LebahNET Statistic – September 2015

1. Summary

CyberSecurity Malaysia has established a Honeynet project known as Lebahnet.

Lebahnet is a Honeypot Based Distributed System for detecting and capturing attacks that evades traditional security devices. This project was initiated in 2002.

Lebahnet as a lightweight and passive honeypot; emulate vulnerabilities of operating systems used in an enterprise to alert security administrator on source of attacks.

The project aims to provide valuable supporting information such as network trends and malicious activities for our incident handling and advisory activities currently carried out by MyCERT. Lebahnet also serves as a research network for our analysts to experiment with relevant tools and techniques.

MyCERT has deployed the LebahNET Sensor in several areas in Malaysia.

2. Analysis

The data is collected from LebahNET Sensors from 2015-09-01 to 2015-09-30.

Summary of collected data

Number of Hits: 35294
Total Malwares: 571
Unique Malwares: 47

Targeted Services

Top 10 Threat Origins

Top 10 IPs

# Source IP Total
1 (CN) 5032
2 (CN) 4711
3 (CN) 3688
4 (US) 1105
5 (NL) 659
6 (CN) 650
7 (CN) 630
8 (CN) 558
9 (US) 432
10 (DE) 360

Web Attack

Bruteforce Attack

Targeted Services

Top 10 Username

# Username Total
1 sa 9703
2 root 4018
3 admin 1663
4 ubnt 464
5 mysql 158
6 support 150
7 user 124
8 test 119
9 oracle 114
10 DUP root 99

Top 10 Password

# Password Total
1 admin 1247
2 root 615
3 ubnt 375
4 password 260
5 123456 222
6 1 112
7 support 108
8 12345 89
9 00 81
10 1234 78

LebahNET API – Malware Information

FireShot Screen Capture #038 - 'LebahNET - Distributed Honeypot Network' - dashboard_honeynet_org_my

We are pleased to announce that we have provided access to public to obtain information on malwares collected by our LebahNET Sensor. Interested parties may access this information by using our Public API.

These are public API that we’re offering to public:
– List of Malware MD5
– List of latest 10 Malware MD5 with timestamp
– Malware Information
– Download malware binary

Please email to us following information in order to receive the API key:

– Your First & Last Name (may not be a third party contact)
– Your Organization and Address
– Contact information for verification.

Our email address is: lebahnet@cybersecurity.my

Dionaea: Malwr Module

We have noticed the following tweet from malwr:

As we use Dionaea Honeypot as our sensors, we decided to make it easy for our analyst to work with.  So, we have created a module to automate the malware submission to malwr.

The following code is for malwr module and step-by-step installation.

Create file modules/python/scripts/malwr.py with the following code

Available on gist

Open file modules/python/scripts/ihandler.py and find the following code:

Then Add this code:

and it should looks like the following:

Open file conf/dionaea.conf and find following code:

Add malwr configuration after the above code and it will look like below:

within same file as above, find following code

add “malwr” after “logsql” and it will look like below, and save 😀

Heartbleed Checker

Heartbleed (CVE-2014-0160) is a vulnerability on OpenSSL library which is affected on million of website. This will cause any user on the internet to read system memory. Our team have working to provide an alternative URL for user to verify their web server for vulnerable OpenSSL. User can visit to the following URL:


Heartbleed hosted on honeynet.org.my

Heartbleed checker hosted on honeynet.org.my. Showing an example of vulnerable website detected.

If the website is not vulnerable user will received the following message:
heartbleed2If you find any bugs or error in this web service please do not hesitate to contact us or leave a comment.

TOR Based APK Trojan

Several security firms recently discovered TOR based malware on android platform. As we received the sample, we make some quick analysis on it.

The sample has been reported to have C&C capability which is using unusual top level domain name (.onion). This TLD is usually used by TOR.
The use of Orbot TOR Client on this malware can be seen on its Java class:
Orbot TOR Client class

The following screenshot is an example of permission that used by this malware and the capabilities to run TOR client:

Permissions TOR Client Service

We have discovered more functionality which is not just TOR but also taking advantage on SMS, contact, USSD, and listing installed apps.

Maybank Phishkit Analysis

Just couple of days ago, we discovered a certain Maybank Phishing kit that limits access to only IP address from Malaysia. The phishing kit is hosted in a server in the US. This is basically done via the .htaccess file.


There is about 300 network addresses listed in the  .htaccess file and makes other  anti-phishing researchers  think that  site does not exit.

On another note, do make use of our DontPhishMe plugin for Firefox and Chrome!

From Facebook App to Botnet

MyCERT had received a couple of  reports of on a  new variant of Facebook malware spreading in the wild. It propagates through an FB application. The malware also is targetting users with messages on Facebook, which then link through to a fake Facebook photo page.

The site is designed to appear that the user is still browsing from within facebook. It was also made to appear that the picture was moved and needed to click the ‘View Photo’ button to see it. Clicking the button will download the malicious file.

The file is currently detected by 0 out of 37 antivirus products

* Refer to: http://virscan.org/report/d67fdc5b7dcfa … 0b1fe.html (Result as of 7 January 2011).

If infected, the computer will connect to the command and control server using the IRC protocol and wait for further instructions. Additionally,  sending similar messages to all your friends on the Facebook network.

Command & Control (C&C) Server connection:
Remote Host:Port Number
– 75.y.a.xx:1234
– 66.b.d.xx:1234

Forensic Challenge 2010/6 – Analyzing Malicious Portable Destructive Files is now live

Another challenge is ready to be tackled by forensic analysts, students, hackers and alike. This time, we present you with an attack vector that has become quite successful: malicious PDF files!

For challenge 6 of our series (provided by Mahmud Ab Rahman and Ahmad Azizan Idris from the Malaysia Honeynet Project Chapter) we present you with a pcap file that contains network traffic generated by the following scenario: An unsuspecting user opens a compromised web page, which redirects the user’s web browser to a URL of a malicious PDF file. As the PDF plug-in of the browser opens the PDF, the unpatched version of Adobe Acrobat Reader is exploited and, as a result, downloads and silently installs malware on the user’s machine.

We prepared a set of questions that requires you to dive deep into the portable document format. Submit your solution by November 30th 2010. The top three submissions will receive small prizes.


Christian Seifert
Chief Communications Officer
The Honeynet Project

Source: The Honeynet Project’s Blog

Converting String, Hex and Fixnum Using Ruby

1.0 Introduction

Software development in the security domains always involve converting from and to hex and binary format. For those new to certain languages, a high learning curve is involved and this translates to increasing the development cost.

This article concentrates in using the ruby language to help new comers shorten the learning curve.

To help us understand this article, we will use the below data:

str = “ABC

Please note that there is a new line character (\n) between C and D. Table 1.0 contains the same variable presented in 4 different formats.

String(Binary) A B C \n D Hex 41 42 43 0A 44 Fixnum(Decimal) 65 66 67 10 68 Binary 01000001 01000010 01000011 00001010 01000100

Table 1.0 Data Presentation Comparison

When we store ‘A’ character into a variable, it needs to be placed in memory. Since our RAM can only store 1 and 0, the ‘A’ character needs to be converted to this binary format. Base on ASCII table (http://www.asciitable.com/) it is agreed that the ‘A’ character should have 01000001 which is equal to 65 in decimal.

From the ASCII table, a new line character will be stored as 00001010 in RAM which is equal to 10(decimal).

Now we are ready for the next phase which is to convert the data into ruby language.

2.1 Converting Hex To BinaryString

First we will look at how to convert hex to binary.

sHex = “4142430A44”
puts [sHex].pack(‘H*’)     ==> “ABC\nD”

pack() is a method  for array object.  Originally sHex is a string, so we need to put it in the block to convert it to array.

Pack method will produce a BinaryString. The ‘H*’ directive will tell ruby that the array element is a Hex string.

There are many directives available (http://ruby-doc.org/core/classes/Array.html#M002222).

2.2 Converting BinaryString To Hex

For converting BinaryString to hex, we should use unpack with H* as the format parameter.

str = “ABC\nD”
str.unpack(‘H*’)  ==> [“4142430a44”]

unpack() will return array which contains a string of the hex format in its first element. To get the  string of hex you can try

str.unpack(‘H*’)[0]    ==> “4142430a44”

2.3 Converting BinaryString To Binary

unpack() can also be used to present data in binary. Use B* as the format parameter as below

str.unpack(‘B*’)[0]  => “0100000101000010010000110000101001000100”

The result is quite long. To understand it, split the string so that each group has 8 numbers. This is because each character consumes 8 bit in memory.

01000001 01000010 01000011 00001010 01000100 A B C \n D

2.4 Converting Hex To Binary

“41”.class is a String. This means our memory will store “00110100” (decimal =52, hex = 34) and “00110001”( decimal = 49, hex = 31).

“41”.hex.class is a FixNum. “41”.hex will tell ruby to read those string as hex, as a result stores “01000001” (decimal = 65, hex = 41) in memory. The two examples will definitely be interpreted differently by a CPU.

To display the same value in binary we can use to_s(2) method from the Fixnum class.

“41”.hex.to_s(2)  ==> “01000001”

The result is a string which contains a binary representative of 0x41.

Value 2 for the parameter means to display the value in base 2. Sending 16 as base will output the same result “41”, as hex is base 16. You can try to pass any integer between 2 and 36 and study the output for further exercise.

2.5 Converting Binary To BinaryString

pack(‘B*’) method from Array class will process the first element of the array and present it in BinaryString.

[“0100000101000010010000110000101001000100”].pack(‘B*’) ==>  “ABC\nD”

3.0 Conclusion

Always remember, that machines do store information in streams of 0 and 1. Since human have limitations in memorizing  long numbers, hex representation is used which can still represent the same value.

Different from both above, string is a stream of character human use for storing information. ASCII table is used to convert information stored in a computer to a format that human can understand

4.0 Reference

1-     http://ruby-doc.org/core/classes/Fixnum.html#M001050
2-     http://ruby-doc.org/core/classes/Array.html#M002222
3-     http://ruby-doc.org/core-1.8.7/classes/ … ml#M000689
4-     http://en.wikipedia.org/wiki/ASCII