Cybersecurity researchers have revealed information on a new Golang-based ‘backdoor’ that uses Telegram as a mechanism for command-&-control (C2) communications.
Netskope Threat Labs, which detailed the functions of the malware, described it as possibly of Russian origin.
Functional
“The malware is compiled in Golang & once executed it acts like a backdoor,” security researcher Leandro Fróes said in an analysis published last week. “Although the malware seems to still be under development it is completely functional.”
When launched, the backdoor is designed to check if it is running under a specific location & using a specific name – “C:\Windows\Temp\svchost.exe” – & if not, it reads its own contents, writes them to that location, & creates a new process to launch the copied version & terminate itself.
Open-Source
A notable aspect of the malware is that it uses an open-source library that offers Golang bindings for the Telegram Bot API for C2 purposes.
This involves interacting with the Telegram Bot API to receive new commands originating from an actor-controlled chat. It supports 4 different commands, although only 3 of them are currently implemented –
- /cmd – Execute commands via PowerShell
- /persist – Relaunch itself under “C:\Windows\Temp\svchost.exe”
- /screenshot – Not implemented
- /selfdestruct – Delete the “C:\Windows\Temp\svchost.exe” file & terminate itself
Screenshot Captured
The output of these commands is sent back to the Telegram channel. Netskope stated that the “/screenshot” command sends the message “Screenshot captured” despite it not being fully fleshed out.
The Russian roots of the malware are explained by the fact that the “/cmd” instruction sends the message “Enter the command:” in Russian to the chat.
“The use of cloud apps presents a complex challenge to defenders & attackers are aware of it,” Fróes explained.
“Other aspects such as how easy it is to set & start the use of the app are examples of why attackers use applications like that in different phases of an attack.”
