k4spreader is a new binary installer developed by the Chinese “8220” mining gang (Water Sigbin) to drop Tsunami DDoS botnet and the PwnRig mining program, with multiple variants and ongoing development. It implements Linux persistence, self-update, and in-situ deployment of other malware, and is delivered via CGO Go binaries with a shell version also in use. #k4spreader #8220 #WaterSigbin #Tsunami #PwnRig
Keypoints
- k4spreader is a new installer tool from the “8220” mining gang, first appearing in February 2024.
- It is written in CGO (Go) and includes system persistence, self-update, and the ability to release other malware for execution.
- A shell version exists; three versions have been observed, with v3 using two layers of a modified upx packer to improve AV evasion.
- The tool releases Tsunami (botnet) and PwnRig (mining) via downloads from C2 or by releasing embedded payloads itself.
- The gang has exploited CVE-2020-14882 (and related JBoss/YARN vectors) and shows high C2 activity with multiple domains/IPs observed.
- Core persistence methods include modifying startup scripts and creating Linux services to maintain execution across reboots.
- Overall activity includes multiple C2 infrastructure nodes (domains/IPs) and embedded binaries in data sections, indicating an evolving capability set.
MITRE Techniques
- [T1059.004] Command and Scripting Interpreter – Bash – The tool uses a bash command via bash -c to create a scheduled task: “k4spreader_utils_GetDownloadRoute() will execute the following command through bash -c to create a scheduled task. It will be executed every 10 minutes and download the two files 2.gif and d.py for execution.”
- [T1105] Ingress Tool Transfer – The downloader fetches 2.gif and d.py from C2 for execution: “download the two files 2.gif and d.py for execution.”
- [T1132] Data Encoding – The new download response is gzip compressed and base64 encoded: “The response data is gzip compressed and base64 encoded.”
- [T1027] Obfuscated/Compressed Files and Information – The toolkit uses modified upx packers (one or two layers) to evade detection: “modified upx packer” and “packs all binary files with modified upx.”
- [T1547] Boot or Logon Autostart Execution – Linux persistence via startup scripts: “.bash_profile” is modified to copy itself to /bin/klibsystem4 and set immutable permissions; the new version uses klibsystem5.
- [T1543] Create or Modify System Process – Service installation and modification: “Add system service through /etc/init.d” and “Add system service through /etc/systemd/system”; service names evolve (knlib, dpkg-deb-package).
- [T1071.001] Web Protocols – C2 and payload delivery over HTTP endpoints: references to C2 domains/IPs and HTTP-based fetches (e.g., curl/wget commands and http://185.172.128.146:443/d.py).
- [T1562.004] Impair Defenses – Disabling firewall and permissive network rules: “ufw disable” and “iptables -P INPUT ACCEPT” to allow all traffic.
Indicators of Compromise
- [IP] C2 addresses and related infrastructure – 185.172.128.146, 51.255.171.23, and 167.114.114.169 (observed as C2/redirect endpoints).
- [Domain] Command-and-control domains – dw.c4kdeliver.top, run.sck-dns.ws, run.sck-dns.cc, c4k-ircd.pwndns.pw, pwn.oracleservice.top, run.on-demand.pw, fbi.su1001-2.top.
- [File hash] Sample payloads and components – 7bade55726a3a6e86d809836d1bc43f4f7702ecde9ceed80a09876c2efeff8d4, f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.
- [File] Embedded binaries and payloads – 2.gif, d.py, bi.64, bin.64, Tsunami, PwnRig.
- [Wallet] Cryptocurrency wallet address – 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3eGf5ZRb4qJzFXLVHGYH4moQ.
- [Vulnerability] CVEs exploited – CVE_2020_14882 (JBoss/ydesc), YARN_API_RCE (YARN).
- [Sample] Hashes and identifiers for observed versions – v1/v2/v3 hashes listed in the article.
Read more: https://blog.xlab.qianxin.com/8220-k4spreader-new-tool-en/