Full Report
A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. [...]
Analysis Summary
# Tool/Technique: Evooo1Bot
## Overview
Evooo1Bot is a modular Linux-based botnet malware derived from the Mirai source code. It targets internet-facing gateway devices and IoT hardware to incorporate them into a botnet. While it retains traditional DDoS capabilities, its primary distinguishing feature is its modularity, specifically its ability to turn infected devices into SOCKS5 traffic relay nodes and perform credential sniffing.
## Technical Details
- **Type:** Malware Family (Mirai variant)
- **Platform:** Linux (multiple architectures including ARM, MIPS, x86, etc.)
- **Capabilities:** DDoS, SOCKS5 Proxying, SSH Brute-forcing, Credential Sniffing, Vulnerability Exploitation, Anti-Analysis.
- **First Seen:** July 2024 (per report findings)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application]
- **[TA0003 - Persistence]**
- [T1543.002 - Create or Modify System Process: Systemd Service]
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (via rc.local and shell profiles)]
- [T1053.005 - Scheduled Task/Job: Cron]
- **[TA0005 - Defense Evasion]**
- [T1070.003 - Indicator Removal on Host: Clear Command History]
- [T1497 - Virtualization/Sandbox Evasion]
- **[TA0006 - Credential Access]**
- [T1110.001 - Brute Force: Password Guessing]
- [T1040 - Network Sniffing]
- **[TA0011 - Command and Control]**
- [T1090 - Proxy (SOCKS5)]
- [T1573.001 - Encrypted Channel: Symmetric Cryptography]
## Functionality
### Core Capabilities
- **Modular Exploitation:** Includes an arsenal targeting vulnerabilities in devices from vendors like D-Link, Zyxel, TP-Link, and Hikvision.
- **DDoS Engine:** Inherited from Mirai, supporting 16 different flood methods (UDP, DNS, SYN, ACK, etc.).
- **Encrypted C2:** Communicates with Command and Control servers over port 443 using encrypted traffic to evade detection.
- **Architecture Support:** Features 12 different builds tailored to various CPU architectures common in IoT devices.
### Advanced Features
- **SOCKS5 Relay:** Supports direct and reverse-relay modes, allowing the botnet to function as a residential proxy service.
- **Credential Sniffer:** Monitors `/proc/net/tcp` to capture sensitive data such as HTTP Basic Authentication and Cookie headers.
- **Evasive Maneuvers:** Performs complex checks for debuggers, sandboxes, containers, and honeypots before full execution.
- **Interactive Shell:** Provides operators with direct command-line access to the compromised system.
## Indicators of Compromise
- **File Names:** Often associated with scripts that clear Bash history or download architecture-specific payloads.
- **Network Indicators:**
- C2 communication on port 443 (TCP).
- Outbound SSH (Port 22) traffic from infected devices (Scanning activity).
- Unexplained SOCKS5 proxy traffic on non-standard ports.
- **Behavioral Indicators:**
- Modification of `rc.local`, `systemd` units, or `cron` tables for persistence.
- Frequent execution of `history -c` or clearing of `.bash_history`.
- High volume of outbound SYN or UDP packets during DDoS events.
## Associated Threat Actors
- Currently attributed to unidentified cybercriminals focusing on building proxy networks and DDoS-for-hire capabilities.
## Detection Methods
- **Signature-based detection:** Monitoring for known Mirai-derived strings within binary files and specific exploit payloads in network traffic.
- **Behavioral detection:** Identifying unauthorized modifications to system startup scripts (`rc.local`, `init`) and unusual process activity monitoring `/proc/net/tcp`.
- **Network Monitoring:** Alerting on high-frequency SSH connection attempts originating from internal gateway devices.
## Mitigation Strategies
- **Patch Management:** Regularly update firmware for all IoT and gateway devices to close known exploitation vectors.
- **Credential Hygiene:** Change all default administrative passwords to strong, unique credentials.
- **Attack Surface Reduction:** Disable remote management interfaces (WAN-side management) and unnecessary services like Telnet or SSH if not required.
- **Network Segmentation:** Isolate IoT devices from critical business or personal data segments.
## Related Tools/Techniques
- **Mirai:** The original source code from which Evooo1Bot’s DDoS engine is derived.
- **Gafgyt/Bashlite:** Other common Linux-based botnets targeting IoT devices.
- **Proxy-as-a-Service:** The operational model Evooo1Bot facilitates via its SOCKS5 module.