HiddenWasp Linux Malware

Original Issue Date:- June 06, 2019
Virus Type:- Trojan
Severity:- High

It has been observed that a new malware named as “HiddenWasp” targeting Linux operating systems is spreading. The malware focuses primarily on gaining remote access of the infected hosts making it different from other Linux malwares which aims crypto-mining or DDoS activity. The infection vector used by the malware is not known. The malware is capable of performing the following functions:

  • Gaining remote access to the infected machine.
  • Evade detection from variety of antivirus solutions.
  • Uses malicious code from other known malwares namely Azael Rootkit and Mirai.
  • Update existing versions of HiddenWasp on the compromised machine
  • Make network connections to download other malwares.
  • Make use of rootkits, Trojan implants and creation of ftp user account to maintain persistence in the system.

The malware is a combined package of various open source malwares such as an initial deployment script for downloading other malwares along with updating existing threats, a rootkit using Mirai code to hook into several functions and a Trojan having features of Azael rootkit that worked with the rootkit to remain operational. Also, similarities have been found in the HiddenWasp malware and other Linux malware named as Winnti malware.


Malware start its activities by execution of the initial deployment script which contains a code to create a user named as “sftp” on the compromised system with hardcoded password to maintain attacker’s access to infected machine even after the malware detection and cleanup. It is shown as below:

Source: Intezer

Thereafter the malware connects to remote server to download a tar file containing a full malware configuration package and then perform its other activities. The working of the malware is as follows:

Source: Intezer

Indicators of Compromise:

Command and Control server:

  • 103[.]206[.]123[.]13
  • 103[.]206[.]122[.]245

URLs downloading malicious script:

  • hxxp://103.206.xx.xx/system.tar.gz
  • hxxp:// 103.206.xx.xx /configUpdate.tar.gz
  • hxxp:// 103.206.xx.xx /configUpdate-32.tar.gz

File Hashes

  • e9e2e84ed423bfc8e82eb434cede5c9568ab44e7af410a85e5d5eb24b1e622e3
  • f321685342fa373c33eb9479176a086a1c56c90a1826a0aef3450809ffc01e5d
  • d66bbbccd19587e67632585d0ac944e34e4d5fa2b9f3bb3f900f517c7bbf518b
  • 0fe1248ecab199bee383cef69f2de77d33b269ad1664127b366a4e745b1199c8
  • 2ea291aeb0905c31716fe5e39ff111724a3c461e3029830d2bfa77c1b3656fc0
  • d596acc70426a16760a2b2cc78ca2cc65c5a23bb79316627c0b2e16489bf86c0
  • 609bbf4ccc2cb0fcbe0d5891eea7d97a05a0b29431c468bf3badd83fc4414578
  • 8e3b92e49447a67ed32b3afadbc24c51975ff22acbd0cf8090b078c0a4a7b53d
  • f38ab11c28e944536e00ca14954df5f4d08c1222811fef49baded5009bbbc9a2
  • 8914fd1cfade5059e626be90f18972ec963bbed75101c7fbf4a88a6da2bc671b

Best Practices and Recommendations:

  • Check for the indicators of compromise associated with the malware and block command and control domain and IP addresses at security perimeter devices.
  • Execute YARA rules against in-memory artifacts in order to be able to detect trojan implants.
  • To check if your system is infected, search for “ld.so” files — if any of the files do not contain the string ‘/etc/ld.so.preload’, your system may be compromised. This is because the Trojan implant will attempt to patch instances of ld.so in order to enforce the LD_PRELOAD mechanism from arbitrary locations.
  • Restrict Web Management Interface access of IoT devices to authorized users only and change default username/passwords
  • Always change Default login credentials before deployment in production.
  • Change default credentials at device startup and ensure that passwords meet the minimum complexity.
  • Disable Universal Plug and Play (UPnP) on IoT devices unless absolutely required.
  • Users should be aware of the installed devices and their capabilities. If a device comes with a default password or an open Wi-Fi connection, users should change the password and only allow it to operate on a home network with a secured Wi-Fi router.
  • Control access to the devices with Access List
  • Configure devices to "lock" or log out and require a user to re-authenticate if left unattended
  • Identify systems with default passwords and implement abovementioned measures. Some the systems that need to examined are Routers, switches, web applications and administrative web interfaces, ICS systems, Telnet and SSH interfaces
  • Implement account lockout policies to reduce the risk of brute forcing attacks.
  • Telnet and SSH should be disabled on device if there is no requirement of remote management
  • Configure VPN and SSH to access device if remote access is required.
  • Configure certificate based authentication for telnet client for remote management of devices
  • Implement Egress and Ingress filtering at router level.
  • Report suspicious entries in Routers to your Internet Service Provider
  • Keep up to date Antivirus on the computer system
  • Keep up-to-date on patches and fixes on the IoT devices, operating system and applications.
  • Unnecessary port and services should be stopped and closed.
  • Logging must be enabled on the device to log all the activities.
  • Enable and monitor perimeter device logs to detect scan attempts towards critical devices/systems