hunt.io
Open in
urlscan Pro
52.223.52.2
Public Scan
URL:
https://hunt.io/blog/rekoobe-backdoor-discovered-in-open-directory-possibly-targeting-tradingview-users
Submission: On October 29 via api from IN — Scanned from DE
Submission: On October 29 via api from IN — Scanned from DE
Form analysis 0 forms found in the DOM
Text Content
Rekoobe Backdoor Discovered in Open Directory, Possibly Targeting TradingView Users Read Now Threat Hunting Platform - Hunt.io Home Product Features Resources About Login Book Your Free Demo Home Blog Rekoobe Backdoor Discovered in Open Directory, Possibly Targeting TradingView Users REKOOBE BACKDOOR DISCOVERED IN OPEN DIRECTORY, POSSIBLY TARGETING TRADINGVIEW USERS Published on Oct 24, 2024 TABLE OF CONTENTS IntroductionDiscovery of the Open Directory & MalwareInfrastructure Analysis: TradingView Lookalike Domains and Hosting ConnectionsExpanded Network Findings ConclusionNetwork ObservablesFile Information INTRODUCTION Rekoobe is a versatile backdoor previously deployed by APT31, also known as Zirconium, amongst other adversaries involved in cyber espionage and data theft. With code partially based on the publicly available Tiny SHell, the malware has evolved to use enhanced encryption techniques and unique command-and-control configurations to hinder analysis and evade detection. While researching open directories, we uncovered two Rekoobe samples, prompting a deeper investigation into the hosting IP. Upon further analysis, we discovered a handful of domains resembling TradingView, a widely used platform for worldwide charting, trading, and sharing financial insights traders use. These suspicious domains suggest a potential interest in targeting the site's community. By pivoting on shared SSH keys, we identified additional infrastructure potentially linked to this campaign and another open directory. DISCOVERY OF THE OPEN DIRECTORY & MALWARE We encountered an open directory at 27.124.45[.]146:9998 running Python version 3.12.4, SimpleHTTP 0.6, which exposed two binaries: 10-13-x64.bin and 10-13x86.bin. Both files were identified as Rekoobe by Hatching Triage, and their SHA-256 hashes are as follows: * 10-13-x64.bin: a1c0b48199e8a47fe50c4097d86e5f43a1a1c9a9c1f7f3606ffa0d45bb4a2eb3 (renamed na.elf in Triage) * 10-13-x86.bin: 28382231cbfe3bf7827c1a874b3d7f18717020ced516b747a2a1bb7598eabe0b Figure 1: Open directory page for 27.124.45[.]146 During dynamic analysis, both binaries attempted to communicate with the same IP address hosting the open directory, specifically targeting port 12345. The naming convention of the files, which follows a month-day-architecture format, is consistent with other Rekoobe samples we've seen in open directories. In our analysis of na.elf, we observed behavior closely resembling that identified by AhnLab as "NoodRAT" and Trend Micro as "Noodle RAT." Specifically, the file changes its process name and copies itself to the /tmp/CCCCCCCC directory, where it executes from. However, it's important to note that this alone does not definitively confirm that the binaries in this case are NoodRAT or Noodle RAT. The similarities in behavior could indicate the work of a copycat, but additional analysis would be required to make a conclusive attribution. Figure 2 depicts the process tree of na.elf as seen in the Hatching Triage analysis. Figure 2: Triage analysis of na.elf processes By clicking the 'Rekoobe' tag, users can easily find additional open directories hosting Rekoobe samples, as shown in Figure 1. Figure 3: Results of clicking the Rekoobe tag to find additional open directories hosting the malware INFRASTRUCTURE ANALYSIS: TRADINGVIEW LOOKALIKE DOMAINS AND HOSTING CONNECTIONS During our investigation into the IP address hosting the two backdoor files, we discovered several domains closely mimicking the legitimate TradingView site. These domains show slight variations in spelling that are indicative of typosquatting attacks: * tradingviewlll[.]com * admin.tradingviewlll[.]com * tradingviewll[.]com * admin.tradingviewll[.].com These minor changes, such as the addition of an extra "I" in tradingviewll[.]com and tradingviewlll[.]com, could easily be missed by users, making them practical for phishing or other social engineering operations. Figure 4: Domain overview showing typosquatting domains targeting TradingView Unfortunately, we could not capture any active web pages associated with these domains created earlier this year. According to the Wayback Machine, both domains returned a standard 404 Not Found Nginx response on 07 September this year. This means any web page may not have been fully deployed or is in a consistently inactive state. Figure 5: Wayback machine results for tradingviewll.com While we can't be sure these domains were used in this campaign, they represent an interesting infrastructure overlap when viewed alongside the presence of the Rekoobe backdoor. This could suggest an attempt to exploit financial platforms and their user base, as many of these systems rely on Linux. EXPANDED NETWORK FINDINGS Continuing our deep dive into 27.124.45[.]146, we found three IP addresses linked by shared SSH keys, suggesting a connection to our original server. This relationship was uncovered using the Hunt's Association tab, as shown in Figure 6. The IPs include: * 27.124.45[.]231 * 1.32.253[.]2 * 27.124.45[.]211 The SSH key (fingerprint: 62497b3e96db49f4fe99db3ecf65332a69a10f9823ececabb1ce805a0e6bd5ee) for all three was first observed by our scanners between late July and early August, and were last active on 04 October. Like the original open directory, these servers are also hosted in Hong Kong, indicating they are likely part of the same operational setup. Figure 6: The Associations Tab in Hunt displays associated IPs that can be pivoted to enhance investigations Among the IPs identified, 27.124.45[.]211 stood out as it also hosts an open directory (on the same port) running the same Python and SimpleHTTP versions and the duplicate Rekoobe-detected files as the original server ending in .146. Figure 7: Open directory contents for 27.124.45[.]211:9998 Clicking on the button containing the three dots next to the files opens a menu for further actions, including searching by SHA-256 to identify other locations where the file is hosted. As shown in Figure 8, this search confirms that the two IPs--.146 and .211--are the only servers hosting these Rekoobe samples. Interestingly, our scanners also detected the Yakit Security Tool on 27.124.45[.]211 We previously wrote about Yakit, an all-in-one cybersecurity application that integrates tools like Nuclei and includes features such as man-in-the-middle (MiTM) interception and web fuzzing. Primarily designed for legitimate security work by red teamers and researchers, Yakit's presence alongside Rekoobe and the typosquatting domains raises concerns about how this setup could be leveraged for malicious purposes. Combining these elements points to activity that merits further investigation to understand the potential risks involved fully. Figure 8: Results of SHA-256 search across all open directories for similar files CONCLUSION In this blog post, we explored how the discovery of the Rekoobe backdoor in an open directory revealed a broader network of potentially malicious infrastructure, lookalike domains mimicking TradingView, and additional servers linked via shared SSH keys. Hunting for malware in open directories can yield valuable insights into the servers behind attack campaigns. By leveraging tools like Hunt, security teams can uncover hidden threats and expand their visibility into attacker infrastructure. NETWORK OBSERVABLES IP AddressASNDomain(s)Host CountryNotes27.124.45[.]146CTG Server Limitedtradingviewlll[.]com admin.tradingviewlll[.]]com tradingviewll[.]com admin.tradingviewll[.]]comHKOpen directory containing two (2) Rekoobe samples.1.32.253[.]2BGPNET Global ASN70332[.]club 390698[.]ru 953388[.]cc 836833[.]cc 734439[.]com 56204[.]sx 49246[.]sx 836833[.]cc 94783[.]club 734439[.]com 963388[.]ccHKIP seen sharing SSH keys with 27.124.45[.]146 from 2024-07-20 - 2024-10-0427.124.45[.]231CTG Server LimitedN/AHKShared SSH keys from 2024-07-31 - 2024-10-0427.124.45[.]211CTG Server LimitedN/AHKShared SSH keys from 2024-07-31 - 2024-10-04 FILE INFORMATION File NameSHA-25610-13-x64.bina1c0b48199e8a47fe50c4097d86e5f43a1a1c9a9c1f7f3606ffa0d45bb4a2eb310-13-x86.bin28382231cbfe3bf7827c1a874b3d7f18717020ced516b747a2a1bb7598eabe0b RELATED POSTS: Oct 24, 2024 REKOOBE BACKDOOR DISCOVERED IN OPEN DIRECTORY, POSSIBLY TARGETING TRADINGVIEW USERS Discover how an open directory of Rekoobe malware samples led to different domains resembling trading platforms, posing risks for traders and investors. Oct 17, 2024 FROM WARM TO BURNED: SHEDDING LIGHT ON UPDATED WARMCOOKIE INFRASTRUCTURE Get an inside look at Warmcookie’s updated C2 infrastructure linked to its latest update. We reveal insights into newly identified servers that can assist defenders in identifying related servers. Oct 15, 2024 INTRODUCING CODE SEARCH ON ATTACKCAPTURE: UNCOVER EXPLOIT CODE, REVERSE SHELLS, C2 CONFIGS, AND MORE Read how CodeSearch helps security professionals to identify exploit code, reverse shells, and C2 configs across open directories, enhancing threat detection. Oct 10, 2024 UNMASKING ADVERSARY INFRASTRUCTURE: HOW CERTIFICATES AND REDIRECTS EXPOSED EARTH BAXIA AND PLUGX ACTIVITY Learn how basic tracking techniques using unusual certificates and redirects helped uncover Earth Baxia and a hidden cyber threat, providing practical insights for network defense. Ready to get started? We can help you unravel networks of threat actor infrastructure blending into hosting providers. Get a Free Demo Today Threat Hunting Platform - Hunt.io Threat Hunting Platform - Hunt.io Products Web Interface Feeds Enrichment API Features AttackCapture™ HuntSQL™ New C2 Detection IOC Hunter Phishing Infrastructure Resources Change Log Terms & Conditions Privacy Policy Support Docs Latest News Rekoobe Backdoor Discovered in Open Directory, Possibly Targeting TradingView Users Oct 24, 2024 From Warm to Burned: Shedding Light on Updated WarmCookie Infrastructure Oct 17, 2024 Introducing Code Search on AttackCapture: Uncover Exploit Code, Reverse Shells, C2 Configs, and More Oct 15, 2024 ©2024 Hunt Intelligence, Inc.