FortiGuard Labs uncovered a new botnet named Goldoon that targets D-Link DIR-645 devices using CVE-2015-2051 to gain remote control. The malware drops a loader, establishes C2 communications, and can be used to launch DoS attacks across Linux architectures while employing persistence and cleanup techniques. Hashtags: #Goldoon #CVE-2015-2051 #D-Link #HNAP #FortiGuard #Fortinet
Keypoints
- Goldoon is a newly observed botnet exploiting CVE-2015-2051 to compromise D-Link devices with the HNAP interface.
- The vulnerability allows remote attackers to execute arbitrary commands via a GetDeviceSettings action on the HNAP interface.
- The dropper is downloaded from a remote server and designed to run across numerous Linux architectures, then cleans up after execution.
- The downloader decrypts strings with a XOR key and uses a fixed HTTP header to fetch the final payload.
- Goldoon implements extensive Linux persistence via multiple autorun methods and a daemon named “goldoon.server.”
- The malware maintains a C2 channel, processes seven command packets, including command execution and DoS actions, and supports dozens of attack methods across protocols.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Remote vulnerability CVE-2015-2051 is used to execute arbitrary commands via a GetDeviceSettings action on the HNAP interface. Quote: “…This vulnerability allows remote attackers to execute arbitrary commands via a GetDeviceSettings action on the HNAP interface.”
- [T1105] Ingress Tool Transfer – The attackers download a file “dropper” from “hxxp://94[.]228[.]168[.]60:8080.” Quote: “The attackers initially exploit CVE-2015-2051 to download a file “dropper” from “hxxp://94[.]228[.]168[.]60:8080.””
- [T1027] Obfuscated/Compressed Files and Information – The XOR key “YesItsAnAntiHoneypotBaby” decrypts strings like “linux” and “i686-linux-gnu.” Quote: “The XOR key, ‘YesItsAnAntiHoneypotBaby,’ to decrypt the specific strings ‘linux’ and ‘i686-linux-gnu.’”
- [T1059.004] Unix Shell – The malware executes commands through “/bin/bash -c” on the victim host. Quote: “executes commands through “/bin/bash -c” on the victim host.”
- [T1071.001] Web Protocols – The final payload is fetched via HTTP with a crafted header carrying commands. Quote: “It uses a fixed header, “User-Agent: FBI-Agent (Checking You),” to get the ultimate payload.”
- [T1543.003] Create or Modify System Process: Linux Service – The malware creates a daemon named “goldoon.server” to persist. Quote: “Otherwise, it can be created as a daemon named “goldoon.server” and later enable itself to persist in the victim’s computer.”
- [T1499] Endpoint Denial of Service – DoS attacks are triggered via commands from the C2, including Minecraft DoS and other DoS payloads. Quote: “the other triggers different DoS attacks.”
Indicators of Compromise
- [IP Address] 94.228.168.60:8080 – C2/dropper host used to deliver the dropper
- [DNS Server] 8.8.8.8, 8.8.4.4 – used as DNS resolvers by the malware
- [File Hash] 66f21251d7f8c58316f149fec104723beb979a1215ad4e788d83f0ee6fd34696 – sample hash associated with the dropper/payload
- [File Hash] 712d9abe8fbdff71642a4d377ef920d66338d73388bfee542f657f2e916e219c – sample hash associated with the dropper/payload
- [File Hash] d7367d41d19baa4f1022f8eb47f7ff1e13f583265c7c26ab96d5f716fa0d61ee – sample hash associated with the dropper/payload
- [File Hash] fdf6dae772f7003d0b7cdc55e047434dbd089e0dc7664a3fae8ccfd9d10ece8c – sample hash associated with the dropper/payload
- [File Hash] aa9e6006bce7d0b4554165dba76e67c4a44d98090c9e6ac9f3dca726f6e9adbf – sample hash associated with the dropper/payload
- [File Hash] fc44018b7432d9e6a1e98f723b0402101fa6e7483d098b10133aac142c0a4a0b – sample hash associated with the dropper/payload