Procedure examples

Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.

Ebury acts as a user land rootkit using the SSH service.

If credentials are not collected for two weeks, Ebury encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.

Ebury has obfuscated its strings with a simple XOR encryption with a static key.

Ebury exfiltrates a list of outbound and inbound SSH sessions using OpenSSH's `known_host` files and `wtmp` records. Ebury can exfiltrate SSH credentials through custom DNS queries or use the command `Xcat` to send the process's ssh session's credentials to the C2 server.

Ebury can use the commands `Xcsh` or `Xcls` to open a shell with Ebury level permissions and `Xxsh` to open a shell with root level.

Ebury has used Python to implement its DGA.

Ebury has used DNS requests over UDP port 53 for C2.

Ebury is executed through hooking the keyutils.so file used by legitimate versions of `OpenSSH` and `libcurl`.

Ebury has encoded C2 traffic in hexadecimal format.

Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.

Ebury has intercepted unencrypted private keys as well as private key pass-phrases.

Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.

Ebury modifies the `keyutils` library to add malicious behavior to the OpenSSH client and the curl library.

Ebury can intercept private keys using a trojanized ssh-add function.

Ebury can deactivate PAM modules to tamper with the sshd configuration.

Ebury has used a DGA to generate a domain name for C2.

Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.

When Ebury is running as an OpenSSH server, it uses LD_PRELOAD to inject its malicious shared module in to programs launched by SSH sessions. Ebury hooks the following functions from `libc` to inject into subprocesses; `system`, `popen`, `execve`, `execvpe`, `execv`, `execvp`, and `execl`.

Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.

Ebury disables OpenSSH, system (`systemd`), and audit logs (`/sbin/auditd`) when the backdoor is active.