SYMBOLCOMMON_NAMEaka. SYNONYMS
win.billgates (Back to overview)

BillGates

VTCollection    

BillGates is a modularized malware, of supposedly Chinese origin. Its main functionality is to perform DDoS attacks, with support for DNS amplification. Often, BillGates is delivered with one or many backdoor modules.

BillGates is available for *nix-based systems as well as for Windows.

On Windows, the (Bill)Gates installer typically contains the various modules as linked resources.

References
2022-03-02Bleeping ComputerBill Toulas
Log4shell exploits now used mostly for DDoS botnets, cryptominers
Kinsing Tsunami BillGates
2021-10-22FortinetCara Lin
Recent Attack Uses Vulnerability on Confluence Server
Tsunami BillGates
2017-12-03Blaze's Security BlogBartBlaze
Notes on Linux/BillGates
BillGates
2016-04-04AkamaiAkamai
Threat Advisory: “BillGates” Botnet
BillGates
2015-09-30ThisIsSecurityBenoît Ancel
When ELF.BillGates met Windows
BillGates
2015-09-01Virus BulletinJaromír Hořejší, Peter Kálnai
DDOS TROJAN: A MALICIOUS CONCEPT THAT CONQUERED THE ELF FORMAT
Bashlite MrBlack XOR DDoS BillGates
2014-07-10Kaspersky LabsMikhail Kuzin
Versatile DDoS Trojan for Linux
BillGates
2014-02-06HabrValdikSS
Исследуем Linux Botnet «BillGates»
BillGates
Yara Rules
[TLP:WHITE] win_billgates_auto (20230808 | Detects win.billgates.)
rule win_billgates_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.billgates."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.billgates"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3c11 7408 3c22 7404 3c30 }
            // n = 5, score = 200
            //   3c11                 | dec                 esp
            //   7408                 | mov                 dword ptr [esp + 0x88], ebp
            //   3c22                 | dec                 eax
            //   7404                 | cmp                 eax, ebx
            //   3c30                 | dec                 ecx

        $sequence_1 = { 8d8809f9ffff b8c94216b2 f7e9 03d1 }
            // n = 4, score = 200
            //   8d8809f9ffff         | dec                 eax
            //   b8c94216b2           | mov                 ecx, edi
            //   f7e9                 | mov                 byte ptr [edx + 8], al
            //   03d1                 | dec                 eax

        $sequence_2 = { 3c58 7507 b802000000 eb02 }
            // n = 4, score = 200
            //   3c58                 | cmp                 eax, ebx
            //   7507                 | jne                 0x2fa
            //   b802000000           | mov                 dword ptr [ebp + 0x58], 0xffffffff
            //   eb02                 | jmp                 0x303

        $sequence_3 = { 740c 3c11 7408 3c22 7404 3c30 }
            // n = 6, score = 200
            //   740c                 | dec                 eax
            //   3c11                 | shr                 eax, 0x3f
            //   7408                 | dec                 eax
            //   3c22                 | add                 edx, eax
            //   7404                 | je                  0x929
            //   3c30                 | dec                 eax

        $sequence_4 = { 3c10 740c 3c11 7408 }
            // n = 4, score = 200
            //   3c10                 | jne                 0x4c
            //   740c                 | test                edx, edx
            //   3c11                 | cmp                 eax, ecx
            //   7408                 | ja                  0x72

        $sequence_5 = { 83f8ff 750c ff15???????? 8bd8 f7db }
            // n = 5, score = 200
            //   83f8ff               | dec                 ebp
            //   750c                 | mov                 edx, ecx
            //   ff15????????         |                     
            //   8bd8                 | dec                 esp
            //   f7db                 | mov                 ebp, edx

        $sequence_6 = { 3c11 7408 3c22 7404 }
            // n = 4, score = 200
            //   3c11                 | mov                 al, 1
            //   7408                 | mov                 ecx, dword ptr [esp + 0x38]
            //   3c22                 | cmp                 eax, edx
            //   7404                 | jb                  0x86

        $sequence_7 = { ff15???????? 83f8ff 7508 ff15???????? f7d8 85c0 }
            // n = 6, score = 200
            //   ff15????????         |                     
            //   83f8ff               | mov                 edi, eax
            //   7508                 | test                esi, esi
            //   ff15????????         |                     
            //   f7d8                 | mov                 esi, eax
            //   85c0                 | cmp                 esi, -1

        $sequence_8 = { 3c10 740c 3c11 7408 3c22 }
            // n = 5, score = 200
            //   3c10                 | test                edi, edi
            //   740c                 | jne                 0xe0
            //   3c11                 | dec                 ecx
            //   7408                 | mov                 edi, dword ptr [esp]
            //   3c22                 | dec                 eax

        $sequence_9 = { 3c10 740c 3c11 7408 3c22 7404 }
            // n = 6, score = 200
            //   3c10                 | mov                 dword ptr [esp + 0xd0], 0x3e8
            //   740c                 | dec                 eax
            //   3c11                 | arpl                word ptr [esi + 0x20], cx
            //   7408                 | mov                 dword ptr [esp + 0x20], 4
            //   3c22                 | dec                 esp
            //   7404                 | lea                 ecx, [esp + 0xd0]

    condition:
        7 of them and filesize < 801792
}
Download all Yara Rules