The script additionally deletes numerous system logs and can arrange persistence on the system by registering a number of cron jobs and including the attacker’s SSH key to the system. Extra importantly, it downloads and deploys a rootkit known as Diamorphine. This rootkit operates as a kernel module that’s loaded with the insmod command and its goal is to cover the attacker’s processes on the system.
If the insmod command fails, the attackers compile Diamorphine from supply as a Linux Shared Object file after which use the LD Preload method to register it with the dynamic linker, ensuing within the malicious file executing each time a brand new executable is launched on the system.
“Diamorphine is well-known in Linux malware circles, with the rootkit being noticed in campaigns from TeamTNT and, extra just lately, Kiss-a-dog,” the Cado researchers stated. “Compiling the malware on supply is frequent and is used to evade EDRs and different detection mechanisms.”
Lastly, the mi.sh script searches the native directories for AWS and Google Cloud entry tokens and exfiltrates any which are discovered to a Telegram group. The Cado researchers deliberately positioned an AWS token on their honeypot system and instantly noticed an try to make use of it to entry the related AWS account. Qubitstrike additionally acts like a SSH work, with the script attempting to connect with all of the IP addresses listed within the SSH hosts file on the system and making an attempt to push mi.sh to them.
Extra implants present in Codeberg repository
By investigating the Codeberg repository that hosted the mi.sh script, the researchers uncovered further scripts and payloads together with an implant written in Python and known as kdfs.py. As soon as executed on a system, this implant will act as a bot that may be part of a Discord server and channel and watch for instructions. It additionally helps downloading and importing recordsdata by the Discord attachment function.
“The identify of the server used is ‘NETShadow,’ and the channel the bot posts to is ‘victims’,” the researchers stated. “The server additionally had one other channel titled ‘ssh.’ Nevertheless, it was empty. All the channels have been made at the very same time on September 2, 2023, suggesting that the creation course of was automated. The bot’s username is Qubitstrike (therefore the identify we selected to offer to the malware).”
