Linux.Agent malware sample - data stealer

Research: SentinelOne, Tim Strazzere Hiding in plain sight?
Sample credit: Tim Strazzere


List of files

9f7ead4a7e9412225be540c30e04bf98dbd69f62b8910877f0f33057ca153b65  malware
d507119f6684c2d978129542f632346774fa2e96cf76fa77f377d130463e9c2c  malware
fddb36800fbd0a9c9bfffb22ce7eacbccecd1c26b0d3fb3560da5e9ed97ec14c  script.decompiled-pretty
ec5d4f90c91273b3794814be6b6257523d5300c28a492093e4fa1743291858dc  script.decompiled-raw
4d46893167464852455fce9829d4f9fcf3cce171c6f1a9c70ee133f225444d37  script.dumped

malware_a3dad000efa7d14c236c8018ad110144
malware fcbfb234b912c84e052a4a393c516c78
script.decompiled-pretty aab8ea012eafddabcdeee115ecc0e9b5
script.decompiled-raw ae0ea319de60dae6d3e0e58265e0cfcc
script.dumped b30df2e63bd4f35a32f9ea9b23a6f9e7

Download

Download. Email me if you need the password

Potao Express samples

http://www.welivesecurity.com/2015/07/30/operation-potao-express/

http://www.welivesecurity.com/wp-content/uploads/2015/07/Operation-Potao-Express_final_v2.pdf

TL; DR

2011- July 2015

• Aka  Sapotao and node69
• Group - Sandworm / Quedagh APT
• Vectors - USB, exe as doc, xls
• Victims - RU, BY, AM, GE 
• Victims - MMM group, UA gov
• truecryptrussia.ru has been serving modified versions of the encryption software (Win32/FakeTC) that included a backdoor to selected targets. 
• Win32/FakeTC - data theft from encrypted drives
• The Potao main DLL only takes care of its core functionality; the actual spying functions are implemented in the form of downloadable modules. The plugins are downloaded each time the malware starts, since they aren’t stored on the hard drive.

• 1st Full Plugin and its export function is called Plug. Full plugins run continuously until the infected system is restarted

• 2nd Light Plugin with an export function Scan. Light plugins terminate immediately after returning a buffer with the information they harvested off the victim’s machine.

• Some of the plugins were signed with a certificate issued to “Grandtorg”:
• Traffic 

• Strong encryption. The data sent is encapsulated using the XML-RPC protocol.

• MethodName value 10a7d030-1a61-11e3-beea-001c42e2a08b is always present in Potao traffic.

• After receiving the request the C&C server generates an RSA-2048 public key and signs this generated key with another, static RSA-2048 private key .

• In 2nd stage the malware generates a symmetric AES-256 key. This AES session key is encrypted with the newly received RSA-2048 public key and sent to the C&C server.

• The actual data exchange after the key exchange is then encrypted using symmetric cryptography, which is faster, with the AES-256 key

• The Potao malware sends an encrypted request to the server with computer ID, campaign ID, OS version, version of malware, computer name, current privileges, OS architecture (64 or 32bits) and also the name of the current process.

• Potao USB - uses social engineering, exe in the root disguised as drive icon
• Potao Anti RE -  uses the MurmurHash2 algorithm for computing the hashes of the API function names.
• Potao Anti RE - encryption of strings
• Russian TrueCrypt Win32/FakeTC - The malicious program code within the otherwise functional TrueCrypt software runs in its own thread. This thread, created at the end of the Mount function, enumerates files on the mounted encrypted drive, and if certain conditions are met, it connects to the C&C server, ready to execute commands from the attackers.
• IOC https://github.com/eset/malware-ioc/tree/master/potao