Meet Muhstik - IoT Botnet Infecting Cloud Servers

File specimens with the Muhstik configs can be identified with the following sequence of bytes which is the XOR’d value of the “muhstik” keyword. Note: Several muhstik payloads are UPX packed so they this is only observable in unpacked binaries:

 

4F 57 4A 51 56 4B 49 0F

 

The decoded configuration for the Muhstik scanning module has common settings seen in many Mirai -based variants. These include

• Memory scraping settings. This functionality is used for killing competing malware. In this case there were parameters for the Zollard IoTIOT botnet:
  • “”””\x58\x4D\x4E\x4E\x43\x50\x46\x22 “zollard.

• An unused RickRoll : https://youtu.be/dQw4w9WgXcQ

Infrastructure & Attribution

Examination of Muhstik’s attack infrastructure exposed some interesting correlations. IRC C2 irc.de-zahlung.eu was found to be sharing an SSL cert with site jaygame.net. Jaygame.net is an amateur site about a game involving an Anime character named ‘Jay’. The site is currently leveraging Google Analytics ID UA-120919167-1.

A reverse Google Analytics search exposed 3 domains with records for the same ID:

• jaygame.net
• fflyy.su
• kei.su

Figure 1: Jaygame.net

The two other domains linked to the analytics ID (ffly.su and kei.su) were also configured as C2s for various other Linux Tsunami malware linked to the same infrastructure. If the infrastructure is administered by a single attacker then we can presume it’s related. 

Figure 2: Muhstik Infrastructure links

This related infrastructure has allowed possible attribution to what Lacework has dubbed “Wasp 8220”. This set of activity has been tied to other cryptomining variants and Linux backdoors . These all have links to the same malware upload path belonging to Chinese forensics firm Shen Zhou Wang Yun Information Technology Co., Ltd. The following are related Virus Total submission artifacts. In all cases, these were seen prior to attacks in the wild and prior to the infrastructure becoming operational. Also, the original specimens were only uploaded one-time suggesting Shen Zhou Wang Yun is likely the malware originator and not simply the first uploader. One of the uploads (.x_3sh) had zero detections and appears to be the first Muhstik downloader.

Virus Total Upload Path	Date	Description
/home/wys/shenzhouwangyun/shell/downloadFile/tomato.deutschland-zahlung.eu_nvr	2018-12-22	upload path has reference for Muhstik domain deutschland-zahlung.eu
/home/wys/shenzhouwangyun/shell/downloadFile/y.fd6fq54s6df541q23sdxfg.eu_nvr	2018-11-06	upload path has reference for Muhstik domain fd6fq54s6df541q23sdxfg.eu
/home/wys/shenzhouwangyun/shell/downloadFile/o.kei.su_qn	2018-11-27	Upload path has reference for Muhstik domain kei.su
/home/wys/shenzhouwangyun/shell/downloadFile/.x_3sh	2018-11-11	Muhstik installer
/home/wys/shenzhouwangyun/shell/downloadFile/.x_mine	2018-11-27	Linked by way of domain derpcity.ru which was seen in malware also configured with fflyy.su and kei.su.  File has URL with  77.233.160.103 which is passive DNS host for derpcity.ru.

 

Figure 3: Original Muhstik installer script (uploaded by Shen Zhou Wang Yun Information Technology Co., Ltd)

Other characteristics of note in Muhstik malware and infrastructure were numerous references to Anime. The following table lists references observed in Muhstik activity:

Indicator	Notes
jaygame.net	The site’s content and image describes an anime themed game
Kei.su	Japanese name “Kei” – possible reference to several different Anime characters
Pokemoninc.com	Clear reference to Pokemon
Keiku doori	Malware string seen in several specimens. This is aThis a misspelling of keikaku doori which is Japanese for “Just as Planned”. Most likely a reference to Anime Death note
nandemo shiranai wa yo shitteru koto dake	Malware string. A Japanese saying seen in several Anime memes
https://www.youtube.com/watch?v=Jzqy6UJXpcQ	Now removed but used to be music from anime GochiUsa. Used in botnet protocol from related Irc botnet

 

Anime references are not unique to Muhstik however it was a common theme worth highlighting.  

For example in 2015, the “cereal” IoT botnet was also observed downloading Anime videos as part of an alleged hobby project . Also, .anime was a frequent process artifact in IoT malware variants and was targeted by Mirai’s memory scraping module. This is observable in the decoded config for the Muhstik scanner module. For IoTs botnets of Chinese origin, this would make sense due to the massive popularity of Anime in China.  

The Muhstik botnet has been using the same C2 domains for the last two years so the provided indicators will likely help with detecting any existing Muhstik infections. As far as prevention, we highly recommend regular scans for the vulnerabilities listed in table 1. 

If you’d like to learn more about how Lacework can automate host vulnerability scanning in the cloud, then please reach out!