---
title: RapperBot Targets IoT
description: FortiGuard Labs recently reported on RapperBot, a malware family with a built-in capability to brute force credentials and gain access to SSH servers.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [RapperBot Targets IoT](https://blog.polyswarm.io/rapperbot-targets-iot)

 Written by [PolySwarm Tech Team](https://blog.polyswarm.io/author/polyswarm-tech-team) | Aug 22, 2022 7:09:40 PM

Executive Summary

FortiGuard Labs recently [reported](https://www.fortinet.com/blog/threat-research/rapperbot-malware-discovery) on RapperBot, a malware family with a built-in capability to brute force credentials and gain access to SSH servers.

Key Takeaways

- RapperBot targets Linux-based IoT devices with ARM, MIPS, SPARC, and x86 architectures.
- RapperBot brute forces SSH server credentials and has limited DDoS capabilities.
- Newer variants of RapperBot allow threat actors to maintain persistence on a victim machine.

**What is RapperBot?**

RapperBot is a malware family targeting Linux-based IoT devices and has been active since at least June 2022. It is based on Mirai, but unlike Mirai, it has a built-in capability to brute force credentials and gains access to SSH servers instead of using Telnet. RapperBot also has limited DDoS capabilities, leveraging plain UDP and TCP STOMP flood attacks.

According to FortiGuard Labs researchers,  RapperBot’s developers appear to be adding code to maintain persistence. This gives threat actors continued access to victim machines via SSH, even if the device is rebooted or the malware is removed. Early RapperBot samples included an embedded URL to a rap music video that was not observed in later samples.

RapperBot is used primarily to brute force credentials, using an SSH 2.0 client that can brute force any SSH server implementing Diffie-Hellmann key exchange with 768-bit or 2048-bit keys and data encryption using AES128-CTR. RapperBot uses SSH-2.0-HELLOWORLD to identify itself to the targeted SSH server.

RapperBot uses TCP requests at separate ports to communicate with the C2 to receive commands, download credential lists, or send credentials. In the samples, FortiGuard analyzed, the port used was 443. Each request uses a 32-byte value hard coded as a bot ID. The bot IDs from the samples FortiGuard analyzed were:

- d4 1c 74 44 70 95 28 ff f0 98 ae 4e 6f 92 ba d5 0f cd 56 29 c5 12 53 a1 fe 46 53 c7 0b b5 18 27
- f6 b7 0b 00 14 77 35 f9 8d 6d 5d c4 bd 23 88 7e cf 5e 02 ce 54 5f e7 b1 e6 3f 2a 16 71 b6 eb 

Some samples of RapperBot reported credentials to the C2 after successfully brute forcing a server without executing further commands on the victim machine. Other samples were self-propagated using a remote binary downloader post-compromise.

More recent samples no longer self-propagate but seek to maintain remote access on the victim machine. RapperBot does this by running a shell command to replace a remote victim’s ~/.ssh/authorized\_keys with the threat actor’s SSH public key and with the comment “helloworld.” This allows threat actors to connect to and authenticate to an SSH server without using a password. RapperBot uses this method to maintain access to victim devices even if the device is rebooted or the malware itself is removed. Early samples had strings in plaintext, while later samples added obfuscation to strings by building them on the stack. This helps thwart analysis and detection, as the tools cannot extract human-readable strings from the binaries. Some RapperBot samples also used an additional layer of XOR encoding to hide strings from memory scanners.

IOCs

PolySwarm has multiple samples of RapperBot.

[05c78eaf32af9647f178dff981e6e4e43b1579d95ccd4f1c2f1436dbfa0727ad](https://polyswarm.network/scan/results/file/05c78eaf32af9647f178dff981e6e4e43b1579d95ccd4f1c2f1436dbfa0727ad)

[1975851c916587e057fa5862884cbac3fa1e80881ddd062392486f5390c86865](https://polyswarm.network/scan/results/file/1975851c916587e057fa5862884cbac3fa1e80881ddd062392486f5390c86865)

[23256f231f3d91b0136b44d649b924552607a29b43a195024dbe6cde5b4a28ad](https://polyswarm.network/scan/results/file/23256f231f3d91b0136b44d649b924552607a29b43a195024dbe6cde5b4a28ad)

[23a415d0ec6d3131f1d537836d3c0449097e98167b18fbdbf2efca789748818a](https://polyswarm.network/scan/results/file/23a415d0ec6d3131f1d537836d3c0449097e98167b18fbdbf2efca789748818a)

[2479932a6690f070fa344e5222e3fbb6ad9c880294d5b822d7a3ec27f1b8b8d5](https://polyswarm.network/scan/results/file/2479932a6690f070fa344e5222e3fbb6ad9c880294d5b822d7a3ec27f1b8b8d5)

[55ff25b090dc1b380d8ca152428ba28ec14e9ef13a48b3fd162e965244b0d39b](https://polyswarm.network/scan/results/file/55ff25b090dc1b380d8ca152428ba28ec14e9ef13a48b3fd162e965244b0d39b)

[77b2e5fb5b72493bde35a6b29a66e6250b6a5a0c9b9c5653957f64a12c793cd5](https://polyswarm.network/scan/results/file/77b2e5fb5b72493bde35a6b29a66e6250b6a5a0c9b9c5653957f64a12c793cd5)

[8380321c1bd250424a0a167e0f319511611f73b53736895a8d3a2ad58ffcd5d5](https://polyswarm.network/scan/results/file/8380321c1bd250424a0a167e0f319511611f73b53736895a8d3a2ad58ffcd5d5)

[88bbb772b8731296822646735aacbfb53014fbb7f90227b44523d7577e0a7ce6](https://polyswarm.network/scan/results/file/88bbb772b8731296822646735aacbfb53014fbb7f90227b44523d7577e0a7ce6)

[8e9f87bb25ff83e4ad970366bba47afb838028f7028ea3a7c73c4d08906ec102](https://polyswarm.network/scan/results/file/8e9f87bb25ff83e4ad970366bba47afb838028f7028ea3a7c73c4d08906ec102)

[92ae77e9dd22e7680123bb230ce43ef602998e6a1c6756d9e2ce5822a09b37b4](https://polyswarm.network/scan/results/file/92ae77e9dd22e7680123bb230ce43ef602998e6a1c6756d9e2ce5822a09b37b4)

[9d234e975e4df539a217d1c4386822be1f56cea35f7dd2aa606ae4995894da42](https://polyswarm.network/scan/results/file/9d234e975e4df539a217d1c4386822be1f56cea35f7dd2aa606ae4995894da42)

[A31f4caa0be9e588056c92fd69c8ac970ebc7e85a68615b1d9407a954d4df45d](https://polyswarm.network/scan/results/file/A31f4caa0be9e588056c92fd69c8ac970ebc7e85a68615b1d9407a954d4df45d)

[C83f318339e9c4072010b625d876558d14eaa0028339db9edf12bbcafe6828bb](https://polyswarm.network/scan/results/file/C83f318339e9c4072010b625d876558d14eaa0028339db9edf12bbcafe6828bb)

[D86d158778a90f6633b41a10e169b25e3cb1eb35b369a9168ec64b2d8b3cbeec](https://polyswarm.network/scan/results/file/D86d158778a90f6633b41a10e169b25e3cb1eb35b369a9168ec64b2d8b3cbeec)

[Dcdeedee4736ec528d1a30a585ec4a1a4f3462d6d25b71f6c1a4fef7f641e7ae](https://polyswarm.network/scan/results/file/Dcdeedee4736ec528d1a30a585ec4a1a4f3462d6d25b71f6c1a4fef7f641e7ae)

[Ddf5aff0485f395c7e6c3de868b15212129962b4b9c8040bef6679ad880e3f31](https://polyswarm.network/scan/results/file/Ddf5aff0485f395c7e6c3de868b15212129962b4b9c8040bef6679ad880e3f31)

[E8f1e8ec6b94ea54488d5f714e71e51d58dcdfe4be3827c55970d6f3b06edf73](https://polyswarm.network/scan/results/file/E8f1e8ec6b94ea54488d5f714e71e51d58dcdfe4be3827c55970d6f3b06edf73)

[Ebb860512a55c1cdc8be1399eec44c4481aedb418f15dbda4612e6d38e9b9010](https://polyswarm.network/scan/results/file/Ebb860512a55c1cdc8be1399eec44c4481aedb418f15dbda4612e6d38e9b9010)

[F5ff9d1261af176d7ff1ef91aa8c892c70b40caa02c17a25de22539e9d0cdd26](https://polyswarm.network/scan/results/file/F5ff9d1261af176d7ff1ef91aa8c892c70b40caa02c17a25de22539e9d0cdd26)

[ff09cf7dfd1dc1466815d4df098065510eec504099ebb02b830309067031fe04](https://polyswarm.network/scan/results/file/ff09cf7dfd1dc1466815d4df098065510eec504099ebb02b830309067031fe04)

You can use the following CLI command to search for all RapperBot samples in our portal:

***$ polyswarm link list -f RapperBot

Don’t have a PolySwarm account? Go [here](https://polyswarm.network/) to sign up for a free Community plan or to subscribe.

Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports***

[View full post](https://blog.polyswarm.io/rapperbot-targets-iot)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "PolySwarm Tech Team"
  },
  "dateModified" : "2022-08-22T19:09:40.240Z",
  "datePublished" : "2022-08-22T19:09:40Z",
  "headline" : "RapperBot Targets IoT",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1407,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/RapperBot_Twitter.jpg",
    "width" : 2500
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/rapperbot-targets-iot",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```