Cyber Hunting Technics

What is Cyber Security Hunting & How will be going benefit to the Org

Hunting: Is something where the unnoticed threat might be lying in an intranet. As a persona like threat hunter should apply his logicality technics to capture a threat or vulnerability. Hence, we identified prior exploiter or stopping future attacks.

Hunter Tools: He/She would apply his/her logics to unearth bots/vulnerabilities. Thus, they need external intel too.

Here logic is: If a person applying his thoughts definitely takes time to dig out the bot. But, if they were taking help from other external intel inputs as well. It is much lesser time to Identify.   

7/10/20

Hunting Topic & IOCs

HEH, a new IOT P2P Botnet going after weak telnet services

https://blog.netlab.360.com/heh-an-iot-p2p-botnet/

The HEH Botnet samples we captured was originally downloaded and executed by a malicious Shell script named wpqnbw.txt

 The malicious scripts and binary programs are hosted on pomf.cat Site(note here, prmf.cat is legit website, don’t block it). The beginning of wpqnbw.txt (similar to the subsequent content):

Universal Declaration of Human Rights

The initial state of this HTTP Server will be set :80/0 to :80/9 a total of 10 URIs, correspondingly, the Universal Declaration of Human Rights in 8 languages and 2 empty contents are displayed. For example, the :80/0 returns the  Chinese version of the “Universal Declaration of Human Rights” .

This article focuses on the UDP service component of HEH Botnet. This component has two key functions: UDP service port number generation and command parsing .

Communication module-Telnet service brute force cracking

After the Bot runs the P2P module, it will execute the brute force task against the Telnet service for the two ports 23 and 2323 in a parallel manner, and then complete its own propagation.

In other words, if the Telnet service is opened on port 23 or 2323, it attempts a brute-force attack using a password dictionary consisting of 171 usernames and 504 passwords. On a successful break-in, the newly infected victim is added to the botnet, thereby amplifying it

6d7502228afe0a56e13e40ae67b2a1d3aab0a3aa1411e2fc3d6d4e674e940d16

95199e8f1ab987cd8179a60834644663

4c345fdea97a71ac235f2fa9ddb19f05
66786509c16e3285c5e9632ab9019bc7
6be1590ac9e87dd7fe19257213a2db32
6c815da9af17bfa552beb8e25749f313
984fd7ffb7d9f20246e580e15fd93ec7
bd07315639da232e6bb4f796231def8a
c1b2a59f1f1592d9713aa9840c34cade
c2c26a7b2a5412c9545a46e1b9b37b0e
43de9c5fbab4cd59b3eab07a81ea8715