4 Uncommon Programming Languages for Malware Development

Technological advancements are one of the vital factors in the modern era. The latest technologies have improved efficiency, altered the status of society, and revolutionized living standards. However, they can also be misused by malicious actors with evil intentions or turned against the purpose of their creation. Bad actors have a reputation for being slow to change what works for them, but it’s not always the case. However, some malware groups have taken advantage of trying uncommon programming languages for malware development.

Programming languages for malware development, such as DLang, Nim, Rust, and Go, are becoming famous among malware authors for bypassing security defenses and addressing the weak points in their development process, BlackBerry researchers report. The research team selected these four programming languages because they have noticed an increase in their use for malicious intent and an increased number of malware families using them. Now the question arises why is there an escalation in the number of malware families being detected using these uncommon programming languages for malware development? Let’s find the answer.

Why Do Malware Authors Use Uncommon Programming Languages to Develop Malware?

New languages are generally adopted to overcome a deficiency in an existing language. Their creators aim to make simple syntax, efficient memory management, and boost performance. Now, let’s find the reasons why malware authors use uncommon programming languages for malware development. Here are some of them.

Four Uncommon Programming Languages for Malware Development Are:

#1. DLANG

Walter Bright at Digital Mars created Dlang, which is a multi-paradigm system programming language released in 2001. The development of this language by Andrei Alexandrescu continued until the first stable release in 2007. According to a developer’s website note, “the general look of Dlang is like C and C++, which makes it easier to learn and transition code to D. Porting code to D from C/C++ should feel natural. The developers will not have to learn entirely new methods of doing things”.

This language aims to offer developers ways to author code efficiently and quickly. It is helpful for applications such as machine learning (ML), web development, data analytics, GUI application, kernel development, and AAA video game development. Moreover, it can be used on different operating systems, including macOS, Linux, Windows, and even Android, with several compiler support.

By Dreak Banas

Dlang Features

Dlang has several qualities that make it appealing to malware authors.

Examples of Malware Written in Dlang

The fact that Dlang can be cross-compiled and the ease of use for C programmers makes it an ideal language to be used by threat actors. Here are some examples of malware written in this language.

It was the first utility developed by FireEye to use in its red-teaming services. The DShell existence was unveiled unwittingly to the public after a data breach. An unnamed APT threat actor penetrated its network in December 2020. DShell is a Dlang-compiled red-team tool that operates like a backdoor. It is capable of modifying firewall rules, connecting to a command and control channel, and containing an encoded payload.

The Vovalex ransomware first made an appearance in February 2021. It uses Trojanized versions of commonly used applications like CCleaner as an infection vector. This Trojan executes on an installer sub-process giving the user an impression that everything is going as expected. Vovalex is a relatively unsophisticated variant of ransomware by today’s standards.

The Vovalex ransomware first made an appearance in February 2021. It uses Trojanized versions of commonly used applications like CCleaner as an infection vector. This Trojan executes on an installer sub-process giving the user an impression that everything is going as expected. Vovalex is a relatively unsophisticated variant of ransomware by today’s standards.

#2. NIM

It’s a notable programming language that is becoming progressively common due to various features making it stand out from other options. Nim is statically compiled like more mature languages, such as Java, C, and C++. Andreas Rumpf started the development in 2005 under “Nimrod”. Version 0.6.0 was published in 2008. It was the first release where the compiler was written and compiled in Nim despite being developed in pascal.

By GameFromscratch

Nim Features

Nim was designed by keeping these three goals in mind.

Expressiveness

Elegant

Examples of Malware Written in Nim

Threat actor TA800 distributed new malware in a phishing campaign in February 2021. The samples were written in Nim and inspired the name NimzaLoader. It is generally distributed via phishing emails. In the Past, TA800 has been found using BazarLoader or Trickbot in its attacks.

It’s a malware family first seen in 2015. Zebrocy is generally distributed as an email attachment targeting the foreign affairs ministry and embassies in Central Asia and Eastern Europe. Over the years, it has been rewritten in different programming languages. However, the first Nim downloader for it appeared in 2019.

The IObit forums were used to distribute DeroHE ransomware in January 2021. Emails with offers were sent to several forum users for a one-year free subscription for IObit products. 

It has become a famous tool among adversaries for command and control channels. Detecting and stopping various loaders used to download the Cobalt Strike beacons is something that many endpoint protection solutions have become good at. Various loaders written in Nim were found to counter the effectiveness of these products.

Graydon Hoare started the Rust programming language project in 2006 as a side work at Mozilla Research. This language has become an independent organization from Mozilla since 2015. However, it has been used in major applications, such as Mozilla’s Firefox web browser. Other organizations, such as Google, Facebook, and Amazon Web Services (AWS), act as a steward for the project.

#3. RUST

Despite being a new programming language, Rust is favorite among developers. It combines the power of low-level control with memory efficiency and speed. Garbage collection is centered around automatic memory management in languages like Python and Java. Rust also gives a notable improvement in memory safety over C and C++.

By Kofi Group

Rust Features

Examples of Malware Written in Rust

It’s Rust-based adware that has targeted macOS systems in 2021. The method of how this adware arrived on a system is unknown, but it may be downloaded using other adware despite the user. 

RustyBeur is a malware loader written in C that was first distributed using phishing campaigns in 2019. This malware is sold in the underground marketplace to download Trojans or ransomware.

One of the Rust malware samples was found by the antivirus vendor Dr.Web in 2016. This Linux backdoor leveraging IRC was a proof of concept because the sample was not capable of spreading to other victims.

TeleBots are considered to originate from a Russian threat actor. It has been associated with the attacks against Ukraine’s critical infrastructure. However, TeleBots is often seen using the KillDisk malware. 

Go

In 2007, Go was developed by Rob Pike, Robert Griesemer, and Ken Thompson. It was released in 2012 but made public in 2009. Google developed Go, and they sought to address the disconnect between the older languages and the computing landscape reality. Many others, including Uber, Twitch, Soundcloud, and Docker, have adopted it along the way. However, Go might not be the most loved language among developers, but it’s most wanted. The Go website defines its purpose as “making it easy to build, reliable, simple, and efficient software.”

By FreeCodeCamp.org

Go Features

Examples of malware written in Go

EKANS, also known as Snake, is an obfuscated malware written in Go. It is unique for having specific industrial control processes as its victims. It also differentiates itself as a rare instance where industrial operations are targeted by the actor motivated by financial gain rather than a nation-state.

It’s a malware family generally associated with APT29. These implants are cross-compiled for ELF and PE supporting HTTPS, HTTP, and DNS communications. Once a connection is established, newer variants support PowerShell capabilities.

The rewrite of Zebrocy in Go was seen in 2018. Moreover, a Zebrocy downloader executable developed in Go was discovered in October 2020. 

Encriyoko, considered the first sample of the Go malware Trojan, was first reported in 2012 by Broadcom. It attempts to pose as an Android rooting tool called GalaxyNxRoot.exe. This file is ransomware that uses the Blowfish algorithm to encrypt targets’ files.

Conclusion

Older malware written in common languages like C, C++, and C# is being given new life with loaders and droppers written in the uncommon programming languages for malware development mentioned in this article. However, wrappers and loaders are cost-effective. Some well-resourced threat actors are starting to rewrite existing malware using these exotic languages. There might be a less apparent reason for generating these rewrites. It is easier to recreate an existing solution while learning a new programming language. Developers only need to concentrate on the language rather than battling the steeper learning curve to create a new solution.

Thanks for reading this post. Please read more such interesting articles here: