The National Security Agency and the Federal Bureau of Investigation of the USA , according to which 85th Main Special Service Center (85th Main Special Service Center of the GRU) uses a piece of malware called "Chopper." The "Chopper" consists of a rootkit in the form of a Linux kernel module, a file transfer tool, and a network port forwarding server. The client part can download and upload files, execute arbitrary commands on behalf of the root user, and redirect network ports to other nodes in the network.
The command center for "Chopper" receives the path to the configuration file in JSON format as a command line argument:
{
"db_host" : "",
"db_port" : "",
"db_db" : "",
"db_user" : "",
"db_password" : "",
"lport" : "",
"lhost" : "",
"ping_sec" : "",
"priv_key_file" : "",
"phrase" : ""
}
MySQL is used as the backend. WebSocket protocol is used to connect clients.
The client has a built-in configuration, including the server URL, its public RSA key, username, and password. After installing the rootkit, the configuration is saved as a text file in JSON format, which is hidden from the system by the "Chopper" kernel module:
{
"id" : "cbcf6abc-466b-11e9-853b-000c29cb9f6f",
"key": "Y2xpZW50a2V5"
}
Here, "id" is a unique identifier issued by the server, where the last 48 bits correspond to the MAC address of the server's network interface. The "key" parameter by default is the base64-encoded string "clientkey," which is used by the server during the initial handshake. Additionally, the configuration file may contain information about hidden files, modules, and network ports:
{
"id" : "6fa41616-aff1-11ea-acd5-000c29283bbc",
"key": "Y2xpZW50a2V5",
"monitor" : {
"file" : [
{
"active" : "true",
"id" : "d9dc492b-5a32-8e5f-0724-845aa13fff98",
"mask" : "testfile1"
}
],
"module" : [
{
"active" : "true",
"id" : "48a5e9d0-74c7-cc17-2966-0ea17a1d997a",
"mask" : "testmodule1"
}
],
"net" : [
{
"active" : "true",
"id" : "4f355d5d-9753-76c7-161e-7ef051654a2b",
"port" : "12345",
"protocol" : "tcp"
}
]
}
}
Another component of "Chopper" is the agent, whose configuration file contains information for connecting to the server:
{
"client_login" : "user123",
"client_pass" : "pass4567",
"clientid" : "e391847c-bae7-11ea-b4bc-000c29130b71",
"clientkey_base64" : "Y2xpZW50a2V5",
"pub_key_file" :"public_key",
"server_host" : "192.168.57.100",
"server_port" :"45122"
"server_uri" :"/ws"
}
The fields "clientid" and "clientkey_base64" are initially absent; they are added after the initial registration on the server.
After installation, the following operations are performed:
- the kernel module is loaded, which registers hooks for system calls;
- the client registers with the kernel module;
- the kernel module hides the client's running process and its executable file on disk.
To interact with the kernel module, the client uses a pseudo-device, such as /dev/zero. The kernel module parses all data written to the device, and to transmit data back, it sends the client a SIGUSR1 signal, after which the client reads data from the same device.
To detect "The Lumberjack", network traffic analysis can be used with NIDS (malicious network activities within the infected system cannot be detected, as the kernel module hides the network sockets it uses, netfilter rules, and packets that could have been intercepted by raw sockets). In a system where "The Lumberjack" is installed, the kernel module can be detected by sending it a file hiding command:
touch testfile
echo "ASDFZXCV:hf:testfile" > /dev/zero
ls
The created file "testfile" then becomes invisible.
Other detection methods include memory analysis and disk content examination. To prevent infection, it is recommended to use mandatory signature checking for the kernel and modules, available starting with Linux kernel version 3.7.
The report includes Snort rules for detecting network activity of "The Lumberjack" and Yara rules for detecting its components.
It is worth noting that the 85 GCSS GRU (military unit 26165) is associated with the group , responsible for numerous cyberattacks.
Source: opennet.ru
