Loading malware…
BillGates, also known as Setag, is a Linux-focused distributed denial-of-service botnet with backdoor functionality. Observed since at least 2014, it is generated using a builder that allows operators to configure separate variants and command-and-control infrastructure. It has been deployed by ChinaZ and in campaigns associated with the luoxk activity cluster, targeting exposed Linux servers across popular distributions.
BillGates enrolls compromised systems into an operator-controlled botnet, collects and transmits operating-system and hardware information, and accepts commands to conduct attacks. Depending on the variant, supported attacks include TCP/SYN, UDP, ICMP, HTTP, and DNS floods, as well as DNS amplification using spoofed requests to vulnerable resolvers. More capable variants separate control and attack functions into cooperating components and support shell-command execution, component downloads, and updates.
Persistence mechanisms include initialization scripts, run-level links, and, in some deployments, cron jobs. Defensive evasion includes debugger detection, tamper checks, and replacement of system utilities to conceal malicious activity. Some variants monitor their components and restart or reinstall them when missing.
Attackers install BillGates after successful SSH brute-force attacks, through downloads by other malware, and by exploiting vulnerable server applications. Documented exploitation vectors include Elasticsearch CVE-2015-1427, Apache Struts CVE-2017-5638, Oracle WebLogic CVE-2018-2893, Atlassian Confluence CVE-2021-26084, Log4Shell, and Adobe ColdFusion remote-code-execution vulnerabilities. Its principal operational purpose is to convert compromised servers into infrastructure for DDoS attacks.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In the last few months we have observed a higher volume of attacks from Billgates, a DDoS botnet attributed to ChinaZ.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Mirai, Muhstik, Elknot, mining, and other malware families were observed "propagating through Log4j2 RCE vulnerability" and targeting exposed services including Apache Flink on port 8081 and Apache Solr on port 8983.
Additionally, check for any potentially created jobs by looking in: /etc/cron.X where X is a name or folder, for example /etc/cron.daily. You may also wish to look in: /var/spool/cron/
CThreadLoopCmd reads commands from g_cmdDoing (the file cmd.n) and executes them using the call system(cmd).
In December 2021, researchers found Log4j version 2.14.1 and all previous versions to be vulnerable to CVE-2021-44228, dubbed "Log4Shell," a critical zero-day remote code execution flaw.
/usr/lib/libamplify.so Configuration file
the backdoor sets itself to run at system startup by creating the following script named DbSecuritySpt in /etc/init.d/
Additionally, check for any potentially created jobs by looking in: /etc/cron.X where X is a name or folder, for example /etc/cron.daily. You may also wish to look in: /var/spool/cron/
the backdoor sets itself to run at system startup by creating the following script named DbSecuritySpt in /etc/init.d/
Additionally, check for any potentially created jobs by looking in: /etc/cron.X where X is a name or folder, for example /etc/cron.daily. You may also wish to look in: /var/spool/cron/
However, just as Xor.DDoS, it has limited rootkit and backdoor functionality
Run the top command and verify any illegitimate processes, usually they will be randomly named.
Every minute – purge system logs and bash command history
/usr/lib/libamplify.so Configuration file
An example of an attack vector via SSH/Telnet bruteforce employed by ChinaZ can be seen in the following session log from one of our honeypots.
Information about network interfaces, taken from /proc/net/dev
atddd collects relevant information about the system, including: system version... number of CPU cores and their clock rates... CPU load... network load
An example of an attack vector via SSH/Telnet bruteforce employed by ChinaZ can be seen in the following session log from one of our honeypots.
2 configuration encryption schemes have been found – RSA encryption – XOR like encryption
Both of these instances share the same CNC domain... Since both BillGates and the Gh0st RAT instances found in the initially discovered HFS panel shared the same CNC, we can associate both implants to be components of a single botnet.
Elknot samples share C2 "300gsyn.it:25009," while SitesLoader specifies a Google Sites URL as C2 and multiple payloads use HTTP-based URLs for retrieval.
CThreadConnSender reads commands from the queue and passes them to the cupsddh module via a TCP connection with 127.0.0.1 on port 10808.
SitesLoader downloads a stage-two ELF file; the XMRig Windows command uses WebClient.DownloadFile to retrieve xmrig.exe; and the Linux variant downloads xmrig.tar.gz plus a setup shell script.
it has limited rootkit and backdoor functionality and thus it's possible remote commands are executed as well as additional malware downloaded.
Attempt to remove other malware and miners including Luoxk, BillGates, XMRig, Hashfish and more... Once found, it kills them. ... This script loops forever and searches for processes that utilize more than 30% of the CPU... Once found, it kills them.
Muhstik is characterized as "DDoS+backdoor," and Elknot/BillGates is described as a long-active DDoS botnet targeting Linux and Windows systems.
This means that 5 attack types are possible: 0x80 – TCP flood... 0x81 – UDP flood... 0x82 – ICMP flood... 0x83, 0x84 – two DNS flood attacks.
CAttackAmp – DNS Amplification. The last attack type on the list above is different in that packets are sent to vulnerable DNS servers, with the attack target specified as the sender’s IP address.
Setag, also known as BillGates or Ganiw... mainly uses UDP/SYN/ICMP/DNS floods to conduct DDoS attack.
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.