Spam-blasting malware infects thousands of Linux and FreeBSD servers

[Aerosol]

Several thousand computers running the Linux and FreeBSD operating systems have been infected over the past seven months with sophisticated malware that surreptitiously makes them part of a renegade network blasting the Internet with spam, researchers said Wednesday. The malware likely infected many more machines during the five years it's known to have existed.

Most of the machines infected by the so-called Mumblehard malware are believed to run websites, according to the 23-page report issued by researchers from antivirus provider Eset. During the seven months that they monitored one of its command and control channels, 8,867 unique IP addresses connected to it, with 3,000 of them joining in the past three weeks. The discovery is reminiscent of Windigo, a separate spam botnet made up of 10,000 Linux servers that Eset discovered 14 months ago.

The Mumblehard malware is the brainchild of experienced and highly skilled programmers. It includes a backdoor and a spam daemon, which is a behind-the-scenes process that sends large batches of junk mail. These two main components are written in Perl and they're obfuscated inside a custom "packer" that's written in assembly, a low-level programming language that closely corresponds to the native machine code of the computer hardware it runs on. Some of the Perl script contains a separate executable with the same assembly-based packer that's arranged in the fashion of a Russian nesting doll. The result is a very stealthy infection that causes production servers to send spam and may serve other nefarious purposes.

More and more complex

"Malware targeting Linux and BSD servers is becoming more and more complex," researchers from Eset wrote. "The fact that the authors used a custom packer to hide the Perl source code is somewhat sophisticated. However, it is definitely not as complex as the Windigo Operation we documented in 2014. Nonetheless, it is worrying that the Mumblehard operators have been active for many years without disruption."

The researchers uncovered evidence that Mumblehard may have links to Yellsoft, a company that sells DirecMailer, which is Perl-based software for sending bulk e-mail. The block of IP addresses for both Yellsoft and some of the Mumblehard C&C servers share the same range. What's more, pirated copies of DirecMailer silently install the Mumblehard backdoor. The pirated copies are also obfuscated by the same packer used by Mumblehard's malicious components.

Eset researchers discovered Mumblehard after being contacted by a system administrator who sought assistance for a server that was added to public security blacklists for sending spam. The researchers identified and analyzed a process that was causing the server to connect to different SMTP servers and send spam. The researchers then linked the behavior to an executable file located in the server's /tmp directory.

A version of the Mumblehard spam component was uploaded to the VirusTotal online malware checking service in 2009, an indication that the spammer program has existed for more than five years. The researchers were able to monitor the botnet by registering one of the domain names that Mumblehard-infected machines query every 15 minutes.

The Eset researchers still aren't certain how Mumblehard is installed. Based on their analysis of the infected server, they suspect the malware may take hold by exploiting vulnerabilities in the Joomla and WordPress content management systems. Their other theory is that the infections are the result of installing pirated versions of the DirecMailer program. The almost 9,000 IP addresses Eset observed can't be directly correlated to the number of machines that were infected by Mumblehard, since in some cases more than one server may share an address and in other cases a single server may give up an old address and take up a new one. Still, the number is a strong indication that several thousand machines were affected during the seven months Eset monitored the malware.

Administrators who want to check their servers for Mumblehard infections should look for unexplained daemons. These so-called cronjobs added by the malware activate the backdoor and cause it to query C&C servers four times per hour in precise, 15-minute increments. The backdoor is usually located in the /tmp or /var/tmp folders. The backdoor can be deactivated by mounting the directories with the noexec option.

Source