ESET ForSSHe December 2018

Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.

Kessel has collected the DNS address of the infected host.

Bonadan can find the external IP address of the infected host.

Kessel's configuration is hardcoded and RC4 encrypted within the binary.

Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.

Bonadan has discovered the username of the user running the backdoor.

Kessel has exfiltrated information gathered from the infected system to the C2 server.

Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.

Bonadan can use the ps command to discover other cryptocurrency miners active on the system.

Windigo has used a Perl script for information gathering.

Bonadan can create bind and reverse shells on the infected system.

Kessel can create a reverse shell between the infected host and a specified system.

Kessel has collected the system architecture, OS version, and MAC address information.

Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.

Windigo has used a script to detect which Linux distribution and version is currently installed on the system.

Windigo has used a script to check for the presence of files created by OpenSSH backdoors.

Kessel can use a proxy during exfiltration if set in the configuration.

Bonadan can download additional modules from the C2 server.

Kessel can download additional modules from the C2 server.

Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.

Kessel has decrypted the binary's configuration once the main function was launched.

Bonadan can download an additional module which has a cryptocurrency mining extension.

Windigo has used a script to detect installed software on targeted systems.

Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.

Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.

Kessel has trojanized the <sode>ssh_login</code> and user-auth_pubkey functions to steal plaintext credentials.

Kessel can RC4-encrypt credentials before sending to the C2.

Bonadan can XOR-encrypt C2 communications.