Arc Money Farm on Replit

The Beginning

As being apart of a security team we come across a lot of random things including suspicious Github repositories. On March 21st someone dropped a Github repository into our chat asking to investigate the repository. After a quick peek at the repository they is only 2 files and both being a Linux executable binary.

Suspicious Github repository

After asking where did the Github repository came from it, they said it came from a replit named earnsquad that downloads from main from that repository. The red flag that brought the action for asking for someone to investigate it was the fact the replit was forked over 130,000 times.

Repl running suspicious executable

Initial Research

Quickly passed it along to someone else on the team who is an quick and amazing reverse engineer. After a few minutes sends me a screenshot showing the binaries executes a shell script and an email for one of the creators of shc. Which is a “Generic shell script compiler” that encodes and encrypts a shell script and wraps an executable around it from C source code.

Reversed engineered binary

The Final Payload

The executable wget a file from https://github.com/rawrboi/refactored-octo-guacamole which only contains archive files, downloading the archive the executable downloads gives you a few files inside of it. Oh boy a filename saying cock, this is gonna be fun.

Second suspicious Github repository Contents of archive

After opening the start.sh, main.py, and cock.py it looks like it install “undetected-chrome-driver” then starts main.py. Which runs a Flask application and on a separate thread starts “undetected-chromedriver” with a random user-agent from the user-agents.txt file. In a loop go to https://httpbots.icehub.ml/targets.txt opens it up and picks a random line from the file and makes “undetected-chromedriver” go to the URL it picked at random, after 900 seconds it repeats.

Contents of suspicious files

C2 Server

Let’s find where that target list is being hosted at, going to https://httpbots.icehub.ml/__repl redirects to https://replit.com/@blueytyt/targetboticehubx and https://icehub.ml/__repl redirects to https://replit.com/@awaprimPL/webtest

Now we know where it’s being hosted at, let’s check what is being hosted on the targets, how about this random one on the list https://skoda-octaviars.marki-samochodow.pl/. Nothing really on the page but it does have this weird icon on the bottom left. Looking at the source code of the page it seems like it’s the widget from Arc.io.

Source code of target site

What is Arc?

Arc is a peer-to-peer content exchange and delivery network (CDN).

Though you can get paid by embedding their widget into your website and utilizing your users to be apart of their peer-to-peer network.

The Conclusion

So it seems that they are using Replit.com to execute that Linux executable which in turn opens websites that is hosting the Arc.io widget to generate money. Though after looking through their repls it seems like they are doing a bunch of malicious stuff such as Discord token grabbing and account generating.

Data Dump

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263


https://replit.com/@earnsquad/earnquad
https://replit.com/@earnsquad/earnquadtest
https://replit.com/@oja9Ivs4IJ/earnquad
https://replit.com/@QJxNRWLdBq/earnquad-254
https://replit.com/@QJxNRWLdBq/earnquad-253
https://replit.com/@QJxNRWLdBq/earnquad-252
https://replit.com/@QJxNRWLdBq/earnquad-251
https://replit.com/@QJxNRWLdBq/earnquad-250
https://replit.com/@QJxNRWLdBq/earnquad-249
https://replit.com/@QJxNRWLdBq/earnquad-248
https://replit.com/@QJxNRWLdBq/earnquad-247
https://replit.com/@QJxNRWLdBq/earnquad-246
https://replit.com/@QJxNRWLdBq/earnquad-245
https://replit.com/@QJxNRWLdBq/earnquad-244
https://replit.com/@QJxNRWLdBq/earnquad-243
https://replit.com/@QJxNRWLdBq/earnquad-242
https://replit.com/@QJxNRWLdBq/earnquad-241
https://replit.com/@QJxNRWLdBq/earnquad-240
https://replit.com/@QJxNRWLdBq/earnquad-239
https://replit.com/@QJxNRWLdBq/earnquad-238
https://replit.com/@QJxNRWLdBq/earnquad-237
https://replit.com/@QJxNRWLdBq/earnquad-236
https://replit.com/@QJxNRWLdBq/earnquad-235
https://replit.com/@QJxNRWLdBq/earnquad-234
https://replit.com/@QJxNRWLdBq/earnquad-233
https://replit.com/@QJxNRWLdBq/earnquad-232
https://replit.com/@QJxNRWLdBq/earnquad-231
https://replit.com/@QJxNRWLdBq/earnquad-230
https://replit.com/@QJxNRWLdBq/earnquad-229
https://replit.com/@QJxNRWLdBq/earnquad-228
https://replit.com/@QJxNRWLdBq/earnquad-227
https://replit.com/@QJxNRWLdBq/earnquad-226
https://replit.com/@QJxNRWLdBq/earnquad-225
https://replit.com/@QJxNRWLdBq/earnquad-224
https://replit.com/@QJxNRWLdBq/earnquad-223
https://replit.com/@QJxNRWLdBq/earnquad-222
https://replit.com/@QJxNRWLdBq/earnquad-221
https://replit.com/@QJxNRWLdBq/earnquad-220
https://replit.com/@QJxNRWLdBq/earnquad-219
https://replit.com/@QJxNRWLdBq/earnquad-218
https://replit.com/@QJxNRWLdBq/earnquad-217
https://replit.com/@QJxNRWLdBq/earnquad-216
https://replit.com/@QJxNRWLdBq/earnquad-215
https://replit.com/@QJxNRWLdBq/earnquad-214
https://replit.com/@QJxNRWLdBq/earnquad-213
https://replit.com/@QJxNRWLdBq/earnquad-212
https://replit.com/@QJxNRWLdBq/earnquad-211
https://replit.com/@QJxNRWLdBq/earnquad-210
https://replit.com/@QJxNRWLdBq/earnquad-209
https://replit.com/@QJxNRWLdBq/earnquad-208
https://replit.com/@QJxNRWLdBq/earnquad-207
https://replit.com/@QJxNRWLdBq/earnquad-206
https://replit.com/@QJxNRWLdBq/earnquad-205
https://replit.com/@QJxNRWLdBq/earnquad-204
https://replit.com/@QJxNRWLdBq/earnquad-203
https://replit.com/@QJxNRWLdBq/earnquad-202
https://replit.com/@QJxNRWLdBq/earnquad-201
https://replit.com/@QJxNRWLdBq/earnquad-200
https://replit.com/@QJxNRWLdBq/earnquad-199
https://replit.com/@QJxNRWLdBq/earnquad-198
https://replit.com/@QJxNRWLdBq/earnquad-197
https://replit.com/@QJxNRWLdBq/earnquad-196
https://replit.com/@QJxNRWLdBq/earnquad-195
https://replit.com/@QJxNRWLdBq/earnquad-194
https://replit.com/@QJxNRWLdBq/earnquad-193
https://replit.com/@QJxNRWLdBq/earnquad-192
https://replit.com/@QJxNRWLdBq/earnquad-191
https://replit.com/@QJxNRWLdBq/earnquad-190
https://replit.com/@QJxNRWLdBq/earnquad-189
https://replit.com/@QJxNRWLdBq/earnquad-188
https://replit.com/@QJxNRWLdBq/earnquad-187
https://replit.com/@QJxNRWLdBq/earnquad-186
https://replit.com/@QJxNRWLdBq/earnquad-185
https://replit.com/@QJxNRWLdBq/earnquad-184
https://replit.com/@QJxNRWLdBq/earnquad-183
https://replit.com/@QJxNRWLdBq/earnquad-182
https://replit.com/@QJxNRWLdBq/earnquad-181
https://replit.com/@QJxNRWLdBq/earnquad-180
https://replit.com/@QJxNRWLdBq/earnquad-179
https://replit.com/@QJxNRWLdBq/earnquad-178
https://replit.com/@QJxNRWLdBq/earnquad-177
https://replit.com/@QJxNRWLdBq/earnquad-176
https://replit.com/@QJxNRWLdBq/earnquad-175
https://replit.com/@QJxNRWLdBq/earnquad-174
https://replit.com/@QJxNRWLdBq/earnquad-173
https://replit.com/@QJxNRWLdBq/earnquad-172
https://replit.com/@QJxNRWLdBq/earnquad-171
https://replit.com/@QJxNRWLdBq/earnquad-170
https://replit.com/@QJxNRWLdBq/earnquad-169
https://replit.com/@QJxNRWLdBq/earnquad-168
https://replit.com/@QJxNRWLdBq/earnquad-167
https://replit.com/@QJxNRWLdBq/earnquad-166
https://replit.com/@QJxNRWLdBq/earnquad-165
https://replit.com/@QJxNRWLdBq/earnquad-164
https://replit.com/@QJxNRWLdBq/earnquad-163
https://replit.com/@QJxNRWLdBq/earnquad-162
https://replit.com/@QJxNRWLdBq/earnquad-161
https://replit.com/@QJxNRWLdBq/earnquad-160
https://replit.com/@QJxNRWLdBq/earnquad-159
https://replit.com/@QJxNRWLdBq/earnquad-158
https://replit.com/@QJxNRWLdBq/earnquad-157
https://replit.com//@QJxNRWLdBq/earnquad-156
https://replit.com//@QJxNRWLdBq/earnquad-155
https://replit.com//@QJxNRWLdBq/earnquad-154
https://replit.com//@QJxNRWLdBq/earnquad-153
https://replit.com//@QJxNRWLdBq/earnquad-152
https://replit.com//@QJxNRWLdBq/earnquad-151
https://replit.com//@QJxNRWLdBq/earnquad-150
https://replit.com//@QJxNRWLdBq/earnquad-149
https://replit.com//@QJxNRWLdBq/earnquad-148
https://replit.com//@QJxNRWLdBq/earnquad-147
https://replit.com//@QJxNRWLdBq/earnquad-146
https://replit.com//@QJxNRWLdBq/earnquad-145
https://replit.com//@QJxNRWLdBq/earnquad-144
https://replit.com//@QJxNRWLdBq/earnquad-143
https://replit.com//@QJxNRWLdBq/earnquad-142
https://replit.com//@QJxNRWLdBq/earnquad-141
https://replit.com//@QJxNRWLdBq/earnquad-140
https://replit.com//@QJxNRWLdBq/earnquad-139
https://replit.com//@QJxNRWLdBq/earnquad-138
https://replit.com//@QJxNRWLdBq/earnquad-137
https://replit.com//@QJxNRWLdBq/earnquad-136
https://replit.com//@QJxNRWLdBq/earnquad-135
https://replit.com//@QJxNRWLdBq/earnquad-134
https://replit.com//@QJxNRWLdBq/earnquad-133
https://replit.com//@QJxNRWLdBq/earnquad-132
https://replit.com//@QJxNRWLdBq/earnquad-131
https://replit.com//@QJxNRWLdBq/earnquad-130
https://replit.com//@QJxNRWLdBq/earnquad-129
https://replit.com//@QJxNRWLdBq/earnquad-128
https://replit.com//@QJxNRWLdBq/earnquad-127
https://replit.com//@QJxNRWLdBq/earnquad-126
https://replit.com//@QJxNRWLdBq/earnquad-125
https://replit.com//@QJxNRWLdBq/earnquad-124
https://replit.com//@QJxNRWLdBq/earnquad-123
https://replit.com//@QJxNRWLdBq/earnquad-122
https://replit.com//@QJxNRWLdBq/earnquad-121
https://replit.com//@QJxNRWLdBq/earnquad-120
https://replit.com//@QJxNRWLdBq/earnquad-119
https://replit.com//@QJxNRWLdBq/earnquad-118
https://replit.com//@QJxNRWLdBq/earnquad-117
https://replit.com//@QJxNRWLdBq/earnquad-116
https://replit.com//@QJxNRWLdBq/earnquad-115
https://replit.com//@QJxNRWLdBq/earnquad-114
https://replit.com//@QJxNRWLdBq/earnquad-113
https://replit.com//@QJxNRWLdBq/earnquad-112
https://replit.com//@QJxNRWLdBq/earnquad-111
https://replit.com//@QJxNRWLdBq/earnquad-110
https://replit.com//@QJxNRWLdBq/earnquad-109
https://replit.com//@QJxNRWLdBq/earnquad-108
https://replit.com//@QJxNRWLdBq/earnquad-107
https://replit.com//@QJxNRWLdBq/earnquad-106
https://replit.com//@QJxNRWLdBq/earnquad-105
https://replit.com//@QJxNRWLdBq/earnquad-104
https://replit.com//@QJxNRWLdBq/earnquad-103
https://replit.com//@QJxNRWLdBq/earnquad-102
https://replit.com//@QJxNRWLdBq/earnquad-101
https://replit.com//@QJxNRWLdBq/earnquad-100
https://replit.com/@QJxNRWLdBq/earnquad-99
https://replit.com/@QJxNRWLdBq/earnquad-98
https://replit.com/@QJxNRWLdBq/earnquad-97
https://replit.com/@QJxNRWLdBq/earnquad-96
https://replit.com/@QJxNRWLdBq/earnquad-95
https://replit.com/@QJxNRWLdBq/earnquad-94
https://replit.com/@QJxNRWLdBq/earnquad-93
https://replit.com/@QJxNRWLdBq/earnquad-92
https://replit.com/@QJxNRWLdBq/earnquad-91
https://replit.com/@QJxNRWLdBq/earnquad-90
https://replit.com/@QJxNRWLdBq/earnquad-89
https://replit.com/@QJxNRWLdBq/earnquad-88
https://replit.com/@QJxNRWLdBq/earnquad-87
https://replit.com/@QJxNRWLdBq/earnquad-86
https://replit.com/@QJxNRWLdBq/earnquad-85
https://replit.com/@QJxNRWLdBq/earnquad-84
https://replit.com/@QJxNRWLdBq/earnquad-83
https://replit.com/@QJxNRWLdBq/earnquad-82
https://replit.com/@QJxNRWLdBq/earnquad-81
https://replit.com/@QJxNRWLdBq/earnquad-80
https://replit.com/@QJxNRWLdBq/earnquad-79
https://replit.com/@QJxNRWLdBq/earnquad-78
https://replit.com/@QJxNRWLdBq/earnquad-77
https://replit.com/@QJxNRWLdBq/earnquad-76
https://replit.com/@QJxNRWLdBq/earnquad-75
https://replit.com/@QJxNRWLdBq/earnquad-74
https://replit.com/@QJxNRWLdBq/earnquad-73
https://replit.com/@QJxNRWLdBq/earnquad-72
https://replit.com/@QJxNRWLdBq/earnquad-71
https://replit.com/@QJxNRWLdBq/earnquad-70
https://replit.com/@QJxNRWLdBq/earnquad-69
https://replit.com/@QJxNRWLdBq/earnquad-68
https://replit.com/@QJxNRWLdBq/earnquad-67
https://replit.com/@QJxNRWLdBq/earnquad-66
https://replit.com/@QJxNRWLdBq/earnquad-65
https://replit.com/@QJxNRWLdBq/earnquad-64
https://replit.com/@QJxNRWLdBq/earnquad-63
https://replit.com/@QJxNRWLdBq/earnquad-62
https://replit.com/@QJxNRWLdBq/earnquad-61
https://replit.com/@QJxNRWLdBq/earnquad-60
https://replit.com/@QJxNRWLdBq/earnquad-59
https://replit.com/@QJxNRWLdBq/earnquad-58
https://replit.com/@QJxNRWLdBq/earnquad-57
https://replit.com/@earnsquad/sffsfsnnn
https://replit.com/@earnsquad/B83j5nd
https://replit.com/@earnsquad/RigidGrossLava
https://replit.com/@earnsquad/B83j5nd-1
https://replit.com/@earnsquad/earnsquad-save-10
https://replit.com/@blueytyt/targetboticehubx
https://replit.com/@blueytyt/dropanie-api
https://replit.com/@blueytyt/nitro-gene
https://replit.com/@blueytyt/nitro-genev2
https://replit.com/@blueytyt/nitro-genev3
https://replit.com/@blueytyt/nitro-genev4
https://replit.com/@blueytyt/nitro-genev5
https://replit.com/@blueytyt/Test-Interia
https://replit.com/@blueytyt/highleaguetk
https://replit.com/@blueytyt/AltGen-Interia-1
https://replit.com/@blueytyt/nitro-sniper
https://replit.com/@blueytyt/Strona
https://replit.com/@blueytyt/advbot1
https://replit.com/@blueytyt/ruterml
https://replit.com/@blueytyt/Ku1BIXonml
https://replit.com/@blueytyt/Rekuml
https://replit.com/@blueytyt/advbot3
https://replit.com/@blueytyt/adv3-advertise
https://replit.com/@blueytyt/adv4
https://replit.com/@blueytyt/adv4-advertise
https://replit.com/@blueytyt/radio
https://replit.com/@blueytyt/Discord-Account-Generator
https://replit.com/@blueytyt/dc-website
https://replit.com/@blueytyt/testing-website-dc
https://replit.com/@blueytyt/Discord-Nitro-Generator-and-Checker
https://replit.com/@blueytyt/NitroGiftGeneratorAndChecker
https://replit.com/@blueytyt/TeamKaluch
https://replit.com/@blueytyt/highleagueml
https://replit.com/@blueytyt/Bot
https://replit.com/@blueytyt/solocombatfederationpl
https://replit.com/@blueytyt/SOLOCOMBATFEDERATIONCOM
https://replit.com/@blueytyt/developerzyrobloxdiscordpl
https://replit.com/@blueytyt/jablkowice
https://replit.com/@blueytyt/lomianki
https://replit.com/@blueytyt/xxs
https://replit.com/@blueytyt/nowawola
https://replit.com/@blueytyt/bytow
https://replit.com/@blueytyt/ciechanow
https://replit.com/@blueytyt/fikcyjneszamotuly
https://replit.com/@blueytyt/paf
https://replit.com/@blueytyt/greathermanchester
https://replit.com/@blueytyt/pdstudio
https://replit.com/@blueytyt/fikcyjnelabrowo
https://replit.com/@blueytyt/robloxdiscordpl
https://replit.com/@blueytyt/usmc
https://replit.com/@blueytyt/heavenrp
https://replit.com/@blueytyt/lesnarp
https://replit.com/@blueytyt/polishstories
https://replit.com/@blueytyt/jw4724nil
https://replit.com/@blueytyt/scripterzykrystela
https://replit.com/@blueytyt/hckrteamcomx
https://replit.com/@awaprimPL/webtest
https://replit.com/@awaprimPL/nordaltz-v4
https://replit.com/@awaprimPL/bot123
https://replit.com/@awaprimPL/GenerousJoyousTags
https://replit.com/@awaprimPL/DarkWorldlyStructs
https://replit.com/@asdasdsazxcxzc/v3

Target list

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59


https://highleague.ml/
https://lomianki.robloxdiscord.pl/
https://jablkowice.robloxdiscord.pl/
https://bytow.robloxdiscord.pl/
https://xxs.robloxdiscord.pl/
https://nowawola.robloxdiscord.pl/
https://ciechanow.robloxdiscord.pl
https://fikcyjne.szamotuly.robloxdiscord.pl
https://nordalts.com/Some/ihavelife
https://fikcyjne.labrowo.robloxdiscord.pl/
https://pd.studio.robloxdiscord.pl/
https://usmc.robloxdiscord.pl/
https://heavenrp.robloxdiscord.pl/
https://lesnarp.robloxdiscord.pl/
https://polish.stories.robloxdiscord.pl/
https://jw.4724.nil.robloxdiscord.pl/
https://scripterzy.krystela.robloxdiscord.pl/
https://landrover-range-rover-evoque.marki-samochodow.pl/
https://landrover-range-rover-sport.marki-samochodow.pl/
https://landrover-series.marki-samochodow.pl/
https://landrover-discovery.marki-samochodow.pl/
https://landrover-defender.marki-samochodow.pl/
https://landrover-discovery-sport.marki-samochodow.pl/
https://landrover-freelander.marki-samochodow.pl/
https://ford-courier.marki-samochodow.pl/
https://ford-cougar.marki-samochodow.pl/
https://ford-capri.marki-samochodow.pl/
https://ford-c-max.marki-samochodow.pl/
https://ford-bronco.marki-samochodow.pl/
https://ford-b-max.marki-samochodow.pl/
https://skoda-yeti.marki-samochodow.pl/
https://skoda-vos.marki-samochodow.pl/
https://skoda-superb.marki-samochodow.pl/
https://skoda-roomster.marki-samochodow.pl/
https://skoda-popular.marki-samochodow.pl/
https://skoda-octaviars.marki-samochodow.pl/
https://skoda-octavia.marki-samochodow.pl/
https://skoda-kodiaqrs.marki-samochodow.pl/
https://skoda-kamiq.marki-samochodow.pl/
https://skoda-garde.marki-samochodow.pl/
https://skoda-forman.marki-samochodow.pl/
https://skoda-felicia.marki-samochodow.pl/
https://skoda-favorit.marki-samochodow.pl/
https://skoda-fabiars.marki-samochodow.pl/
https://skoda-fabia.marki-samochodow.pl/
https://skoda-445.marki-samochodow.pl/
https://skoda-440.marki-samochodow.pl/
https://skoda-450.marki-samochodow.pl/
https://skoda-1202.marki-samochodow.pl/
https://skoda-130.marki-samochodow.pl/
https://skoda-120.marki-samochodow.pl/
https://skoda-105.marki-samochodow.pl/
https://skoda-kamiq.marki-samochodow.pl/
https://skoda-scala.marki-samochodow.pl/
https://skoda-karoq.marki-samochodow.pl/
https://skoda-kodiaq.marki-samochodow.pl/
https://skoda-rapid.marki-samochodow.pl/
https://skoda-100series.marki-samochodow.pl/
https://skoda-1000mb.marki-samochodow.pl/