Raspberry Pi Malware uses IRC Remote Access Trojan (RAT)

The video analyzes a self-propagating bash script malware targeting Raspberry Pi devices that uses Internet Relay Chat (IRC) for command and control (C2) and spreads via default SSH credentials 0:10.

Key Takeaways:
• The script achieves persistence by copying itself to /etc/rc.local if running as root, or using sudo to do so, ensuring it executes on boot and changes the user password 2:04 3:49.
• It establishes a C2 channel by connecting to random IRC servers on port 6667, joining a specific channel, and waiting for base64-encoded commands within private messages 11:00 15:56.
• The malware installs tools like zmap and sshpass to scan for open SSH ports and brute-force default credentials ("pi/raspberry") to propagate to new victims 17:34 18:01.
• To maintain control, the malware removes bash history files, alters DNS settings, and terminates competing processes like crypto miners 4:38 5:38.

This analysis demonstrates how legacy protocols like IRC remain effective for modern malware operations and botnets 20:42.

Sources:

• 0:10 Introduction of the malware found on a Raspberry Pi
• 2:04 Checking for root privileges and persistence mechanism
• 3:49 Adding script to rc.local for startup persistence
• 4:38 Killing compe