Malware Analysis Report (AR22-270A)

MAR-10400779-1.v1 – Zimbra 1

Click to Tweet.
Click to send to Facebook.
Click to Share.

Notification

This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Summary

Description

CISA received seven files for analysis. Six Java Server Pages (JSP) webshells and a Bourne Again SHell (bash) file. Five JSP webshell files are designed to parse inbound requests for commands for execution, download files, and upload files. One JSP webshell file contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in a JSP page. The bash file is designed to perform ldapsearch queries and store the output into a newly created directory.

Download the STIX version of this report: MAR-10400779.r1.v1.WHITE_stix, 1.3 MB

Submitted Files (7)

28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52 (TasksTtt.jsp)

6dee4a1d4ac6b969b1f817e36cb5d36c5de84aa8fe512f3b6e7de80a2310caea (DatatypeConverter.jsp)

9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245 (test.jsp)

c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553 (xjhdshd.jsp)

c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409 (security.jsp)

c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614 (test2.jsp)

d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1 (test.sh)

Findings

c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409

Tags

trojanwebshell

Details
Name security.jsp
Size 2629 bytes
Type ASCII text, with very long lines
MD5 2847c3be246be1dfd49789ebbffd5553
SHA1 a1e0297b1195fad89eb500d43e860c3beae90840
SHA256 c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409
SHA512 9d61f0dab4368c49055780e6db6d337d46a3b3a00eee0136456c4cf5705c8b272b96a258f23c69d62475caeddfc7dec92526caf69959f4f6b112377fa529673b
ssdeep 48:LO0Vh1APgh1Ey4zSTYeMvQcvQZcLeR6wpEsSMk/ijSjhAjYv:Ca1APgredtX5k6MXjSjhAjC
Entropy 5.158869
Antivirus
Adaware Generic.JAVA.WebShell.B.1D5257AD
AhnLab WebShell/JSP.Godzilla.S1719
Bitdefender Generic.JAVA.WebShell.B.1D5257AD
ESET Java/Webshell.AX trojan
IKARUS Trojan.Java.Webshell
McAfee JAVA/Webshell.c
Quick Heal HTML.Trojan.45967
Sophos Troj/JSPRat-D
Symantec Process timed out
Trend Micro Backdoo.514E18B9
Trend Micro HouseCall Backdoo.514E18B9
YARA Rules
  • rule CISA_10400779_01 : trojan webshell GODZILLA
    {
       meta:
           Author = "CISA Code & Media Analysis"
           Incident = "10400779"
           Date = "2022-08-29"
           Last_Modified = "20220908_1400"
           Actor = "n/a"
           Category = "Trojan Webshell"
           Family = "GODZILLA"
           Description = "Detects Godzilla webshell samples"
           MD5 = "2847c3be246be1dfd49789ebbffd5553"
           SHA256 = "c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409"
       strings:
           $s0 = { 53 74 72 69 6E 67 20 78 63 }
           $s1 = { 53 74 72 69 6E 67 20 70 61 73 73 }
           $s2 = { 6D 64 35 28 70 61 73 73 2B 78 63 29 }
           $s3 = { 43 6C 61 73 73 4C 6F 61 64 65 72 }
           $s4 = { 53 65 63 72 65 74 4B 65 79 53 70 65 63 }
           $s5 = { 4D 65 73 73 61 67 65 44 69 67 65 73 74 }
           $s6 = { 62 61 73 65 36 34 }
           $s7 = { 72 65 71 75 65 73 74 2E 67 65 74 50 61 72 61 6D 65 74 65 72 }
           $s8 = { 73 65 73 73 69 6F 6E 2E 73 65 74 41 74 74 72 69 62 75 74 65 }
       condition:
           filesize < 10KB and all of them
    }
ssdeep Matches

No matches found.

Description

This file is a JSP webshell and has also been identified as a Godzilla webshell. When the webshell is loaded, it parses the inbound request for the parameter named "pass". If the parameter is found in the request, it retrieves the value data (attack payload/command’s functional code) of the parameter and Base64 decodes it. The decoded data is decrypted a hard-coded Advanced Encryption Standard (AES) cipher. The AES decryption and encryption key is the hard-coded key value "3c6e0b8a9c15224a", which is the first 16 characters of the MD5 hash for the word "key".

The malware checks if the session used to store the decrypted data is empty. If it is empty, it stores the decrypted data in the session and uses the classloader to load the decrypted byte-code data. If it is not empty and there is an initialized payload, it will call the payload specific function. It assigns the decrypted data to a parameter and stores it into ByteArrayOutputStream and pageContext.

The content of the decrypted data will be executed to perform additional functions. The output of the command executed is AES encrypted and Base64 encoded before being sent to the Godzilla's server in an Hypertext Transfer Protocol (HTTP) response.

Screenshots
Figure 1 - This code snippet contains a class constructor (class X) to create classes of attack payloads in string format. The x function is the encryption and decryption function of AES. It uses the Java ternary conditional operator to indicate AES decryption and encryption ( 1 is encryption mode, and 2 is the decryption mode). It generates the MD5 hash value of the hard-coded password and the key.

Figure 1 - This code snippet contains a class constructor (class X) to create classes of attack payloads in string format. The x function is the encryption and decryption function of AES. It uses the Java ternary conditional operator to indicate AES decryption and encryption ( 1 is encryption mode, and 2 is the decryption mode). It generates the MD5 hash value of the hard-coded password and the key.

Figure 2 - This code snippet parses inbound POST requests, decrypts its content with a hard-coded key, stores the decrypted payload in the session, executes it and returns the result of the command executed. The output is AES encrypted and Base64 encoded before being sent to the Godzilla's server in an HTTP response.

Figure 2 - This code snippet parses inbound POST requests, decrypts its content with a hard-coded key, stores the decrypted payload in the session, executes it and returns the result of the command executed. The output is AES encrypted and Base64 encoded before being sent to the Godzilla's server in an HTTP response.

28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52

Tags

utility

Details
Name TasksTtt.jsp
Size 722 bytes
Type ASCII text, with very long lines
MD5 36cfcfb4e6988caf8e449a7f26c92eae
SHA1 b2c45a12c6ead4d9dc9902a93c2e1e45c20a16d9
SHA256 28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52
SHA512 070d68dec36e0057747162842168397752576d09436c8096fa7606fe02deb810a96b2b675ff70cd60104b931701a6b0fa1e4c19381a316586890d7caa6c3fff5
ssdeep 12:eew2rF79Xm8POq4PO+yMCi/wageKgWvsa0kdo8gerWjW9Wwx:DPx9W8P8PjyW/wa9Kpsa0X89rWjW9Wa
Entropy 5.049376
Antivirus
Symantec Unavailable (production)
YARA Rules
  • rule CISA_10400779_02 : utility ZIMBRA
    {
       meta:
           Author = "CISA Code & Media Analysis"
           Incident = "10400779"
           Date = "2022-08-29"
           Last_Modified = "20220908_1400"
           Actor = "n/a"
           Category = "Utility"
           Family = "ZIMBRA"
           Description = "Detects malicious JSP Zimbra samples"
           MD5 = "36cfcfb4e6988caf8e449a7f26c92eae"
           SHA256 = "28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52"
       strings:
           $s0 = { 2F 62 69 6E 2F 73 68 }
           $s1 = { 22 72 6D 20 2D 72 66 }
           $s2 = { 2F 76 61 72 2F 74 6D 70 2F 74 6D 70 2E 6A 61 72 }
           $s3 = { 74 61 72 20 63 7A 66 }
           $s4 = { 61 63 63 6F 75 6E 74 73 2E 78 6D 6C }
           $s5 = { 6C 6F 63 61 6C 63 6F 6E 66 69 67 2E 78 6D 6C }
           $s6 = { 2E 65 78 65 63 28 63 31 }
           $s7 = { 2E 65 78 65 63 28 63 32 }
           $s8 = { 2E 65 78 65 63 28 63 33 }
       condition:
           filesize < 10KB and all of them
    }
ssdeep Matches

No matches found.

Description

This file is a JSP file designed to use a shell command to remove an existing Java ARchive (jar) file "/var/tmp/tmp.jar", create a new tar archive file /var/tmp/tmp.jar", and then create a symbolic link to the jar file.

Displayed below is the shell command used to remove the file "/var/tmp/tmp.jar":

--Begin command--
"sh -c rm -rf /var/tmp/tmp.jar"
--End command--

Displayed below is the shell command used to combine and group the files below into a single archive file "/var/tmp/tmp.jar"

--Begin command--
"sh -c tar czf /var/tmp/tmp.jar /opt/zimbra/backup/accounts.xml /opt/zimbra/backup/accounts.xml.old /opt/zimbra/data/ldap/config /opt/zimbra/data/ldap/ldap* /var/log/zimbra.log /opt/zimbra/jetty_base/webapps/zimbra/public/ /opt/zimbra/jetty_base/webapps/zimbraAdmin/public/ /tmp/ldap/ /etc/hosts /etc/passwd /opt/zimbra/conf/localconfig.xml"
--End command--

Displayed below is the shell command used to create a symbolic link in "/opt/zimbra/jetty_base/webapps/zimbra/public/tmp.jar" to the file "/var/tmp/tmp.jar":

--Begin command--
"sh -c ln -s /var/tmp/tmp.jar /opt/zimbra/jetty_base/webapps/zimbra/public/tmp.jar"
--End command--

Screenshots
Figure 3 - The contents of the JSP file.

Figure 3 - The contents of the JSP file.

c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614

Tags

backdoortrojanwebshell

Details
Name test2.jsp
Size 377 bytes
Type ASCII text, with CRLF line terminators
MD5 0751fbc32ada4ded129a15a0d1ea0459
SHA1 cd2e32eab50da45f747a02cacaa8f91da8d3da98
SHA256 c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614
SHA512 753da768406ccbad90bbd186778c43b443d7357ba5a4c623dbbac24207fc00331c007dcda2df4cd16466839e987ec059cda8a2d64ec4ad3296c58f06bc6d9f58
ssdeep 6:NNoONRzP2Mnp+eGFsICBAeiW2Mnhsj/dZdRAlFrkQJNtxcFERwzQ:QOTPTph1IdaThsj7dRY9Jws
Entropy 4.687617
Antivirus
Adaware Generic.ASP.WebShell.AF.963D0B0D
AhnLab WebShell/JSP.Generic.S1578
Antiy Trojan[Backdoor]/PHP.Webshell.a
Bitdefender Generic.ASP.WebShell.AF.963D0B0D
Cyren ABRisk.PEQJ-6
ESET Java/Webshell.L trojan
McAfee JAVA/Webshell.f
Sophos Troj/WebShel-BJ
YARA Rules
  • rule CISA_10400779_03 : trojan webshell backdoor
    {
       meta:
           Author = "CISA Code & Media Analysis"
           Incident = "10400779"
           Date = "2022-08-29"
           Last_Modified = "20220908_1400"
           Actor = "n/a"
           Category = "Trojan Webshell Backdoor"
           Family = "n/a"
           Description = "Detects malicious password protected JSP webshell samples"
           MD5 = "0751fbc32ada4ded129a15a0d1ea0459"
           SHA256 = "c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614"
       strings:
           $s0 = { 2E 65 71 75 61 6C 73 }
           $s1 = { 67 65 74 50 61 72 61 6D 65 74 65 72 28 22 70 77 64 22 29 }
           $s2 = { 2E 65 78 65 63 28 72 65 71 75 65 73 74 2E 67 65 74 50 61 72 61 6D 65 74 65 72 }
           $s3 = { 2E 67 65 74 49 6E 70 75 74 53 74 72 65 61 6D }
           $s4 = { 6F 75 74 2E 70 72 69 6E 74 28 }
           $s5 = { 3C 70 72 65 3E }
           $s6 = { 3C 2F 70 72 65 3E }
       condition:
           filesize < 10KB and all of them
    }
ssdeep Matches

No matches found.

Description

This file is a password protected JSP webshell designed to retrieve and execute certain parameters from the attacker. When the attacker makes a request to the malicious JSP file along with certain parameters, it checks if the password supplied by the attacker through the "pwd" parameter is equals to "123456". If the password is correct, it executes the command supplied by the attacker through the "i" parameter and outputs the command executed in the console.

Screenshots
Figure 4 - The contents of the JSP file.

Figure 4 - The contents of the JSP file.

c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553

Tags

backdoortrojanwebshell

Details
Name xjhdshd.jsp
Size 587 bytes
Type ASCII text
MD5 e146561122214f67eb35c52758a21fa5
SHA1 af9bc7ef25755982a00aca920ee7ad51f76c5cc2
SHA256 c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553
SHA512 4f6b3212c68e4fc0794445455b03fb70372614f308c90381d0a075389532cf942712c36b3a6c5c1806549c4b1c348fe78fe09eda3056a10ec6a906641673e154
ssdeep 12:P9CKGVuew42RT4kimBF6le9FonOzFjyu6iy2UIn+:Pg/dT2TLimBsle+gFjyuzHUIn+
Entropy 4.765361
Antivirus
AhnLab WebShell/JSP.Agent
Cyren ABRisk.GLNK-2
ESET Java/Webshell.BF trojan
McAfee JAVA/Webshell.d
Sophos Troj/WebShel-BB
Symantec Trojan.Gen.NPE
Trend Micro Backdoo.0B525FD4
Trend Micro HouseCall Backdoo.0B525FD4
YARA Rules
  • rule CISA_10400779_04 : trojan webshell backdoor
    {
       meta:
           Author = "CISA Code & Media Analysis"
           Incident = "10400779"
           Date = "2022-08-29"
           Last_Modified = "20220908_1400"
           Actor = "n/a"
           Category = "Trojan Webshell Backdoor"
           Family = "n/a"
           Description = "Detects malicious JSP webshell samples"
           MD5 = "e146561122214f67eb35c52758a21fa5"
           SHA256 = "c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553"
       strings:
           $s0 = { 49 4E 50 55 54 20 6E 61 6D 65 }
           $s1 = { 63 6D 64 }
           $s2 = { 73 75 62 6D 69 74 20 76 61 6C 75 65 }
           $s3 = { 52 75 6E }
           $s4 = { 53 74 72 69 6E 67 20 63 6D 64 }
           $s5 = { 67 65 74 50 61 72 61 6D 65 74 65 72 }
           $s6 = { 53 74 72 69 6E 67 20 6F 75 74 70 75 74 }
           $s7 = { 65 78 65 63 28 63 6D 64 }
           $s8 = { 67 65 74 49 6E 70 75 74 53 74 72 65 61 6D }
           $s9 = { 73 2B 22 3C 2F 62 72 3E 22 }
           $s10 = { 70 72 69 6E 74 53 74 61 63 6B 54 72 61 63 65 }
       condition:
           filesize < 10KB and all of them
    }
ssdeep Matches

No matches found.

Description

This file is a JSP webshell designed to allow an attacker to execute commands and read the output of the commands. When executed, it prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in the JSP page.

Screenshots
Figure 5 - The contents of the JSP file. It contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute.

Figure 5 - The contents of the JSP file. It contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute.

9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245

Tags

utility

Details
Name test.jsp
Size 3733 bytes
Type HTML document, ASCII text
MD5 55e51e8ceda717813a5223a8c99a8830
SHA1 275774dbfc8c1e8a95dcd2f0d589db1ab369eb01
SHA256 9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245
SHA512 e14e598ac4e21e81d3e06b67b3e0cee7ee277b8a8e744649534bd930cc3f659f70450f64d59e2ef9cd81ce104943d4557a19b53b3f41a26ff0305bee097bb6ad
ssdeep 96:xZ+BhtTdkfTGRipKJ2N9rwrdNHZhFxwSyc:b2TdkfTGiAJ2N9mdN7ftyc
Entropy 4.550524
Antivirus

No matches found.

YARA Rules
  • rule CISA_10400779_05 : utility webshell ZIMBRA
    {
       meta:
           Author = "CISA Code & Media Analysis"
           Incident = "10400779"
           Date = "2022-08-29"
           Last_Modified = "20220908_1400"
           Actor = "n/a"
           Category = "Utility Webshell"
           Family = "ZIMBRA"
           Description = "Detects malicious JSP webshell samples"
           MD5 = "55e51e8ceda717813a5223a8c99a8830"
           SHA256 = "9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245"
       strings:
           $s0 = { 2f 6f 70 74 2f 7a 69 6d 62 72 61 2f 6a 65 74 74 79 2f 77 65 62 61 70 70 73 2f 7a 69 6d 62 72 61 41 64 6d 69 6e 2f 70 75 62 6c 69 63 2f 74 65 73 74 2e 73 68 }
           $s1 = { 2E 65 78 65 63 28 }
           $s2 = { 5A 69 70 4F 75 74 70 75 74 53 74 72 65 61 6D }
           $s3 = { 67 65 74 50 61 72 61 6D 65 74 65 72 }
           $s4 = { 22 61 63 74 69 6F 6E 22 }
           $s5 = { 22 65 78 65 63 22 2E }
           $s6 = { 70 72 69 6E 74 6C 6E 28 65 78 65 63 }
           $s7 = { 22 64 6F 77 6E 22 2E }
           $s8 = { 43 6F 6E 74 65 6E 74 2D 44 69 73 70 6F 73 69 74 69 6F 6E }
           $s9 = { 61 74 74 61 63 68 6D 65 6E 74 }
           $s10 = { 67 65 74 4F 75 74 70 75 74 53 74 72 65 61 6D }
           $s11 = { 70 61 67 65 43 6F 6E 74 65 78 74 2E }
           $s12 = { 6F 75 74 2E 70 72 69 6E 74 6C 6E 28 22 6E 6F 22 29 }
       condition:
           filesize < 10KB and all of them
    }
ssdeep Matches

No matches found.

Relationships
9d2a842e7a... Used d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1
Description

This file is a JSP webshell designed to retrieve and execute certain parameters from the attacker. The attacker can make a request to the malicious JSP file along with certain parameters to execute commands and output to console, download files, and zip compress files into "/tmp/zimbra/". It executes the file "/opt/zimbra/jetty/webapps/zimbraAdmin/public/test.sh" (ab28345b8aba13ae82f8bc0694f15804).

Screenshots
Figure 6 - This code snippet retrieves and executes certain parameters from the attacker. The attacker can execute commands and output to console, download files, and zip compress files.

Figure 6 - This code snippet retrieves and executes certain parameters from the attacker. The attacker can execute commands and output to console, download files, and zip compress files.

d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1

Tags

credential-harvester

Details
Name test.sh
Size 1111 bytes
Type Bourne-Again shell script, ASCII text executable
MD5 ab28345b8aba13ae82f8bc0694f15804
SHA1 6c484d46637cb3a9c4a5f0b42bff388c7b550b6d
SHA256 d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1
SHA512 d438228d08210f5a294865a1c3e91618e8c84a2c250f60349bf95659a04fe711feda9b882b189da65db81bd0ac417febde4bd7487a7a81a6467e7bb381b4116e
ssdeep 24:+U+pW+pO+pg+xvbDk9w+1dsRcy+1dsuXpeG+1dsYXeL+h:tSWSOSgsbDsw+1dsD+1dskpN+1dsoh
Entropy 5.047438
Antivirus

No matches found.

YARA Rules
  • rule CISA_10400779_06 : credential_harvester ZIMBRA
    {
       meta:
           Author = "CISA Code & Media Analysis"
           Incident = "10400779"
           Date = "2022-08-29"
           Last_Modified = "20220908_1400"
           Actor = "n/a"
           Category = "Credential-Harvester"
           Family = "ZIMBRA"
           Description = "Detects ZIMBRA bash file samples"
           MD5 = "ab28345b8aba13ae82f8bc0694f15804"
           SHA256 = "d335d7e3a0ac77e132e9ea839591fa