"The primary goal of the malware is to exfiltrate various private data from a compromised softswitch, including call detail records (CDR)," ESET researchers said in a Thursday analysis.
"To steal this metadata, the malware queries internal MySQL databases used by the softswitch. Thus, attackers demonstrate a good understanding of the internal architecture of the targeted platform."
Softswitches (short for software switches) are generally VoIP servers that allow for telecommunication networks to provide management of voice, fax, data and video traffic, and call routing.
ESET's research uncovered that CDRThief targeted a specific Linux VoIP platform, namely the VOS2009 and 3000 softswitches from Chinese company Linknat, and had its malicious functionality encrypted to evade static analysis.
The malware starts off by attempting to locate the Softswitch configuration files from a list of predetermined directories with the goal of accessing the MySQL database credentials, which are then decrypted to query the database.
ESET researchers say the attackers would have had to reverse engineer the platform binaries to analyze the encryption process and retrieve the AES key used to decrypt the database password, suggesting the authors' "deep knowledge" of the VoIP architecture.
Besides scooping up basic information about compromised Linknat system, CDRThief exfiltrates details of the database (username, encrypted password, IP address) and executes SQL queries directly to the MySQL database in order to capture information pertaining to system events, VoIP gateways, and call metadata.
"Data to be exfiltrated from the e_syslog, e_gatewaymapping, and e_cdr tables is compressed and then encrypted with a hardcoded RSA-1024 public key before exfiltration. Thus, only the malware authors or operators can decrypt the exfiltrated data," ESET said.
In its current form, the malware appears to be focused only on gathering data from the database, but ESET warns that could easily change should the attackers decide to introduce more advanced document stealing features in an updated version.
That said, the ultimate goal of the malware authors or information about the threat actor behind the operation still remains unclear.
"At the time of writing we do not know how the malware is deployed onto compromised devices," ESET's Anton Cherepanov said. "We speculate that attackers might obtain access to the device using a brute-force attack or by exploiting a vulnerability."
"It seems reasonable to assume that the malware is used for cyberespionage. Another possible goal for attackers using this malware is VoIP fraud. Since the attackers obtain information about activity of VoIP softswitches and their gateways, this information could be used to perform International Revenue Share Fraud (IRSF)."
