⚠️ Overview

GoBotKR is a Linux-based botnet malware written in the Go programming language, first documented in August 2016 by security researcher MalwareMustDie. It is categorized as a DDoS botnet and is attributed to a threat group believed to operate from South Korea, targeting primarily Linux servers for cryptocurrency mining and distributed denial-of-service attacks.

🔧 Technical Capabilities

GoBotKR propagates via SSH brute-forcing using a hardcoded list of common credentials and then downloads a second-stage payload. It establishes command and control (C2) communication over IRC channels, using a custom protocol to receive DDoS commands (e.g., SYN flood, UDP flood, HTTP GET flood). Persistence is achieved by adding a cron job that re-executes the malware after reboot or at scheduled intervals. Evasion techniques include UPX packing, obfuscated strings, and the use of polymorphic downloader scripts that change their URLs. The malware also contains a self-update mechanism that fetches new versions from its C2 server. It can disable competing malware or cryptocurrency miners by killing processes and removing cron entries of other tools.

📜 History & Notable Incidents

First publicly analyzed in 2016, GoBotKR was observed in campaigns targeting South Korean political parties and media sites around 2017, notably the Liberty Korea Party (now People Power Party) website. In 2018, a variant was found exploiting CVE-2018-1111 (a DHCP client vulnerability) on Linux systems, though this was not widely used. No major law enforcement actions have been publicly reported; the malware remains active in low‑volume campaigns against Asian and US targets.

🔍 Detection Indicators

Known file hashes include SHA256: c0f1e4b2a3d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f (example from VirusTotal reports). Behavioral indicators include outbound IRC traffic to non‑standard ports (6667, 7000) with nicknames like GoBot or Korean‑derived strings, and cron entries containing wget or curl fetching .sh scripts. Network IOCs include User‑Agent strings such as Mozilla/5.0 (compatible; GoBotKR/1.0) and specific IRC join messages containing #gobotkr.

☠️ Risk & Impact

GoBotKR primarily causes damage through DDoS attacks that can disrupt websites and online services, particularly in South Korea. It also performs cryptocurrency mining (Monero) on infected servers, consuming CPU resources and leading to performance degradation and increased electricity costs. The malware has affected Linux servers in hosting providers, educational institutions, and government agencies across Asia and the United States.

🛡️ Mitigation

Defenders should enforce strong SSH password policies or use key‑based authentication, disable root SSH login, and apply regular patching for Linux kernels and common services. Network monitoring should flag outbound IRC traffic on non‑standard ports, and endpoint detection rules can be built using Sigma or YARA signatures that match the GoBotKR binary strings and cron‑based persistence patterns.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.