DDoS-as-a-Service: The Rebirth Botnet

MITRE Techniques

• [T1059.004] Unix Shell – The malware is delivered and executed via a bash script that downloads and runs payloads. “The malicious ELFs are spread on a target system by downloading and executing a bash script, whose code remains the same in all campaigns.”
• [T1036] Masquerading – The malware uses prctl to set the process name to /bin/bash to evade detection. “the prctl system call was used to set the process name as /bin/bash to evade detection by security tools.”
• [T1105] Ingress Tool Transfer – The dropper fetches multiple files from a remote server with wget, then chmod +x and executes them, removing them afterward. “download multiple files from a remote server using wget… After downloading each file, it sets execute permissions (chmod +x) and executes them (./filename). These files are then removed (rm -rf) after execution.”
• [T1027] Obfuscated/Compressed Files and Information – A BusyBox-based variant is used to reduce detection, exploiting BusyBox built-ins. “This may be a recent introduction that aims to minimize detection risks by taking advantage of the many busybox built-in commands.”
• [T1070.004] File Deletion – The malware removes dropped payloads after execution. “These files are then removed (rm -rf) after execution.”
• [T1046] Network Service Discovery – The malware reads /proc/net/tcp to discover active connections and potential targets. “The malware performs a large number of read operations on the /proc/net/tcp file, one byte at a time… identifying open ports and potential targets for infection.”