Zergeca is a Go-based botnet with six DDoS methods, plus features like proxying, scanning, self-updating, persistence, file transfer, reverse shell, and device information collection. The research links its DoH-enabled C2 and UPX-packed samples to Mirai-era infrastructure at 84.54.51.82. #Zergeca #XLab
Keypoints
- Zergeca is a Golang botnet with six DDoS attack methods and additional capabilities such as proxying, scanning, self-upgrading, persistence, file transfer, reverse shell, and device information collection.
- The botnet uses DNS-over-HTTPS (DoH) for C2 resolution and a Smux-based protocol, encrypted with XOR, to communicate with its C2.
- Initial samples were UPX-packed with a modified UPX and a non-standard magic number, aiding evasion; unpacking and pattern analysis reveal a decryption-heavy string table and automation potential.
- C2 domains (ootheca.pw, ootheca.top) share an IP (84.54.51.82) and leverage DoH to obscure C2-domain relationships, contributing to low VirusTotal detections.
- The infrastructure shows Mirai-era reuse of 84.54.51.82 as a loader/downloader and later as Zergeca’s C2, suggesting a lineage from earlier IoT botnets.
- Persistence is achieved via a systemd service (geomi.service); a “Silivaccine” module blocks competing threats like Mozi and kinsing, with experiments demonstrating process termination and binary deletion.
- The DDoS feature set includes seven vectors and a structured protocol for C2-driven attack commands, with sample data indicating real-time command handling and port/target details.
MITRE Techniques
- [T1027] Obfuscated/Compressed Files and Information – Packed with a modified UPX to evade detection. ‘packed with a modified UPX’
- [T1071.004] DNS – DoH for C2 resolution – DoH prioritization used to hide C2 domain resolution. ‘prioritizing DOH for C2 resolution’
- [T1095] Non-Application Layer Protocol – Uses the uncommon Smux library for C2 communication protocol, encrypted via XOR. ‘uncommon Smux library for C2 communication protocol, encrypted via XOR’
- [T1046] Network Service Scanning – Scanning activities targeting Telnet, HTTP, and socks4; ports 23, 8080, 3128, 80, 8888. ‘scanning activities commenced, primarily targeting protocols such as Telnet, HTTP, and socks4. The main ports scanned include 23, 8080, 3128, 80, and 8888’
- [T1082] System Information Discovery – Reports device information to the C2 (country, public IP, OS, user groups, runtime directory, reachability). ‘reports sensitive information from the compromised device to the C2, including details like country, public IP, OS, user groups, runtime directory, and reachability’
- [T1547] Boot or Logon Autostart Execution – Persistence via systemd service geomi.service to restart geomi on reboot or termination. ‘adding a system service geomi.service’
- [T1105] Ingress Tool Transfer – Loader/Downloader activity: downloading samples from 84.54.51.82 (e.g., http://84.54[.51.82/jaws], etc.). ‘Loader IP and Downloader IP for the Mirai botnet’ (and related sample URLs)
Indicators of Compromise
- [MD5] context – 23ca4ab1518ff76f5037ea12f367a469, 9d96646d4fa35b6f7c19a3b5d3846777, and other 3 hashes
- [Domain] context – ootheca.pw, ootheca.top, and bot.hamsterrace.space
- [IP] context – 84.54.51.82
- [File] context – geomi (path: /usr/bin/geomi; also the sample file 23ca4ab1518ff76f5037ea12f367a469)
Read more: https://blog.xlab.qianxin.com/a-deep-dive-into-the-zergeca-botnet/