Shellbot Remote Access Trojan
First observed in 2005, Shellbot is a remote access trojan primarily used as a backdoor and downloader for other malware. Despite its age, Shellbot continues to be a popular choice for threat actors and is now being used in cryptocurrency mining campaigns against Drupal web servers.
Shellbot is distributed using exploits for two Drupal vulnerabilities to gain access; CVE-2018-7600 (also known as Drupalgeddon 2.0) and CVE-2018-7602. Potentially vulnerable websites are first identified using automated scans, before the exploits are deployed to gain access to the underlying server.
Once this is done, Shellbot will use CVE-2018-7600 to escalate its privileges before connecting to a command and control server over IRC. It will then detect and terminate all cryptocurrency mining applications on the server before installing it’s own miner. Shellbot is also able to use the infected server in spam and phishing campaigns, to perform distributed denial-of-service attacks and to scan for new devices to infect.
For further information:
Resolution
Drupal has released updates to address both CVE-2018-7600 and CVE-2018-7602 earlier this year. Affected organisations should apply these updates immediately if they have not already done so. The NCSC Web Check tool can be used to identify vulnerable Drupal installations.
Indicators of Compromise
| 104.236.44.248 |
| 112.216.147.83 |
| 146.185.171.227 |
| 149.202.153.56 |
| 158.69.198.91 |
| 173.45.100.18 |
| 178.254.30.145 |
| 187.63.160.3 |
| 188.165.248.37 |
| 188.246.204.121 |
| 190.60.0.0 |
| 190.61.255.255 |
| 190.61.5.15 |
| 192.95.12.34 |
| 194.60.242.251 |
| 195.160.232.92 |
| 195.242.220.89 |
| 195.95.205.130 |
| 198.23.135.209 |
| 199.19.105.102 |
| 200.185.236.85 |
| 200.91.29.67 |
| 200.98.114.143 |
| 202.171.68.144 |
| 202.191.121.230 |
| 202.202.121.27 |
| 203.130.240.38 |
| 213.5.67.223 |
| 216.158.240.36 |
| 217.114.212.26 |
| 217.160.105.37 |
| 222.73.18.162 |
| 223.252.35.159 |
| 3.4.5.6 |
| 31.184.194.100 |
| 31.184.194.114 |
| 31.204.80.133 |
| 37.59.74.161 |
| 46.101.210.240 |
| 46.16.170.158 |
| 46.235.10.34 |
| 46.235.15.255 |
| 50.84.167.237 |
| 62.113.208.196 |
| 64.34.216.214 |
| 67.208.91.118 |
| 67.228.164.154 |
| 67.228.255.255 |
| 69.89.2.153 |
| 74.208.166.12 |
| 78.47.78.165 |
| 82.165.11.172 |
| 85.214.60.234 |
| 87.229.108.74 |
| 89.248.172.144 |
| 93.115.85.69 |
| 93.115.85.85 |
| 95.110.228.144 |
| 96.126.116.50 |
| 98.142.215.182 |
| 0d6da4db11d4.pl |
| 0day.jp |
| 1.zip |
| 18eb3a4122f9.pl |
| 2.pl |
| adm.pl |
| agent.ao |
| all1gat0r.blogspot.com |
| as.pl |
| asmodeus.pl |
| atrix-team.org |
| b.pl |
| backconn.pl |
| backdoor.ac |
| backdoor.ag |
| banner313.pl |
| beta2.zip |
| bilder-upload.eu |
| bossanova-web.com |
| br20.net |
| brasnet.org |
| bruteforcer.pl |
| bugbopper.com |
| by.ru |
| bypass.pl |
| byroe.net |
| c.org |
| castle-estates.uk.com |
| checker.pl |
| clickers.pl |
| conback.pl |
| connectback2.pl |
| cox.pl |
| crawler.pl |
| daehanultravision.com |
| decrypt.zip |
| delabernabela.com.ar |
| delibare.alwaysdata.net |
| detux.org |
| dialer.pw |
| dreniq.com |
| dumper.pl |
| fileam.com |
| fileden.com |
| flooder.pl |
| flooder.pr |
| generator.pl |
| geocode.farm |
| gigachat.net |
| grabber.pl |
| graber.pl |
| hce.edu.vn |
| hi2.ro |
| iasics16.ro |
| ifxcorp.com |
| inamidst.com |
| inforelay.com |
| infostealer.cm |
| ircbot.am |
| kickslion.net |
| lister.pl |
| n.com |
| on.pl |
| pbot.pl |
| perl.pl |
| perl.shellbot.bd |
| perl.shellbot.fj |
| perlbot.pl |
| php.kg |
| php.webshell.bd |
| phpbackdoorconnect.pl |
| pma.pl |
| pora.pl |
| program.pl |
| r57pws.pl |
| regular.bot |
| satanbot.pl |
| scan5.pl |
| scanner.pl |
| script.pl |
| shares.pl |
| shell.at |
| shellbot.cx |
| shellcode.fr |
| softlayer.com |
| stepd.com |
| strangled.net |
| style-s.ru |
| suryaselindo.co.id |
| systems.pl |
| themilliononline.com |
| ubimed.com |
| va.pl |
| void.ru |
| vulner.pl |
| vulnz.pl |
| webshell.pl |
| whoopis.com |
| wiresix.com |
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.