SpeakUp

SpeakUp is a Trojan backdoor that targets both Linux and OSX devices. It was first observed in January 2019. ^[1]

ID: S0374

ⓘ

Type: MALWARE

ⓘ

Platforms: Linux, macOS

Version: 1.2

Created: 17 April 2019

Last Modified: 11 April 2024

Techniques Used

Domain	ID		Name	Use
Enterprise	T1059		命令与脚本解释器	SpeakUp uses Perl scripts.^[1]
		.006	Python	SpeakUp uses Python scripts.^[1]
Enterprise	T1203		客户端执行漏洞利用	SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager. ^[1]
Enterprise	T1071	.001	应用层协议: Web Protocols	SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server. ^[1]
Enterprise	T1132	.001	数据编码: Standard Encoding	SpeakUp encodes C&C communication using Base64. ^[1]
Enterprise	T1110	.001	暴力破解: Password Guessing	SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels. ^[1]
Enterprise	T1027	.013	混淆文件或信息: Encrypted/Encoded File	SpeakUp encodes its second-stage payload with Base64. ^[1]
Enterprise	T1070	.004	移除指标: File Deletion	SpeakUp deletes files to remove evidence on the machine. ^[1]
Enterprise	T1082		系统信息发现	SpeakUp uses the `cat /proc/cpuinfo \| grep -c "cpu family" 2>&1` command to gather system information. ^[1]
Enterprise	T1033		系统所有者/用户发现	SpeakUp uses the `whoami` command. ^[1]
Enterprise	T1049		系统网络连接发现	SpeakUp uses the `arp -a` command. ^[1]
Enterprise	T1016		系统网络配置发现	SpeakUp uses the `ifconfig -a` command. ^[1]
Enterprise	T1046		网络服务发现	SpeakUp checks for availability of specific ports on servers.^[1]
Enterprise	T1105		输入工具传输	SpeakUp downloads and executes additional files from a remote server. ^[1]
Enterprise	T1053	.003	预定任务/作业: Cron	SpeakUp uses cron tasks to ensure persistence. ^[1]

References

Check Point Research. (2019, February 4). SpeakUp: A New Undetected Backdoor Linux Trojan. Retrieved April 17, 2019.