SMTP is the key: BPFDoor and AVERAT hitting the network edge

What it is

BPF Rekoobe variant embedded in a BPFDoor campaign targeting SpamSniper (Korean anti-spam) mail gateways, plus the ShareTech dropper installer and AVERAT RAT configuration internals — three mechanisms the existing summary names but doesn't explain.

How it works

The Rekoobe sample attaches a 26-instruction BPF filter that sniffs TCP/UDP/SCTP IPv4 and UDP IPv6 traffic where both source and destination port equal 25. It authenticates magic packets against a hardcoded 32-byte sequence and uses a repeating-key XOR (uvTIgh47,@#R) to decrypt strings and command tokens. The C2 handshake begins with a 12-byte sequence that decrypts to %wGvo4GL62p*. The reverse shell spoofs the process name /sniper/autorun/rblsmtpd --start -n 9 (a real qmail RBL daemon name) and connects back on port 25.

The src=25/dst=25 choice is deliberate: firewalls in front of mail appliances commonly allow ACCEPT tcp --sport 25 --dport 25 for MTA relay, so the magic packet reaches the raw socket before stateful inspection ever sees it.

The dropper's install branch is gated on a precondition: it only fires if /tmp/flag already exists AND the target .php script does not. It writes a shell script to /HDD/ms6x2xTo64/updIptable.php, chmods it 0777, and runs it via system() — which requires /HDD to be both writable and exec-capable (a noexec mount causes EACCES with no fallback). The script stages ntpdate and udevds into /sbin, runs them, and deletes them after 10 seconds. One of the two re-launched binaries is the dropper itself; on re-exec it finds the .php already present, fails the gate, and becomes a 2-second watchdog that recreates the script and marker file execProcEnd if either vanishes — explaining the apparent lack of persistence code (the appliance's own /addpkg/sbin/ startup relaunches it at boot).

AVERAT's 276-byte config blob derives an RC4 key from its own first 16 bytes folded with a reverse XOR cascade; the resulting S-box is used directly as keystream, with each field's byte-parity selecting bitwise-inversion or nibble-rotation before XOR. Across all six samples, the MAC key and aux key are byte-identical; only one stream key is shared between a pair — indicating shared build infrastructure but per-deployment key rotation.

Preconditions / Affected

SpamSniper appliances with firewall rules permitting port-25 MTA relay traffic (src=25/dst=25) bypass stateful inspection entirely. ShareTech dropper requires /HDD mounted exec-capable; a noexec mount blocks installation outright.

What to do

• Alert on .db state files and on /HDD/ms6x2xTo64/, any .php-named file starting with #!/bin/sh, or a file literally named execProcEnd containing the string end.
• Detect the staging sequence as a process-tree pattern: sh -c on a .php path → cp/chmod into /sbin → rm -rf of the same path within ~10 seconds.
• Review firewall rules permitting tcp --sport 25 --dport 25; this specific rule is the bypass path for the Rekoobe magic packet.
• Flag outbound SMTP from an appliance to mail-role hostnames resolving to consumer/embedded devices.

Caveats

Rapid7 states this is a reconstruction of source code/behavior from samples, not a vendor-confirmed account; attribution to the China-nexus ORB pattern is explicitly a device-class similarity, not confirmed membership in any named ORB network (LapDogs/UAT-7810, SPACEHOP, FLORAHOX).