Log4J vulnerability exploited by Bots

A backdoor found targeting Linux systems with the goal of corralling the machines into a botnet and acting as a conduit for downloading and installing rootkits dubbed B1txor20 based on its propagation using the file name ‘b1t,’ the XOR encryption algorithm, and the RC4 algorithm key length of 20 bytes.

Advertisements

The malware leverages a technique called DNS tunneling to build communication channels with C2 servers by encoding data in DNS queries and responses which leverages Log4j Vulnerability

B1txor20, while also buggy in some ways, currently supports the ability to obtain a shell, execute arbitrary commands, install a rootkit, open a SOCKS5 proxy, and functions to upload sensitive information back to the C2 server.

Once compromised, the malware utilizes the DNS tunnel to retrieve and execute commands sent by the server and send the data using encoding techniques to C2 hiding with

Bot sends the stolen sensitive information, command execution results, and any other information that needs to be delivered, after hiding it using specific encoding techniques, to C2 as a DNS request.

Once received, C2 sends the payload to the Bot side as a response to the DNS request. In this way, Bot and C2 achieve communication with the help of DNS protocol.