Malware-Traffic-Analysis.net - 2024-11-24: Redtail bash script for Linux malware

2024-11-24 (SUNDAY): "REDTAIL" BASH SCRIPT FOR LINUX MALWARE

NOTES:

Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website.

ASSOCIATED FILES:

2024-11-24-webserver-scans-and-probes.pcap.zip 1.6 MB (1,555,335 bytes)
2024-11-24-infection-by-Redtail-bash-script-from-45.202.35_190.pcap.zip 2.8 MB (2,824,646 bytes)
2024-11-24-Redtail-bash-script-and-malware-from-45.202.35_190.zip 1.7 MB (1,695,645 bytes)

2024-11-24 (SUNDAY): "REDTAIL" BASH SCRIPT FOR LINUX MALWARE HOSTED ON 45.202.35[.]190

NOTES:

- This is my investigation from a sample of "redtail" bash script pushed by scans/probes hitting one of my webservers.
- After downloading an ELF for the proper CPU architecture, the initial bash script changes the name of the ELF to ".redtail"
- I've noticed versions of this script for several months now, so I wanted to see traffic generated from an infection.
- The initial URL hosting the Redtail bash script at hxxp[:]//45.202.35[.]190/sh has been active as early as 2024-11-23 at
  21:28 UTC.

SCANS/PROBES PUSHING REDTAIL BASH SCRIPT HOSTED ON 45.202.35[.]190:

  (Read: Date/time - Source IP address - HTTP request to my web server)

- 2024-11-23 21:28:27 UTC - 8.222.225[.]103 - POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
- 2024-11-23 22:23:16 UTC - 4.213.162[.]155 - POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
- 2024-11-23 22:23:17 UTC - 4.213.162[.]155 - POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
  %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
- 2024-11-23 22:23:22 UTC - 4.213.162[.]155 - POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
- 2024-11-24 02:32:13 UTC - 47.236.167[.]8 - POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
- 2024-11-24 07:10:39 UTC - 132.145.74[.]179 - POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
- 2024-11-24 07:10:40 UTC - 132.145.74[.]179 - POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
  %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
- 2024-11-24 07:10:40 UTC - 132.145.74[.]179 - POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
- 2024-11-24 07:54:01 UTC - 47.236.136[.]217 - POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
- 2024-11-24 08:05:42 UTC - 8.222.152[.]112 - POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
- 2024-11-24 09:17:43 UTC - 47.236.150[.]50 - POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
- 2024-11-24 14:25:20 UTC - 8.222.197[.]158 - POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
- 2024-11-25 00:03:59 UTC - 8.222.137[.]97 - POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh

ASSOCIATED FILES:

- SHA256 hash: aed29398112ad074b8fd8a2e25020fb01db1f8cdaff86326222529dbeba5746b
- File size: 1,594 bytes
- File type: Bourne-Again shell script text executable, ASCII text
- File location: hxxp[:]//45.202.35[.]190/sh
- File description: Initial "redtail" script pushed by the scans/probes

- SHA256 hash: d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e
- File size: 795 bytes
- File type: Bourne-Again shell script text executable, ASCII text
- File location: hxxp[:]//45.202.35[.]190/clean
- File description: Follow-up script retreived for this infection

- SHA256 hash: 29f8524562c2436f42019e0fc473bd88584234c57979c7375c1ace3648784e4b
- File size: 1,692,620 bytes
- File type: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), statically linked, no section header
- File location: hxxp[:]//45.202.35[.]190/x86_64
- File description: Linux Executable File (ELF) retrieved for this infection

IMAGES

Shown above: Traffic in Wireshark from the scans/probes hitting my web server, filtered to show only those URLs pushing the Redtail bash script from 45.202.35[.]190.

Shown above: Traffic filtered in Wireshark that I generated by infecting a Linux host with the Redtail bash script.

Shown above: Initial HTTP GET request for the Redtail bash script, with the ".redtail" highlighted.

Shown above: Follow-up HTTP GET requested for the ELF file also hosted on 45.202.35[.]190.

Click here to return to the main page.