Antarctica

Scenario

Antarctica, a stealthy Linux binary auto-starts via .profile, runs silently in the background, and may exfiltrate sensitive data through covert channels, compromising Station 97’s internal server activity. Your task is to analyze and reverse the binary file to find its internal logic, control flow, and hidden functionality. This will help you build practical skills in both static and dynamic analysis.

Executive Summary

Antarctica is a Go ELF backdoor built with garble, which scrambles function names and the Go runtime metadata but leaves string literals in plaintext. Static analysis of those strings and the code that references them exposed the full design. On start the binary takes a lock file so only one copy runs, then checks for VirtualBox through loaded kernel modules and DMI hardware strings. It plants an embedded SSH public key for persistent access, watches the user’s shell history with a filesystem notification API, and talks to its operator over DNS. The sample was analysed statically only and never executed.

Artifacts

• antarctica: a single stripped 64-bit Go ELF. Open with strings and objdump, plus a small Python script to parse the garbled pclntab and resolve string references

Tooling note: garble randomises the pclntab magic and renames functions, so Go plugins for disassemblers will not recover symbols. The .rodata strings are still readable, and the code that uses them is found by following RIP-relative lea instructions in the main.* function range.

Execution

Hash the sample straight after extraction, before anything else touches the working directory.

md5sum antarctica

strings shows a Go binary with scrambled symbol names. Disassemble it, locate the main.* functions, and resolve each RIP-relative lea plus its length argument to the .rodata literal it loads. The entry code loads a path under /tmp right next to the file-lock setup, which is the single-instance guard.

objdump -d --no-show-raw-insn antarctica > main.asm

strings -a antarctica | grep -E '^/tmp/'

Tip: Go strings are not NUL-terminated, so plain strings output runs several literals together. The lea and length pair in the disassembly gives the exact value.

Defense Evasion

Loaded-module checks on Linux read /proc/modules. That path sits in the anti-VM function next to the name of a VirtualBox guest kernel module.

strings -a antarctica | grep -E 'proc/modules|vbox'

A second anti-VM function reads hardware identity instead of modules. The DMI directory holds the vendor and product strings that give away a hypervisor, and its path literal is referenced from that function.

strings -a antarctica | grep -E 'sys/class/dmi'

Gotcha: The answer needs the trailing slash, because the malware builds file paths by appending names to this directory string.

Persistence

The key is a base64 blob in .rodata at offset 0x548b3d. It decodes to an ssh-rsa public key with the comment null@debian, the line the malware appends to authorized_keys for passwordless operator access. The blob length used below is simplified from the one-off extraction script.

dd if=antarctica bs=1 skip=$((0x548b3d)) count=752 2>/dev/null | base64 -d

Credential Access

The binary carries the IN_* event constants of the Go fsnotify package, which on Linux wraps the kernel’s inotify subsystem.

strings -a antarctica | grep -iE 'inotify|fsnotify'

From Q6 we know a watcher exists, so find the function that registers it. It builds a %s/%s path from a base directory and a filename literal, and the filename is the user’s shell history. Following new lines as they are written lets the malware capture anything typed on the command line, including credentials.

strings -a antarctica | grep -F '.bash_history'

Command and Control

The binary embeds a DNS client with EDNS handling and has no HTTP or raw-socket exfiltration strings. This answer was reasoned from that, not read from a single labelled artifact: a DNS library with its message handlers points to DNS as the covert channel, which also fits the scenario’s wording about covert channels.

strings -a antarctica | grep -iE 'edns|dns'

With DNS as the transport (Q8), look for a hostname literal in the string table. One 20-character entry has the shape of a domain name. As with Q8, this was picked from the strings by shape and context rather than traced through the resolver call.

strings -a antarctica | grep -E '^[a-z0-9.-]+\.[a-z]+$'

Tip: .invalid is a reserved TLD that never resolves, so this looks like a placeholder value. It is still the indicator to hunt for.

Attack Summary

IOCs

MITRE ATT&CK

Defender Takeaways

Writes to authorized_keys by a non-SSH process are worth alerting on. The embedded key gives access that survives password changes. File integrity monitoring on ~/.ssh/authorized_keys and a baseline of approved keys would catch it, and the null@debian comment is an easy hunting string.

Shell profile persistence needs its own watch. The scenario has the binary launched from .profile, which runs at every login and needs no privileges. Monitor changes to .profile, .bashrc and similar files, and treat new background processes started from them as suspicious.

Obfuscation did not hide the strings. garble broke symbol recovery but left the lock path, module names, key and domain readable in .rodata. Static string extraction is a cheap first pass on obfuscated Go, and the same strings make good YARA material.

DNS egress should be constrained and logged. A host that speaks DNS to an arbitrary resolver for a name nobody recognises is the covert channel the scenario describes. Force DNS through monitored resolvers and alert on rare domains and unusual query volume per host.

Conclusion

Antarctica gives its operator a lasting SSH foothold, a view of what users type, and a quiet DNS path out, all from one lightweight Go binary. Obfuscating the symbols was not enough, because the indicators sat in plain strings the whole time.