Blackrota Golang Backdoor Packs Heavy Obfuscation Punch

  • Blackrota is targeting a security bug in Docker, but is just about impossible to reverse-analyze.

    Researchers have discovered a new backdoor created in the Go programming language (Golang), which turned their heads because of to its heavy level of obfuscation.

    The backdoor, named Blackrota, was very first learned in a honeypot owned by researchers, trying to exploit an unauthorized-access vulnerability in the Docker Distant API. What sets the backdoor apart is its use of considerable anti-detection strategies, which would make the malware really challenging to examine – some thing that scientists stated is not typically found with Golang-based malware.

    “Historically, we have seen malware created in Go that was at most effective stripped at compiling time, and at worst marginally obfuscated, with out significantly issues in reverse-analysis,” said scientists with 360 Netlab, in a Tuesday putting up. “Blackrota delivers a new tactic to obfuscation, and is the most obfuscated Go-published malware in ELF structure that we have located to date.”

    Scientists named the malware Blackrota, thanks to its command-and-regulate (C2) domain name ( Threatpost has reached out to 360 Netlab for further facts regarding the specific vulnerability being specific.

    The Malware

    The Blackrota backdoor is presently only accessible for Linux, in Executable and Linkable Structure (ELF) file structure, and supports both of those x86/x86-64 CPU architectures, stated scientists. ELF is a widespread standard file structure for executable documents. Upon further investigation, scientists found that Blackrota is configured centered on what they called a “geacon.”

    This is a type of beacon utilised by the malware to connect with a C2 server, inquiring for recommendations or to exfiltrate gathered info. This beacon in certain is implemented in the Go language, and has earlier been used by way of CobaltStrike, a commodity attack-simulation device that is applied by attackers to distribute malware and management compromised hosts.

    This beacon implements various crucial functions for the Blackrota backdoor, allowing it to execute shell instructions (CMD_SHELL), upload documents (CMD_Add), download specified information (CMDDOWNLOAD), search data files (CMD_FILE_Look through), established a sleep delay time (CMD_Sleep) and improve directories (CMD_CD).


    When it arrives to obfuscation, several ways make Blackrota challenging to review and detect. For one, the malware utilizes gobfuscate, an open-resource instrument for Go code, to obfuscate the source code just before compiling. It hides numerous features of Go resource code with random character substitutions – which includes the package names, international variable names, perform names, sort names and process names.

    “With 1000’s of random string-named features and a substantial selection of randomly-named details sorts, methods and international variables, we could not be absolutely sure what third-social gathering Go packages were being made use of inside of the sample, generating the reverse-investigation practically extremely hard to transfer ahead,” reported scientists.

    Gobfuscate also replaces all strings utilised in the code with XOR encodings (the XOR cipher is a cryptographic logic operation that compares two input bits and generates a single output little bit). In this situation, each string is assigned an XOR decoding function that dynamically decodes strings all through program execution.

    “Blackrota uses gobfuscate to obfuscate symbolic and sort information, which is the ‘life-door’ of such reverse-evaluation resources,” claimed researchers. “The symbolic details they parse and recover turns into unreadable, and it is not feasible to make perception of the symbolic and form information, and it is not doable to know which third-bash packages ended up imported to the challenge. This will make the reverse-examination approach a whole lot extra hard.”

    Another roadblock for assessment is that the Go language employs entirely static back links to make binary information – indicating that all of the codes made use of in normal and third-party libraries are packed into binary data files, resulting in really significant binary files.

    “This attribute, from a reverse-analysis stage of check out, signifies that when you open a Go binary file in a disassembly instrument, you will see thousands or even tens of hundreds of capabilities,” claimed researchers. “If these features do not have corresponding symbolics, it will be hard to reverse-examine Go binary files.”

    Researchers said that obfuscated malware prepared in Go is rare, but has been noticed in advance of. The ransomware strain named EKANS, which is an ransomware variant prepared in Golang, was beforehand uncovered making use of the same obfuscation process as Blackrota, for instance. Scientists warned that these new sorts of malware will build a headache for security defenders relocating forward when it comes to investigation and detection.

    “The obfuscation process of Blackrota and EKANS makes new difficulties for reverse analysis,” said researchers. “As the Go language gets to be extra popular, additional and extra malware will be prepared in Go in the future…we will hold an eye on what is likely to come about.”