The Accidental Malware Repository: Hunting & Collecting Malware Via Open Directories (Part 1)

The Accidental Malware Repository: Hunting & Collecting Malware Via Open Directories (Part 1)

Published on

Published on

Published on

Feb 1, 2024

Feb 1, 2024

Feb 1, 2024

The Accidental Malware Repository: Hunting & Collecting Malware Via Open Directories (Part 1)
The Accidental Malware Repository: Hunting & Collecting Malware Via Open Directories (Part 1)
The Accidental Malware Repository: Hunting & Collecting Malware Via Open Directories (Part 1)
TABLE OF CONTENTS

This post will serve as the first in a long series of articles on using the platform to identify malicious infrastructure and hunt across the open internet for malware, phishing pages, and whatever else may pose harm to the networks we defend.

For our initial blog in this hunting workshop, we'll leave our territory and peruse an open directory containing a phishing site, which also happens to be hosting the XWorm RAT.

Did You Know?

You can search over 5,000 open directories and hone in on specific file names, sandbox results for hosted malware samples, exposed shell history, and more with the click of a button. If you haven't already, please apply for an account and give the Hunt platform a spin.

httpshuntioimagesblogsacc-malwareimg-1-3xwebp
Figure 1: Hunt Open Directory Feature

One of our budding researchers discovered the IP address 65.1.224[.]214:80 while collecting intelligence on servers hosting malicious software. Digging deeper into the open directory, we see some interestingly named files, including a sub-directory titled "/We."

httpshuntioimagesblogsacc-malwareimg-2-3xwebp
Figure 2: Suspect Open Dir

*You can download and obtain a file hash or see what other servers host the same file by clicking one of the buttons under "Actions."

For the eagle-eyed reader, you may have noticed that Hunt detects the lazily named "PowerShell.ps1" as the XWorm RAT. We'll take a look at that file, as well as the others, later. For now, let's check out the /We directory.

httpshuntioimagesblogsacc-malwareimg-3-3xwebp
Figure 3: File contents of the /We directory

The folder contains several files, including images, an image folder, and HTML & PHP pages. Files titled "BlockChain_Login" and "Device_Verification" lead us to believe that whoever is controlling this server is attempting to phish user credentials, posing as the legitimate site, likely for the theft of digital currency.

Let's take a look at the malicious login page.

httpshuntioimagesblogsacc-malwareimg-4-3xwebp
Figure 4: Spoofed Login Page
httpshuntioimagesblogsacc-malwareimg-5-3xwebp
Figure 5: Legitimate Login Page

If you've investigated phishing pages before, the malicious login page is often a carbon copy of the legitimate site, with limited functionality outside of capturing credentials on login.

If we refer back to the /We folder, there are files for the "Import Your Account" button. Clicking on the button reveals an additional attempt to steal the user's recovery phrase.

httpshuntioimagesblogsacc-malwareimg-6-3xwebp
Figure 6: Attempt To Steal Private Key Phrase

So far, some web pages are attempting to spoof a digital currency financial services company. Interesting and worth reporting (hopefully, your users aren't trading currency on the company network), but the multiple .bat, .vbs, and .ps1 files may really pique your interest.

httpshuntioimagesblogsacc-malwareimg-7-3xwebp
Figure 7: Batch File Which Initiates Execution

While a thorough analysis of the files themselves is outside the scope of this post, Downloader.bat, void of any obfuscation, downloads the PowerShell script we saw earlier.

httpshuntioimagesblogsacc-malwareimg-8-3xwebp
Figure 8: PowerShell Script To Download .bat & .vbs files

The script, thoughtfully written with comments, downloads two files and checks if the documents already exist on the victim machine; if not, it executes the VBS file from a hidden window.

httpshuntioimagesblogsacc-malwareimg-9-3xwebp
Figure 9: Malicious VBS File

Again, the visual basic file checks if the 2.bat file is on the victim host and, if so, runs the file silently.

httpshuntioimagesblogsacc-malwareimg-10-3xwebp
Figure 10: Encoded Batch File

2.bat, when executed, drops a file named 2.bat.exe in the %TEMP% folder. Luckily, the decryption key can be found within the code, and decompression is trivial.

httpshuntioimagesblogsacc-malwareimg-11-3xwebp
Figure 11: Decompressed & Decrypted Code

What Else Can I Find?

Short answer: just about anything you can think of. We constantly scan and update our database of open directories and their associated files, ensuring the most up-to-date information for defenders and researchers looking to analyze malicious samples and thwart actors attempting to damage their reputations.

As we progress in this series, we'll dive deeper into how Hunt can assist in hunting for the next significant threat, keeping our networks and brands safer one blog at a time.

Found something interesting using the Open Directories feature, please share it on X (Twitter), LinkedIn, or Mastodon.

TABLE OF CONTENTS

This post will serve as the first in a long series of articles on using the platform to identify malicious infrastructure and hunt across the open internet for malware, phishing pages, and whatever else may pose harm to the networks we defend.

For our initial blog in this hunting workshop, we'll leave our territory and peruse an open directory containing a phishing site, which also happens to be hosting the XWorm RAT.

Did You Know?

You can search over 5,000 open directories and hone in on specific file names, sandbox results for hosted malware samples, exposed shell history, and more with the click of a button. If you haven't already, please apply for an account and give the Hunt platform a spin.

httpshuntioimagesblogsacc-malwareimg-1-3xwebp
Figure 1: Hunt Open Directory Feature

One of our budding researchers discovered the IP address 65.1.224[.]214:80 while collecting intelligence on servers hosting malicious software. Digging deeper into the open directory, we see some interestingly named files, including a sub-directory titled "/We."

httpshuntioimagesblogsacc-malwareimg-2-3xwebp
Figure 2: Suspect Open Dir

*You can download and obtain a file hash or see what other servers host the same file by clicking one of the buttons under "Actions."

For the eagle-eyed reader, you may have noticed that Hunt detects the lazily named "PowerShell.ps1" as the XWorm RAT. We'll take a look at that file, as well as the others, later. For now, let's check out the /We directory.

httpshuntioimagesblogsacc-malwareimg-3-3xwebp
Figure 3: File contents of the /We directory

The folder contains several files, including images, an image folder, and HTML & PHP pages. Files titled "BlockChain_Login" and "Device_Verification" lead us to believe that whoever is controlling this server is attempting to phish user credentials, posing as the legitimate site, likely for the theft of digital currency.

Let's take a look at the malicious login page.

httpshuntioimagesblogsacc-malwareimg-4-3xwebp
Figure 4: Spoofed Login Page
httpshuntioimagesblogsacc-malwareimg-5-3xwebp
Figure 5: Legitimate Login Page

If you've investigated phishing pages before, the malicious login page is often a carbon copy of the legitimate site, with limited functionality outside of capturing credentials on login.

If we refer back to the /We folder, there are files for the "Import Your Account" button. Clicking on the button reveals an additional attempt to steal the user's recovery phrase.

httpshuntioimagesblogsacc-malwareimg-6-3xwebp
Figure 6: Attempt To Steal Private Key Phrase

So far, some web pages are attempting to spoof a digital currency financial services company. Interesting and worth reporting (hopefully, your users aren't trading currency on the company network), but the multiple .bat, .vbs, and .ps1 files may really pique your interest.

httpshuntioimagesblogsacc-malwareimg-7-3xwebp
Figure 7: Batch File Which Initiates Execution

While a thorough analysis of the files themselves is outside the scope of this post, Downloader.bat, void of any obfuscation, downloads the PowerShell script we saw earlier.

httpshuntioimagesblogsacc-malwareimg-8-3xwebp
Figure 8: PowerShell Script To Download .bat & .vbs files

The script, thoughtfully written with comments, downloads two files and checks if the documents already exist on the victim machine; if not, it executes the VBS file from a hidden window.

httpshuntioimagesblogsacc-malwareimg-9-3xwebp
Figure 9: Malicious VBS File

Again, the visual basic file checks if the 2.bat file is on the victim host and, if so, runs the file silently.

httpshuntioimagesblogsacc-malwareimg-10-3xwebp
Figure 10: Encoded Batch File

2.bat, when executed, drops a file named 2.bat.exe in the %TEMP% folder. Luckily, the decryption key can be found within the code, and decompression is trivial.

httpshuntioimagesblogsacc-malwareimg-11-3xwebp
Figure 11: Decompressed & Decrypted Code

What Else Can I Find?

Short answer: just about anything you can think of. We constantly scan and update our database of open directories and their associated files, ensuring the most up-to-date information for defenders and researchers looking to analyze malicious samples and thwart actors attempting to damage their reputations.

As we progress in this series, we'll dive deeper into how Hunt can assist in hunting for the next significant threat, keeping our networks and brands safer one blog at a time.

Found something interesting using the Open Directories feature, please share it on X (Twitter), LinkedIn, or Mastodon.

Related Posts:

Sep 10, 2024

Compromising a browser can be a goldmine for attackers, offering extensive access to sensitive user data ...

Sep 10, 2024

Compromising a browser can be a goldmine for attackers, offering extensive access to sensitive user data ...

Sep 3, 2024

The ToneShell backdoor, frequently associated with Mustang Panda (also known as Stately Taurus and Earth Preta...

Sep 3, 2024

The ToneShell backdoor, frequently associated with Mustang Panda (also known as Stately Taurus and Earth Preta...

Aug 29, 2024

During a recent analysis of known Latrodectus infrastructure, our research team encountered a command-and-control...

Aug 29, 2024

During a recent analysis of known Latrodectus infrastructure, our research team encountered a command-and-control...

Launching AttackVault by Hunt.Io
Aug 23, 2024

We originally launched our "Open Directory" feature in Hunt a year ago.  The premise behind it was to get into the mind of the attacker by get a backstage view into their attacks.  What we learned was that there was a ton of information that could be correlated and indexed.  Today, we're reaffirming our commitment to getting into the tooling of attackers by launching AttackCapture™ by Hunt.io.

Launching AttackVault by Hunt.Io
Aug 23, 2024

We originally launched our "Open Directory" feature in Hunt a year ago.  The premise behind it was to get into the mind of the attacker by get a backstage view into their attacks.  What we learned was that there was a ton of information that could be correlated and indexed.  Today, we're reaffirming our commitment to getting into the tooling of attackers by launching AttackCapture™ by Hunt.io.

Sep 10, 2024

Compromising a browser can be a goldmine for attackers, offering extensive access to sensitive user data ...

Sep 3, 2024

The ToneShell backdoor, frequently associated with Mustang Panda (also known as Stately Taurus and Earth Preta...