X (Twitter).

As we can see in Figure 9, the result of a.txt is a Python script that decrypts shellcode (encrypted with Fernet) in memory and executes it.

VirusTotal and Triage detect 1.exe and the shellcode as part of the Cobalt Strike penetration testing tool.

Conclusion

As we've explored, exposed directories serve as a common vector for malware delivery and the subsequent loading of additional malicious components. Often overlooked due to the plethora of malware found in directories, it is crucial that we, as defenders, remember that these servers can be the beginning of a bad day for our network.

For further hunting, here are more examples:

Attackers constantly devise new and sophisticated methods of delivering malware to infiltrate systems and exfiltrate data. For some actors, these threats lurk in dark corners of the internet, behind multiple proxies, or even utilizing previously compromised hosts to initiate attacks.

In other cases, these threats hide in plain sight, using open directories as a gateway to deliver malware to their victims.

Hunt constantly crawls the internet for open directories, downloading every file on the server, including scripts, which defenders can read (thanks to Hunt) without opening the file.

In this post, I'll provide two recent examples exploring how threat actors leverage open directories to deliver malware to computer systems.

AsyncRAT & BITS

Recently, Hunt identified a malicious IP address serving AsyncRAT that hosted two files in an open directory.

httpshuntioimagesblogsblog-8img-1-2xwebpFigure 1: Results of Hunt crawling the open directory at 207.32.217[.]21.

Little thought went into naming the files, which could have given us an idea of the actor's intent.

Clicking on the magnifying glass under the "Actions" tab will open a smaller window, allowing us to read the file.

httpshuntioimagesblogsblog-8img-2-2xwebpFigure 2: Contents of xx.txt

xx.txt contains VBScript, which does the following:

1 Creates an XML file containing a PowerShell command, saving the file to the system as "temp.xml."

2 Extracts the content within the "" section of the XML file and uses Microsoft BITS (Background Intelligent Transfer Service) to download the file "f.jpg" from the same server.

3 Remove all traces of "temp.xml" from the system using the FileSystemObject command

Naming a file "xx.txt" presumably indicates a placeholder, which the actor may rename uniquely for each campaign or target. Likely, delivery methods could include attaching the text file in a crafted email or as a series of files offered to the victim by other means.

Let's move to a VM and see what's behind f.jpg.

httpshuntioimagesblogsblog-8img-3-2xwebpFigure 3: Detect it Easy results of f.jpg

f.jpg is a zip file containing 9 additional files. We'll keep digging from here, unzip the file, and see what we find.

httpshuntioimagesblogsblog-8img-4-2xwebpFigure 4: Contents of f.jpg

Let's wrap up this first example. If you are analyzing the files at home, let me know what you found.

Python Executable Wrapped in Fernet

The second case is a malicious IP Hunt detected as hosting a login page for Supershell, an open-source C2 platform, and two more files in an open directory.

httpshuntioimagesblogsblog-8img-5-2xwebpFigure 5: Hunt results of open directory at 121.37.21[.]229

Once again, we have some rather dull file names. 1.exe is rather large at 10 MB, but let's look at a.txt.

httpshuntioimagesblogsblog-8img-6-2xwebpFigure 6: Encoded/encrypted data of a.txt.

The text in the file is encoded or encrypted; we just don't know with what algorithm yet.

Even with a 10MB file, phishing remains a viable delivery method, in addition to hosting the file somewhere as a popular tool for download.

Moving back to our VM, let's look at 1. exe.

httpshuntioimagesblogsblog-8img-7-2xwebpFigure 7: Detect it Easy results of 1.exe

Let's skip forward and cover the compiled Python files extracted from the executable.

httpshuntioimagesblogsblog-8img-8-2xwebpFigure 8: Decompiled code of b.pyc and interesting stringhttpshuntioimagesblogsblog-8img-9-2xwebpFigure 9: decrypted code from a.txt

From Figures 8 & 9, we can see that 1.exe:

  1. Defines a key using the Fernet encryption scheme to decrypt "sectr" stored in "destr."

  2. The inner function, "A" executes the "destr" value.

  3. "T2" Base64 encodes a message in Chinese twice.

  4. "T1" implements the QuickSort algorithm.

  5. Function "00619654()" makes a GET request and downloads a.txt from the open directory, then tries to run the "06936762() function.

From Figures 8 & 9, we can see that 1.exe:

Note: I couldn't find the message in string "t2" used in other malicious code. If you've seen it used before, feel free to reach out on X (Twitter).

As we can see in Figure 9, the result of a.txt is a Python script that decrypts shellcode (encrypted with Fernet) in memory and executes it.

VirusTotal and Triage detect 1.exe and the shellcode as part of the Cobalt Strike penetration testing tool.

Conclusion

As we've explored, exposed directories serve as a common vector for malware delivery and the subsequent loading of additional malicious components. Often overlooked due to the plethora of malware found in directories, it is crucial that we, as defenders, remember that these servers can be the beginning of a bad day for our network.

For further hunting, here are more examples:

Related Posts:

TinyLoader Malware: Crypto Theft & C2 Infrastructure
Sep 2, 2025

Investigation into TinyLoader malware stealing cryptocurrency via Redline Stealer, USB spread, and C2 infrastructure.

TinyLoader Malware: Crypto Theft & C2 Infrastructure
Sep 2, 2025

Investigation into TinyLoader malware stealing cryptocurrency via Redline Stealer, USB spread, and C2 infrastructure.

Announcing Hunt 2.5
Aug 21, 2025

Hunt 2.5 introduces IP pivots, faster HuntSQL queries, a full-screen app view, and a refreshed IP database. Explore the latest improvements.

Announcing Hunt 2.5
Aug 21, 2025

Hunt 2.5 introduces IP pivots, faster HuntSQL queries, a full-screen app view, and a refreshed IP database. Explore the latest improvements.

APT MuddyWater Targets CFOs with Multi-Stage Phishing & NetBird Abuse
Aug 20, 2025

Hunt.io uncovers MuddyWater phishing campaigns using Firebase lures, VBS payloads, and NetBird for persistent remote access. Learn more.

APT MuddyWater Targets CFOs with Multi-Stage Phishing & NetBird Abuse
Aug 20, 2025

Hunt.io uncovers MuddyWater phishing campaigns using Firebase lures, VBS payloads, and NetBird for persistent remote access. Learn more.

ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis
Aug 14, 2025

Hunt.io uncovers the complete ERMAC V3.0 source code, revealing its infrastructure, vulnerabilities, and expanded form injection capabilities.

ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis
Aug 14, 2025

Hunt.io uncovers the complete ERMAC V3.0 source code, revealing its infrastructure, vulnerabilities, and expanded form injection capabilities.

TinyLoader Malware: Crypto Theft & C2 Infrastructure
Sep 2, 2025

Investigation into TinyLoader malware stealing cryptocurrency via Redline Stealer, USB spread, and C2 infrastructure.

Announcing Hunt 2.5
Aug 21, 2025

Hunt 2.5 introduces IP pivots, faster HuntSQL queries, a full-screen app view, and a refreshed IP database. Explore the latest improvements.