1. Home
  2. Software
  3. Bonadan

Bonadan

Bonadan is a malicious version of OpenSSH which acts as a custom backdoor. Bonadan has been active since at least 2018 and combines a new cryptocurrency-mining module with the same credential-stealing module used by the Onderon family of backdoors.[1]

ID: S0486
ⓘ
Type: MALWARE
ⓘ
Platforms: Linux
Version: 1.0
Created: 16 July 2020
Last Modified: 25 April 2025
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1059 Command and Scripting Interpreter

Bonadan can create bind and reverse shells on the infected system.[1]

Enterprise T1554 Compromise Host Software Binary

Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.[1]
Enterprise T1573 .001 Encrypted Channel: Symmetric Cryptography

Bonadan can XOR-encrypt C2 communications.[1]
Enterprise T1105 Ingress Tool Transfer

Bonadan can download additional modules from the C2 server.[1]
Enterprise T1057 Process Discovery

Bonadan can use the ps command to discover other cryptocurrency miners active on the system.[1]
Enterprise T1496 .001 Resource Hijacking: Compute Hijacking

Bonadan can download an additional module which has a cryptocurrency mining extension.[1]
Enterprise T1082 System Information Discovery

Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.[1]
Enterprise T1016 System Network Configuration Discovery

Bonadan can find the external IP address of the infected host.[1]
Enterprise T1033 System Owner/User Discovery

Bonadan has discovered the username of the user running the backdoor.[1]

References

  1. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.