KmsdBot: A Customized Botnet Family with DDoS and Mining Capabilities

I. Overview

NSFOCUS Security Labs recently detected that a new botnet family KmsdBot, which combines DDoS and mining functions, has become active again. Attackers continue to replace C&C infrastructure and update Trojan versions. Compared with the traditional botnet-like family, KmsdBot adopts a brand-new architecture and is developed in the Go programming language. The simplicity, high efficiency and good cross-platform of Go greatly reduce the development cost of malicious code. At the same time, the native characteristics of Go language cause great annoyance to analysts.

The family first came to people’s attention in September 2022, when the sample functions were imperfect and the attack module was not mature enough. It gets its name because the initial loader is called “kmsd.exe”. In October of that year, KmsdBot attacked the servers of game company FiveM. The family started adding DDoS modules in version 2 and has been updated to version 4. The DDoS attack module is more complete, and the code is optimized simultaneously, improving the program’s stability and gradually fixing the code style.

The family is highly targeted in attack target selection, focusing on the gaming and high-end automobile manufacturing industries. It also has customized modules for attacks against FiveM. It is also worth noting that the C&C addresses of this family are concentrated in Western Europe and North America, which are significantly less active in Russia than in other countries and regions.

II. Sample Analysis

2.1 Version change

Table 2.1 Evolution of KmsdBot samples

2.2 Affected platform
KmsdBot is developed in the Go language and spread by means of SSH brute force attack. The latest version has been adapted to the following platforms:

Table 2.2 Architecture supported by latest sample

2.3 Basic attack modules
The latest version of KmsdBot first uses the fslock library to create exclusive locks after runtime to prevent access conflicts. At the same time, a pid.lock file is generated in the same directory.

The sample is then propagated by pulling an SSH brute force tool called “watchdogs” from the FTP server via curl and tftp commands and invoking it for weak password brute force. Before calling the brute force tool, the Trojan will execute the following commands to increase the upper limit of system file descriptors in preparation for multi-threaded scanning and brute force cracking by the SSH brute force tool.

The watchdogs pulled from the C&C server is an independent brute force module that attempts SSH login by weak password brute force and has a telnet scanning function.

Attackers have been maintaining and updating the DDoS attack module for a long time. Compared with earlier samples, multiple flooding attacks based on UDP protocol are added in the latest version. The DDoS attack methods in the latest version are as follows:

Table 2.3 DDoS attack methods

2.4 Mining module
KmsdBot can completely control the workflow of mining program, and download, load and update mining program through “main_reloadminer”, “main_startminer” and “main_updateminer” functions.

In addition, it is worth noting that the mining program uses the name “watchdog” similar to the daemon of Linux to confuse the victims and adopts the tls protocol to protect the privacy of communication. The parameters for starting the mining process are as follows:

The wallet address used in the latest version is as follows:

2.5 Directional attack module
Unlike the traditional botnet-like family, KmsdBot has built-in modules for directed attacks against FiveM in later versions.

In the latest version, the above attack modules are integrated and optimized to improve the efficiency and stability of DDoS attacks and launch flooding attacks based on http protocol against FiveM.

III. Conclusion

Since the KmsdBot botnet family was first discovered at the end of 2022, its versions have been updated frequently and its functions are improving. It has both mining and DDoS functions, as well as targeted attack modules. Recently, the family has started a new round of activity. NSFOCUS Security Labs further organized the resources held by the controllers of this botnet family based on the data accumulated in NSFOCUS’s global threat hunting system and found that the controller behind the KmsdBot can be described as “a big business”. Its attack scope covers Windows and Linux platforms, with multiple self-developed hacker tools including SSH blast and mining. In addition to KmsdBot, the controlled botnet families also have multiple botnet families including Mirai variants. NSFOCUS Security Labs will continuously monitor KmsdBot and its controllers.

IV. IOC

Hash:

Currency Wallet: