Threat analysts have identified a new variant of the BotenaGo botnet malware and it is the most stealthy seen so far, operating undetected by any anti-virus engine.
BotenaGo is a relatively new malware written in Golang, Google's open-source programming language.
The source code for the botnet has been publicly available for about half a year, since it was leaked in October 2021.
Since then, several variants have emerged, while the original one has continued to be active and add exploits to target millions of IoT.
Researchers at Nozomi Networks Labs recently discovered a new variant of BotenaGo that appears to have originated from the leaked source code
The sample they analyzed targets “Lilin security camera DVR devices,” which prompted the researchers to call it the “Lillin scanner.”.
A hidden new version
The most notable feature of the Lillin BotenaGo variant is that it is not detected by antivirus engines on the VirusTotal scanning platform.
One of the reasons for this is that its authors have removed all the exploits present in the original BotenaGo and are only focusing on targeting Lilin DVRs using a critical two-year-old remote code execution flaw .
Notably, this exploit is the same one used by the Fodcha malware, another botnet recently discovered for launching denial-of-service (DDoS) attacks that has seen impressive growth.
Therefore, it appears that there are a significant number of unpatched Lilin DVR devices out there that are logical targets for the creators of the new botnet.
Gateway to Mirai
Another difference between the Lillin scanner and the original BotenaGo is that the former relies on an external bulk scanning to form lists of IP addresses of exploitable devices.
The malware then uses the function to infect all valid and accessible IP addresses via cleartext strings and then relies on a hardcoded list of credentials that are typically set up on poorly protected endpoints.
Lilin-specific “root/icatch99” and “report/8Jg0SR8K50” are included in this list. If a match is found, threat actors can remotely execute arbitrary code on the target
The exploit comes via a POST request with malicious code, submitted to the dvr/cmd, with the aim of modifying the camera.
If this is successful, the new configuration will run a wget command to download a file (wget.sh) from 136.144.41[.]169 and then execute it. If it is not successful, the malware attempts to inject the command into cn/cmd.
The wget.sh file downloads Mirai payloads compiled for multiple architectures and executes them on the compromised device.
Some of these payloads were uploaded to VirusTotal in March 2022, indicating that the testing period is new.
Nozomi researchers report that Mirai has certain IP range exceptions to avoid infecting the US Department of Defense (DoD), the US Postal Service (USPS), General Electric (GE), Hewlett-Packard (HP), and others.
Mirai takes on the task of targeting a broader list of exploits and devices, so in this campaign, the Lilin DVR exploit serves as a gateway to a larger wave of infection.
It's not a huge threat
The Lillin scanner variant does not appear to pose a huge threat to IoT due to its very specific targeting, even if the second-stage Mirai has more powerful capabilities.
Furthermore, it cannot spread on its own, as the scanning and infection functions operate manually, so it is a highly targeted threat or perhaps still in an experimental stage.
However, it is an interesting new botnet project that demonstrates how easy it is for malware authors to completely covertly create botnets from known, documented code.
Information source: bleepingcomputer.com
