Inside Linux GoGra Backdoor

GoGra is an interesting backdoor family which emerged in 2024, mostly targeting India and Afghanistan. This year, its developers released a Linux variant with several smart mechanisms: an implant hidden in the dropper ELF binary, abuse of the Microsoft Graph API as an email-based dead-drop C2.

The sample we are studying in this talk targets India. It is typically distributed in the form of a file named "TheExternalAffairesMinister. pdf", where the space between the dot and the PDF is a trick to make the victim think the file is a PDF.

It's not: the file is an ELF binary, precisely a dropper, which fetches within itself another embedded binary (payload). That payload is immediately executed, and in parallel, a decoy PDF is displayed.

In this talk, we present 2 different aspects:

1. Functionalities of GoGra. We can't detail them all, we'll focus on how the implant is hidden and how emails are encrypted.
2. How I reversed. As the name goes, GoGra is implemented in Go, which is usually painful to reverse. I used Ghidra, and "enhanced" myself with a Ghidra MCP piloted by a LLM. But, hey, wait, AI didn't do it all, I had to work ;) Basically, AI helped speed up creation of a few Ghidra scripts, but it lacked intuition and knowledge on how to reverse Go.