Security investigators have found the malicious Linux binaries generated for the Windows Subsystem for Linux (WSL), indicating that attackers are trying out new methods to negotiate Windows machines. The searches indicated that the threat actors are analyzing new methods of attacks and are focusing their attention on WSL to avoid detection.

Utilizing WSL to Evade Detection

The initial samples targeting the WSL surroundings were founded in early May and continued to come every two to three weeks until August 22. They act as loaders for the WSL environment and enjoy very low assessments on public file scanning services.

In the recent report, security investigators at Lumen’s Black Lotus Labs say that the malicious files either have the payload embedded or fetch it from a remote server. The next step is to insert the Trojan into a running process utilizing Windows API calls, a tactic that is neither advance nor sophisticated.

From the small number of samples identified, only one came with a publicly routable IP address, hinting that threat actors are testing the use of WSL to install malware on Windows. The malicious files rely mainly on Python 3 for carrying out their tasks and are packaged as an ELF executable for Debian using PyInstaller.

“As the negligible detection rate on VirusTotal suggests, most endpoint agents designed for Windows systems don’t have signatures built to analyze ELF files, though they frequently detect non-WSL agents with similar functionality.”

Less than a month ago, one of the malicious Linux files was detected by just one antivirus engine on VirusTotal. Refreshing the scan on another sample showed that it went completely undetected by the engines on the scanning service.

Variants are in PowerShell and Python

One of the variants, written absolutely in Python 3, does not use any Windows API and seems to be the first trial at a loader for WSL. It utilizes standard Python libraries, which makes it compatible with both Windows and Linux.

The investigators discover in a test sample code that prints “Hello Sanya” in Russian. All but one file associated with this sample contained local IP addresses, while the public IP pointed to 185.63.90.137, already offline when the investigators tried to grab the payload.

Another “ELF to Windows” loader variant relied on PowerShell to inject and execute the shellcode. One of these samples used Python to call functions that killed the running antivirus solution, established persistence on the system, and run a PowerShell script every 20 seconds.

Based on inequalities observed when analyzing several samples, the researchers believe that the code is still being developed, although in the final stage. The limited clarity from the public IP address indicates activity restricted to targets in Ecuador and France between late June and early July.

Black Lotus Labs estimates that the WSL malware loaders are the production of a threat actor testing the method from a VPN or proxy node. Microsoft introduced Windows Subsystem for Linux in April 2016. In September 2017, when WSL was freshly out of beta, researchers at Check Point demonstrated an attack they called Bashware where WSL could be abused to hide malicious code from security products.        

The report of Lumen’s Black Lotus Labs facilitates indicators of negotiates affiliated with the examined campaign to help supporters create exposure rules. For file hashes and data on this threat actor’s wider activity.