Objectives

In this report, we will conduct a comprehensive analysis of Gafgyt, which is an ELF malware. Our aim is to examine the malware’s capabilities and determine its functions:

• DDoS Attack Capabilities
• Communication with Command and Control (C&C) Server
• Evade detection
• Network Setup and Configuration
• Process Manipulation

Overview

Gafgyt malware, which is also known as Bashlite has targeted millions of vulnerable IoT devices in the last few years. Gafgyt is a Linux-based botnet.It receives commands from C2 server to perform multiple types of TCP and UDP DoS attacks

According to Kaspersky Gafgyt family is used for DDoS attacks and consists of ELF files controlled by C&C servers.

It targets vulnerable Internet of Things (IoT) devices like Huawei routers, Realtek routers, and ASUS devices, which it then uses to launch large-scale distributed denial-of-service (DDoS) attacks.

Static Analysis

Let’s see the sample in VirusTotal

Gafgyt contacts with URLs, domains, and potentially malicious IP addresses.

Let’s see its strings

strings a9662b56d8409b4c022c5b3d3f0bcf00ea353220960191e3fe3cc239b874b3aa.elf

There are some interesting strings:

User agents for various browsers and devices

SendHTTP can be used to send HTTP requests.

Malware could use HTTP requests to communicate with command and control servers, download additional payloads, exfiltrate data, or perform other malicious activities over the internet.

Let’s see if the sample is packed or not. I’ll use DIE

DIE says that it’s packed, but it’s not always correct.

Let’s see its functions

gdb a9662b56d8409b4c022c5b3d3f0bcf00ea353220960191e3fe3cc239b874b3aa.elf
(gdb) info functions

There are intriguing functions

Behavioral Analysis

Let’s run the sample to see what IPs the malware communicates with.

I think we got the malware C2 server IP

91.92.244.11:19302

Virus Total says that this ip address is malicious

Code Analysis

Let’s open the sample in IDA

Network reconnaissance.

Next we have a function named by getOurIP. Let’s see it.

This function creates a UDP socket which is a communication endpoint that enables malware to send and receive data using the User Datagram Protocol (UDP).

After that, it establishes a connection to Google DNS (8.8.8.8). This connection has a two-fold purpose: firstly, it serves as a means to ensure that the malware can successfully create outgoing network connections, and secondly, it allows the malware to send DNS queries, which can be used for various purposes.

Next, it retrieves the local socket’s address and port by querying the operating system. Knowing the local IP address and port is crucial for the malware to identify the network interface through which it is communicating and to determine how other devices on the network can reach it.

Then it finds the default gateway, which is the network device responsible for transmitting traffic destined for external networks. By determining the default gateway, the malware gains information about the network topology and the path outgoing traffic takes to reach destinations outside the local network.

Finally, it extracts the default gateway’s MAC address. By obtaining the MAC address of the default gateway, the malware gains additional information about the network infrastructure, which could be used for various purposes such as network reconnaissance or creating spoofed packets.

Process Manipulation

Next the malwares creates a child process. The parent waits for the child to exit to exit also. Meanwhile the first child creates a second child process that will be the daemon process.

The malware sets up the daemon process. First, the process is detached from the controlling terminal, its working directory is changed to the root directory, and a signal handler is set up to ignore the SIGPIPE signal.

This is a setup process for a daemon process that has been created by malware. It ensures that the daemon process can operate independently without relying on any specific terminal or directory. Additionally, it handles certain signals to prevent unexpected terminations.

The next function sets up a socket connection with a server which is done by the following:

1. Specify the server’s address and port number that the client wants to connect to.

2. Create a socket and initiate the connection request to the server.

3. Once the connection is established, data can be exchanged between the client and the server.

Information Gathering Functions:

getArch() function returns “x86_32”, indicating that the system architecture is 32-bit x86. The result of this function is assigned to the variable Arch for later use in the malware’s operation.

Next we have getPortz()

This function checks for the presence of certain executables (python, python3, perl, and telnetd) and returns the port number associated with SSH (22) if any of them are found. If none are found or if Telnet is not available, it returns “Unknown Port”. The return value is assigned to “Portz”.

inet_ntoa(ourIP) takes an IPv4 address in binary form (ourIP) and converts it into a string representation in standard dotted-decimal notation. This notation separates the four octets of the IPv4 address with periods, resulting in a human-readable IP address format.

For example, if ourIP is represented in binary form as “11000000101010000000101000000001”, the function would convert it to the string “192.168.10.1” in dotted-decimal notation.

System Configuration

UpdateNameSrvs update the DNS resolver configuration file /etc/resolv.conf with Google’s public DNS server addresses (8.8.8.8 and 8.8.4.4).

RemoveTempDirs removes temporary directories and files, as well as terminate certain processes.

Processes to be terminated:

badbox
busybox
perl
python

It may be part of the malware’s strategy to evade detection, remove competing malware, or ensure system stability for its own operation.

Communication

This function sends a formatted message over the socket mainCommSock. It includes the IP address stored in v9, the port stored in Portz, and the architecture stored in Arch. The text is displayed in bright magenta color.

Then we have a loop that is responsible for handling communication with clients. It likely listens for incoming connections, receives commands from clients, processes these commands, and manages child processes as needed.

Now let’s go to the last call processCmd

This part deals with network communication, specifically handling TCP and UDP connections.

C&C Commands

TCP Command

• This command calls ftcp function that crafts and sends TCP packets with specified TCP flags set according to the provided a5 parameter.

UDP Command

• This command calls SendUDP function that crafts and sends UDP packets with a randomized sequence of payload data.

VSE Command

• This command calls vseattack function that sends the payload over the network, randomizes the destination IP address and computes and updates the checksum for the packet.

STDV3 Command

• This command calls SendSTDV function that generates a series of random hexadecimal values that are accumulated and concatenated to form a payload. The payload is then presumably sent over the network using the socket.

UDPBYPASS Command

• This command calls vseattack and astd functions, astd sends data through the socket and connects to an address and it checks if a certain amount of time has passed since the start of the function and exits if so.

JUNK Command

• This command calls ajunk function that manages multiple sockets, performs I/O operations, and handles errors in a networked environment.

LAYER3 Command

• This command calls aLAYER3 function that continuously sends data packets over a network while monitoring the elapsed time, and it terminates when the specified time limit is reached.

HOME Command

• This command calls SendUDP and astd functions

HOLD Command

• This command calls ahold function that manages network connections, including socket creation, data transmission, and reception, while also monitoring the elapsed time and terminating when necessary.

FORTNITE Command

• This command calls rtcp function that sends TCP packets to random IP addresses within a specified time frame or packet count. It may be used for network stress testing or other network-related tasks.

R6 Command

• This command calls RandHex function that generate a long hexadecimal values.

ARK Command

• This command calls RandHex function

NULLROUTE Command

• This command calls atcp function that constructs an IP packet and sends the constructed packets.

VPN-BETA Command

• This command calls rtcp and vpnattack functions, vpnattack performs a DoS attack against a target host.

OVH-BETA Command

• This command calls atcp and SendSTDV functions

HANDSHAKE Command

• This command calls atcp and ftcp functions

XMAS Command

• This command calls rtcp function

SSH-KILL Command

• This command calls rtcp and aLAYER3 functions

KILLALLV7 Command

• This command calls rtcp, ftcp, atcp and astd functions

CRUSH Command

• This command calls atcp and SendSTDV functions

STOMP Command

• This command calls audp, atcp, and SendSTD_HEX functions

  • audp is designed to flood a target host with network packets, either using UDP or TCP protocol, depending on the specified protocol type.
  • SendSTD_HEX sends hexadecimal data over a socket.

HEX Command

• This command calls astd function

HTTP Command

• This command calls SendHTTP function that sends HTTP requests using the provided HTTP method, target host, URI, and a randomly selected user agent to a server

STOP Command

• This command calls kill function that sends a kill signal to the process identified by the PID.

CLEAN Command

• This command removes temporary directories and files, as well as terminate certain processes and sends HTTP requests based on input parameters.

User Agents

Summary

Gafgyt is a type of malware that waits for command and control (C&C) instructions to execute distributed denial of service (DDoS) attacks.

IOCs

C2 Server :
  91.92.244.11:19302
Sha256:
  a9662b56d8409b4c022c5b3d3f0bcf00ea353220960191e3fe3cc239b874b3aa

References

• https://threats.kaspersky.com/en/threat/Backdoor.Linux.Gafgyt/#:~:text=This%20family%20consists%20of%20malicious,used%20to%20perform%20DDoS%20attacks.
• https://securityscorecard.com/wp-content/uploads/2024/01/Report-A-Detailed-Analysis-Of-The-Gafgyt-Malware-Targeting-IoT-Devices.pdf
• https://threatpost.com/gafgyt-botnet-ddos-mirai/165424/

This report is authored by Mostafa Farghaly(M4lcode).