Elknot the "encrypted" sub-version
https://www.virustotal.com/en/file/10e7 ... 411504901/< packed too (usual)
Previous samples for this type are:
https://www.virustotal.com/en/file/92c8 ... 406605801/
https://www.virustotal.com/en/file/1903 ... 411053039/
https://www.virustotal.com/en/file/4cc1 ... 402865829/
https://www.virustotal.com/en/file/223f ... 407913413/
(etc..)
I was about to make new family of this one, but seeing many ELknot characteristic in it so I put them all in this topic.
The code obfuscation made the low detection to every minor variant, they made their point to evade AV sigs.
In this sample these are the source codes:
Code: Select all Fake.cpp
Global.cpp
main.cpp
Manager.cpp
ServerIP.cpp
StatBase.cpp
ThreadAttack.cpp
ThreadHostStatus.cpp
ThreadTaskManager.cpp
ThreadTimer.cpp
AutoLock.cpp
FileOp.cpp
Log.cpp
Md5.cpp
Media.cpp
NetBase.cpp
ThreadCondition.cpp
Thread.cpp
ThreadMutex.cpp
Utility.cpp
Typical code characteristic:
Code: Select all_ZN13CThreadAttack5StartEP11CCmdMessage
_ZN13CThreadAttack4StopEv
_ZN13CThreadAttack12DomainRandExER10CRandArrayRi
_ZN13CThreadAttack11ProcessMainEv
_ZN13CThreadAttackD1Ev
_ZN13CThreadAttackC2EP8CManager
_ZN13CThreadAttackD0Ev
_ZN13CThreadAttack6PktAtkER8CSubTaskRSt6vectorIjSaIjEE
_ZN13CThreadAttackD2Ev
_ZN13CThreadAttack18EmptyConnectionAtkER8CSubTask
_ZN13CThreadAttack11FakeUserAtkER8CSubTask
_ZN13CThreadAttackC1EP8CManager
_ZN13CThreadAttack12DomainInitExER10CRandArrayPKc
_ZN13CThreadAttack7HttpAtkER8CSubTask
..and:
Code: Select all0x0827093B 0x011 // ThreadAttack.cpp , contains:
0x08270956 0x03A // _ZZN13CThreadAttack12DomainInitExER10CRandArrayPKcE5C.131
0x08270990 0x03E // _ZZN13CThreadAttack6PktAtkER8CSubTaskRSt6vectorIjSaIjEEE4C.93
0x082709CE 0x03E // _ZZN13CThreadAttack6PktAtkER8CSubTaskRSt6vectorIjSaIjEEE4C.86
0x08270A0C 0x03E // _ZZN13CThreadAttack6PktAtkER8CSubTaskRSt6vectorIjSaIjEEE4C.83
It has a stupid trick copies the sample with adding "a" char in the end of filename to exec as child ;)
Code: Select allexecve("/bin/cp", ["cp", "{$PATH}/sample", "{$PATH}/samplea"]
execve("{$PATH}/samplea", ["{$PATH}/conga", "{$PATH}/sample"], [" ={$PATH}/sample", "SHELL=/bin/bash", "TERM=screen", $ENV)
CNC is:
