Kiss-a-Dog Discovered Utilizing a 20-Year-Old Process Hider

MITRE Techniques

• [T1053.003] Cron – The cron scheduler runs, the database file is read and interpreted as a cron job, resulting in arbitrary code execution. ‘the cron scheduler runs, the database file is read and interpreted as a cron job, resulting in arbitrary code execution.’
• [T1105] Ingress Tool Transfer – Redis is used to download and execute an initialisation shell script on the compromised node. ‘download and execute an initialisation shell script on the compromised node.’
• [T1105] Ingress Tool Transfer – The campaign downloads a second stage payload (b.sh) from kiss[.]a-dog[.]top. ‘second stage payload (b.sh), hosted at the kiss[.]a-dog[.]top domain.’
• [T1059.004] Unix Shell – ai.sh is a small shell script used in the chain. ‘The script begins with a log statement and some variable assignment, including the decoding of the following payload URL.’
• [T1027] Obfuscated/Compressed Files and Information – The domain is encoded in base64 and decoded on the fly. ‘encoded in base64 and then decoded on the fly when the job executes.’
• [T1574.002] Hijack Execution Flow – LD_PRELOAD dynamic linker hijacking used to run the process hider code. ‘LD Preload dynamic linker hijacking technique.’
• [T1014] Rootkit – Diamorphine open source LKM rootkit used to hide a malicious process. ‘Diamorphine, an open source LKM rootkit for Linux kernel versions 2.6 and newer.’
• [T1036] Masquerading – The malware masquerades as Sendmail, a Linux email transfer agent. ‘masquerading as Sendmail, a Linux email transfer agent.’
• [T1496] Resource Hijacking – Mining cryptocurrency is performed, indicating cryptomining activity. ‘Mining cryptocurrency is incredibly resource intensive.’