170 lines
14 KiB
Plaintext
170 lines
14 KiB
Plaintext
██████╗ █████╗ ██████╗ ██╗██████╗ ███████╗
|
|
██╔══██╗██╔══██╗██╔══██╗██║██╔══██╗╚════██║
|
|
██████╔╝███████║██████╔╝██║██║ ██║ ██╔╝
|
|
██╔══██╗██╔══██║██╔═══╝ ██║██║ ██║ ██╔╝
|
|
██║ ██║██║ ██║██║ ██║██████╔╝ ██║
|
|
╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚═╝
|
|
M A L W A R E L A B S
|
|
==========================================================
|
|
Enhanced Linux BPFDoor Detection Script
|
|
==========================================================
|
|
Host : eve
|
|
Date : 2026-03-27_13-23-32
|
|
Version: 1.1
|
|
==========================================================
|
|
[2026-03-27 13:23:32] [INFO] [1/12] Checking /var/run for suspicious zero-byte mutex/lock files
|
|
[2026-03-27 13:23:32] [SUCCESS] [1/12] No known suspicious mutex/lock files found
|
|
[2026-03-27 13:23:32] [INFO] [2/12] Checking /etc/sysconfig for suspicious auto-start entries
|
|
[2026-03-27 13:23:32] [WARN] [2/12] /etc/sysconfig not present; skipping
|
|
[2026-03-27 13:23:32] [INFO] [3/12] Inspecting BPF filters via ss -0pb
|
|
Netid Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
|
|
p_raw 0 0 LLDP:enp2s0 * users:(("systemd-network",pid=1036734,fd=17))
|
|
bpf filter (12): 0x20 0 0 0, 0x15 1 0 25215488, 0x06 0 0 0, 0x28 0 0 4, 0x15 3 0 0, 0x15 2 0 3, 0x15 1 0 14, 0x06 0 0 0, 0x28 0 0 12, 0x15 1 0 35020, 0x06 0 0 0, 0x06 0 0 4294967295,
|
|
p_raw 0 0 LLDP:enp1s0 * users:(("systemd-network",pid=1036734,fd=18))
|
|
bpf filter (12): 0x20 0 0 0, 0x15 1 0 25215488, 0x06 0 0 0, 0x28 0 0 4, 0x15 3 0 0, 0x15 2 0 3, 0x15 1 0 14, 0x06 0 0 0, 0x28 0 0 12, 0x15 1 0 35020, 0x06 0 0 0, 0x06 0 0 4294967295,
|
|
[2026-03-27 13:23:32] [SUCCESS] [3/12] No obvious BPFDoor-like BPF filters found
|
|
[2026-03-27 13:23:32] [INFO] [4/12] Checking RAW and packet socket usage (SOCK_RAW / SOCK_DGRAM)
|
|
[2026-03-27 13:23:33] [ALERT] Suspicious Socket detected: PID 1036734 (/lib/systemd/systemd-networkd) -> /usr/lib/systemd/systemd-networkd
|
|
[2026-03-27 13:23:33] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/systemd/libsystemd-shared-249.so (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
491000004e1000005010000000000000511000005310000056100000581000005b100000
|
|
000000000000008878000012000f000051100000000000b7010000000000005e20000012
|
|
3000000000000bc86000012000f00b04511000000000014010000000000000b440000120
|
|
-------------------------------
|
|
[2026-03-27 13:24:00] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/systemd/systemd-networkd (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
00000000000009074090000000000086511000000000008000000000000001d910c00000
|
|
0000020651100000000000800000000000000507c0900000
|
|
000004865110000000000080000000000000024910c00000
|
|
-------------------------------
|
|
[2026-03-27 13:24:14] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
f6ec009d80b85f8feffff660f62c70f8482000000410fb6872103000041899f2c0300006
|
|
10fb644240483e00f49837c2408000f8482000000b998fbffff488914240fa3c10f82880
|
|
5ffff4c89e731c0e8552fffff488db42482000000488d3d53160100e831f5ffff4c89e73
|
|
-------------------------------
|
|
[2026-03-27 13:24:17] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
5ff746b66817ff82c7175634885d20f848200000085f6752e488b4708488947104883ef0
|
|
6817ff82c717577488d77f84885db0f848200000066817bf82c71757a488b5328b801000
|
|
-------------------------------
|
|
[2026-03-27 13:24:17] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
8fdffffe819f8ffff4989c74885c00f8482000000f605abd902001075314889efe85cf2f
|
|
2b1425280000000f85c30200004881c4482000005b5d415c415d415e415fc30f1f800000
|
|
58b6f0c418b5708450fafee4585ed0f8482000000410fb6470489c183e17f80f90574043
|
|
-------------------------------
|
|
[2026-03-27 13:24:20] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libc.so.6 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
0000000000000571a000012000f00d0a5110000000000e801000000000000822a0000220
|
|
0000000000000535b000012000f0040a51100000000008a00000000000000ff600000120
|
|
0000000000000433e000022000f0040e51100000000000b00000000000000907a0000220
|
|
-------------------------------
|
|
[2026-03-27 13:24:41] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libcap.so.2.44 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
0d0970000000000000800000000000000f270000000000000d8970000000000000800000
|
|
0709a0000000000000800000000000000f270000000000000809a0000000000000800000
|
|
0d270000000000000de70000000000000f27000000000000007710000000000001971000
|
|
-------------------------------
|
|
[2026-03-27 13:24:42] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libcrypto.so.3 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
000000004b1000004d1000004e1000005110000052100000561000005710000058100000
|
|
f1000000211000003110000041100000511000006110000081100000a1100000b1100000
|
|
0000000221100002311000024110000251100000000000028110000291100002a1100002
|
|
-------------------------------
|
|
[2026-03-27 13:25:24] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
913000000000008000000000000003805110000000000286913000000000008000000000
|
|
000008005110000000000306913000000000008000000000
|
|
00000c805110000000000386913000000000008000000000
|
|
-------------------------------
|
|
[2026-03-27 13:25:36] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
085b5dc30f1f440000488b7708488bbd48200000ffd04883f8ff7435488b6b484885c074
|
|
4885d20f8ed6000000488b7308488bb8482000004801ee41ffd44883f8ff75cf488b4b20
|
|
0048c743280000000031d231f6488bb84820000041ffd44585ed744fe889d4ffff41bdff
|
|
-------------------------------
|
|
[2026-03-27 13:25:38] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libip4tc.so.2.0.0 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
000000000000000000000000000000064820000000000000701000000000000000000000
|
|
-------------------------------
|
|
[2026-03-27 13:25:39] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
04183fd0a0f84ac0000004183fd010f84820000008b550031c085d2740a80bdc80000000
|
|
801742b83f8020f840201000085c00f8482000000b80b0000004883c4185b5d415c415d4
|
|
408488306014883680801c64014ff0f8482000000488b0e4839cf75da5bb8010000005d4
|
|
-------------------------------
|
|
[2026-03-27 13:25:40] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libmount.so.1.1.0 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
5bad701004889dfe8c91effff85c00f8482000000488d35ebe501004889dfe8b21effff8
|
|
0200100e95afdffff483debe027000f84820000007e4b483deeffc00074374c8d2d5c200
|
|
885ff0f848e000000803f004889fd0f848200000031f6e823d3fdff4989c44885c00f84b
|
|
-------------------------------
|
|
[2026-03-27 13:25:43] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
0000f2ec37c1c412182e514be465b10a9352000000000000000000000000000000000000
|
|
8bf00100000488b7010ff104885c00f8482000000498b5660488910498946604883c0104
|
|
b6c242848c1e003837c2418284488bc24820000000f94c280bc24810000008648898424a
|
|
-------------------------------
|
|
[2026-03-27 13:25:49] [CRITICAL] Little-Endian Magic Bytes found in mapped file: /usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8 (PID: 1036734)
|
|
------- HEXDUMP CONTEXT -------
|
|
04c897424584c8bb424f0000000c6842482000000008bb424e80000004c897424404c8bb
|
|
c395c24580f87f30600004589c1c6842482000000014183e00741c1e9034d29cb4c895c2
|
|
c2440010000488984245001000080bc248200000000741a488b442438488984242001000
|
|
-------------------------------
|
|
[2026-03-27 13:25:57] [INFO] [5/12] Checking for suspicious environment variables
|
|
[2026-03-27 13:26:06] [SUCCESS] [5/12] No processes with the full suspicious env var set found
|
|
[2026-03-27 13:26:06] [INFO] [6/12] Checking TCP ports 42391-43390 and 8000
|
|
[2026-03-27 13:26:06] [SUCCESS] [6/12] No connections on known suspicious BPFDoor ports
|
|
[2026-03-27 13:26:06] [INFO] [7/12] Checking for masqueraded processes (Verifying true execution paths)
|
|
[2026-03-27 13:26:44] [CRITICAL] [7/12] Process Masquerading Detected! PID=1043 claims to be '/sbin/agetty -o -p -- \u --noclear tty1 linux' but is actually executing '/usr/sbin/agetty (deleted)'
|
|
[2026-03-27 13:29:14] [INFO] [8/12] Checking for processes executing deleted binaries (Fileless execution)
|
|
[2026-03-27 13:29:14] [CRITICAL] PID: 1043 masquerading as 'agetty' running from a deleted file: /usr/sbin/agetty (deleted)
|
|
[2026-03-27 13:29:14] [WARN] PID: 1063, ProcessName: unattended-upgr, Exec: /usr/bin/python3.10 (deleted) (Deleted Binary)
|
|
[2026-03-27 13:29:14] [WARN] PID: 946, ProcessName: networkd-dispat, Exec: /usr/bin/python3.10 (deleted) (Deleted Binary)
|
|
[2026-03-27 13:29:14] [WARN] PID: 971, ProcessName: systemd-logind, Exec: /usr/lib/systemd/systemd-logind (deleted) (Deleted Binary)
|
|
[2026-03-27 13:29:14] [INFO] [9/12] Checking kernel stacks for raw socket blocking (packet_recvmsg/wait_for_more_packets)
|
|
[2026-03-27 13:29:14] [SUCCESS] [9/12] No processes blocking on suspicious packet socket kernel functions
|
|
[2026-03-27 13:29:14] [INFO] [11/12] Checking for active connections to known BPFDoor C2 domains
|
|
[2026-03-27 13:29:15] [CRITICAL] Active Reverse Shell to BPFDoor C2: ntpussl.instanthq.com (204.16.169.54)
|
|
Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
|
|
[2026-03-27 13:29:16] [CRITICAL] Active Reverse Shell to BPFDoor C2: ntpd.casacam.net (127.0.0.1)
|
|
Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
|
|
[2026-03-27 13:29:16] [CRITICAL] Active Reverse Shell to BPFDoor C2: ntpupdate.ygto.com (127.0.0.1)
|
|
Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
|
|
[2026-03-27 13:29:16] [INFO] [12/12] Checking specific processes for hardcoded BPFDoor file signatures
|
|
[2026-03-27 13:29:16] [SUCCESS] [12/12] No hardcoded process signatures detected
|
|
[2026-03-27 13:29:16] [INFO] [10/12] Deep scanning candidate binaries (hash, strings, UPX packing)
|
|
[2026-03-27 13:29:16] [INFO] >>> Analyzing candidate binary: /usr/lib/systemd/libsystemd-shared-249.so
|
|
[2026-03-27 13:29:16] [INFO] >>> Analyzing candidate binary: /usr/lib/systemd/systemd-networkd
|
|
[2026-03-27 13:29:17] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
|
|
[2026-03-27 13:29:17] [ALERT] String match '1234' found in /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
|
|
[2026-03-27 13:29:17] [CRITICAL] BPFDoor-like string pattern(s) found in /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
|
|
[2026-03-27 13:29:17] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301
|
|
[2026-03-27 13:29:17] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0
|
|
[2026-03-27 13:29:17] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libc.so.6
|
|
[2026-03-27 13:29:17] [ALERT] String match '1234' found in /usr/lib/x86_64-linux-gnu/libc.so.6
|
|
[2026-03-27 13:29:17] [CRITICAL] BPFDoor-like string pattern(s) found in /usr/lib/x86_64-linux-gnu/libc.so.6
|
|
[2026-03-27 13:29:17] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libcap.so.2.44
|
|
[2026-03-27 13:29:17] [ALERT] String match '1234' found in /usr/lib/x86_64-linux-gnu/libcap.so.2.44
|
|
[2026-03-27 13:29:17] [CRITICAL] BPFDoor-like string pattern(s) found in /usr/lib/x86_64-linux-gnu/libcap.so.2.44
|
|
[2026-03-27 13:29:17] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libcrypto.so.3
|
|
[2026-03-27 13:29:18] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
|
|
[2026-03-27 13:29:18] [ALERT] String match '1234' found in /usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
|
|
[2026-03-27 13:29:18] [CRITICAL] BPFDoor-like string pattern(s) found in /usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
|
|
[2026-03-27 13:29:18] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1
|
|
[2026-03-27 13:29:18] [ALERT] String match '1234' found in /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1
|
|
[2026-03-27 13:29:18] [CRITICAL] BPFDoor-like string pattern(s) found in /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1
|
|
[2026-03-27 13:29:18] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libip4tc.so.2.0.0
|
|
[2026-03-27 13:29:18] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5
|
|
[2026-03-27 13:29:18] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libmount.so.1.1.0
|
|
[2026-03-27 13:29:18] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
|
|
[2026-03-27 13:29:18] [ALERT] String match '1234' found in /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
|
|
[2026-03-27 13:29:18] [CRITICAL] BPFDoor-like string pattern(s) found in /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
|
|
[2026-03-27 13:29:18] [INFO] >>> Analyzing candidate binary: /usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8
|
|
[2026-03-27 13:29:19] [INFO] >>> Analyzing candidate binary: /usr/sbin/agetty
|
|
[2026-03-27 13:29:19] [ALERT] String match '1234' found in /usr/sbin/agetty
|
|
[2026-03-27 13:29:19] [CRITICAL] BPFDoor-like string pattern(s) found in /usr/sbin/agetty
|
|
[2026-03-27 13:29:19] [INFO] [-] Basic persistence triage (cron, systemd, rc scripts)
|
|
[2026-03-27 13:29:19] [ALERT] Suspicious pattern in systemd units under /usr/lib/systemd/system
|