ysf

# install.

sudo pacman -S audit # if not installed
sudo systemctl enable --now auditd.service

sudo auditctl -s
sudo auditctl -l

# put here for persistent rules: /etc/audit/rules.d/70-aur-malware.rules:

ysf

ELF64 x86-64 PIE, stripped, 3,668,704 bytes sha256 06c857c8ca798d50c765b4de39e6c4f272ecb57bc8316a8ed4c0fdf02fb59502

this is a rust infostealer + interactive RAT + ssh worm. it installs its own persistence, harvests everything of value on the host, and takes remote commands over its own tor channel.

almost all strings are encrypted with ChaCha20-Poly1305, with one key + nonce + ciphertext per call site.

first it checks

ysf

validator.malware

ELF64 x86-64 PIE, stripped, 43,640 bytes sha256 2d25d2ea313767fae5808164224cf6ad610ab09546d1e5a6f033eedbfd98a281

first-stage loader that installs itself, builds its own tor transport, fetches stage 2 from an .onion, runs it, then goes inactive.

it contains 154 ChaCha20 encrypted strings, see https://gist.github.com/ysf/c1b8cc85f4063367fddb85c443589f5b

first it checks:

ysf

#!/usr/bin/env python3
"""
ChaCha20 string decoder for validator.malware strings

    python3 decode.py validator.malware
    python3 decode.py validator.malware --json > strings.json
    python3 decode.py validator.malware --keys

at launch the malware decrypts all strings at once. each string has its own
ChaCha20 key and nonce. I found 4 tables of 154 entries in .rodata with ciphertext:

ysf

.text

.global _start

_start:
	
	# setresuid() syscall
	# Narnia FIX: Bash drop the setuid bit if EUID != RUID
	# I need to call setresuid() to set a different RUID
	xor %eax, %eax		# Cleaning syscall number

ysf

from datetime import datetime
from time import sleep

from dnslib import DNSLabel, QTYPE, RD, RR
from dnslib import A, AAAA, CNAME, MX, NS, SOA, TXT
from dnslib.server import DNSServer

EPOCH = datetime(1970, 1, 1)
SERIAL = int((datetime.utcnow() - EPOCH).total_seconds())

ysf

# source from .bashrc for lazy pipe grep magic

command_not_found_handle () 
{ 
  # only run within an input pipe
  if [[ -p /dev/stdin ]]; then 
    grep -- "$*"
    return $?
  fi

ysf

Keybase proof

I hereby claim:

• I am ysf on github.
• I am ysf (https://keybase.io/ysf) on keybase.
• I have a public key whose fingerprint is C164 E108 8854 3B27 F961 6703 9DDA 5F79 EFE3 EBDF

To claim this, I am signing this object:

ysf

#!/usr/bin/env python

# hack to provide a repeat statement in reply to: https://gist.github.com/ychaouche/f30d5e07012454fff0d2

import inspect


def repeat(count):
    if not hasattr(repeat, "loops"):
        repeat.loops = {}

ysf

# Copyright © 2010-2011 Tech-Angels. All Rights Reserved.

# CollectorTransaction will be created each time the Collector needs
# to trace an activity.
#
# Attributes:
# * id [integer, primary, not null] - primary key
# * before_tr [binary] - associated model serialized before transaction
# * created_at [datetime] - creation time
# * model_id [integer] - belongs_to Model (polymorphic)