BotenaGo strikes once more – malware supply code uploaded to GitHub

In November 2021, AT&T Alien Labs™ first revealed analysis on our discovery of latest malware written within the open-source programming language Golang. The crew named this malware “BotenaGo.” (Learn earlier article right here.) On this article, Alien Labs is updating that analysis with new data.

Lately BotenaGo supply code was uploaded to GitHub, doubtlessly resulting in a major rise of latest malware variants as malware authors will be capable to use the supply code and adapt it to their targets. Alien Labs expects to see new campaigns based mostly on BotenaGo variants concentrating on routers and IoT gadgets globally. As of the publishing of this text, antivirus (AV) vendor detection for BotenaGo and its variants stays behind with very low detection protection from most of AV distributors.

Key takeaways:

• BotenaGo malware supply code is now accessible to any malicious hacker or malware developer.
• New BotenaGo samples had been discovered with very low AV detection (3/60 engines).
• With solely 2,891 traces of code, BotenaGo has the potential to be the place to begin for a lot of new variants and new malware households utilizing its supply code.

Background

In September 2016, supply code of one of the well-liked botnets named Mirai was leaked and uploaded to one of many hacking group boards, and later uploaded to GitHub with detailed data on the botnet, its infrastructure, configuration and construct it.

Because the launch of that data, the recognition of Mirai has elevated dramatically. A number of malware variants similar to Moobot, Satori, Masuta, and others use the supply code of Mirai. They then add distinctive performance, which has resulted in these a number of variants inflicting hundreds of thousands of infections. The Mirai botnet targets principally routers and IoT gadgets, and it helps completely different architectures together with Linux x64, completely different ARM variations, MIPS, PowerPC, and extra. Because the Mirai botnet might be now modified and compiled by completely different adversaries, many new variants have turn out to be accessible over time that includes new capabilities and new exploits.

In our November 2021 analysis article, Alien Labs first described its findings concerning the new BotenaGo malware together with technical particulars. We used on-line instruments similar to Shodan to point out the potential injury the BotenaGo malware may trigger, and its potential for placing hundreds of thousands of IoT gadgets in danger.

Alien Labs just lately found that the supply code of BotenaGo malware was uploaded to GitHub on October sixteenth 2021, permitting any malicious hacker to make use of, modify, and improve it —  and even merely compile it as is and use the supply code as an exploit package, with the potential to leverage all BotenaGo’s exploits to assault weak gadgets. The unique supply of the code is but unknown. In the identical repository, we’ve got discovered extra hacking instruments collected from a number of completely different sources.

Supply code evaluation

The malware supply code, containing a complete of solely 2,891 traces of code (together with empty traces and feedback), is straightforward but environment friendly. It consists of every little thing wanted for a malware assault, together with however not restricted to:

• Reverse shell and telnet loader, that are used to create a backdoor to obtain instructions from its operator
• Automated arrange of the malware’s 33 exploits, giving the hacker a “prepared state” to assault a weak goal and infect it with an acceptable payload based mostly on course kind or working system

The highest of the supply code on GitHub reveals a remark with the listing of present exploits for “supported” distributors and software program, as proven in Determine 1.

Determine 1 reveals BotenaGo’s accessible exploits for a number of distributors.

As described in our earlier weblog, the malware initiates a complete of 33 exploit features concentrating on completely different routers and IoT gadgets by calling the operate “scannerInitExploits” (see determine 2).

Determine 2 reveals the initialization of 33 exploits.

Every exploit operate comprises the exploit configuration (similar to a selected “GET” request) and particular payload for the focused system (see determine 3). Some exploits are a sequence of instructions, similar to a number of “GET” requests (see figures 4 and 5).

Determine 3 reveals the particular payload for various targets.

Determine 4 reveals the implementation of CVE-2020-10987.

Determine 5 reveals the implementation of CVE-2020-10173

The code comprises extra configuration for a distant server, together with accessible payloads and a path to folders that comprises extra script information to execute on contaminated gadgets (see determine 6).

Determine 6 reveals an instance of extra configuration.

On prime of all that, the primary operate calls collectively all the obligatory items: establishing a backdoor, loading extra payload scripts, initializing exploit features, and ready for instructions (see determine 7). It’s easy and clear malware creation in simply 2,891 traces of code.

Determine 7 reveals BotenaGo’s fundamental operate.

Further updates

Since our first article on BotenaGo, the samples have continued for use to take advantage of routers and IoT gadgets, spreading Mirai botnet malware. Much more worrisome, the samples proceed to have a really low AV detection charge, as proven under in VirusTotal (determine 8).

Determine 8 reveals the low stage of antivirus detections for BotenaGo’s new variants.

One of many variants is configured to make use of a brand new Command and Management (C&C) server (see determine 9).

It’s value noting that the IP tackle for one among BotenaGo’s payload storage servers is included within the listing of indicators of compromise (IOC) for detecting exploitation of the Apache Log4j safety vulnerabilities. Learn the Alien Labs Report on Log4Shell.

Determine 9 reveals a command to configure a C&C server for a BotenaGo variant.

Really helpful actions

1. Preserve minimal publicity to the Web on Linux servers and IoT gadgets and use a correctly configured firewall.
2. Set up safety and firmware upgrades from distributors, as quickly as potential.
3. Examine your system for pointless open ports and suspicious processes.

Conclusion

Right this moment, BotenaGo variants function a standalone exploit package and as a spreading instrument for different malware. Now with its supply code accessible to any malicious hacker, new malicious exercise might be added simply to the malware.  Alien Labs sees the potential for a major enhance in these malware variants, giving rise to doubtlessly new malware households that would put hundreds of thousands of routers and IoT gadgets vulnerable to assault.

Detection strategies

The next related detection strategies are in use by Alien Labs. They can be utilized by readers to tune or deploy detections in their very own environments or for aiding extra analysis.

Related indicators (IOCs)

The next technical indicators are related to the reported intelligence. An inventory of indicators can also be accessible in an Alien Labs Open Menace Change™ (OTX™) pulse. You may entry the OTX pulse right here. In case you are not an OTX member, it’s free to be a part of our world, open-source menace intelligence group of greater than 200,000.

Mapped to MITRE ATT&CK

The findings of this report are mapped to the next MITRE ATT&CK Matrix methods:

• TA0008: Lateral Motion
  • T1210: Exploitation of Distant Companies
  • T1570: Lateral Software Switch
• TA0011: Command and Management

*Present as of the publishing of this text.