ZynorRAT: Go-Based Malware Taking Shape on Telegram

ZynorRAT: Emerging Go-Based RAT Using Telegram as C2

Summary

First detected in July 2025, ZynorRAT is a newly emerging Go-based remote access trojan (RAT) that uses Telegram bots as command-and-control (C2) hubs. Although still in active development and not widely deployed, ZynorRAT already demonstrates a powerful feature set, including remote command execution, file exfiltration, process and system enumeration, screenshot capture, and persistence mechanisms.

Telemetry reveals that the author—likely operating from Turkey—is experimenting on cloud instances, iterating code, and re-uploading samples to bypass detection. This tool could soon appear on underground forums as a customizable RAT-for-hire, posing a rising threat to both enterprise and cloud infrastructure.

Attack Details

ZynorRAT is compiled as a 64-bit ELF Go binary (Linux variant) with symbols preserved, making static analysis easier. The malware’s core behaviors include:

• C2 via Telegram: Converts a Telegram bot into a live operator console. Non-matching bot messages are treated as shell input, executed with bash -c, granting full remote command execution capability.

• Persistence: Creates a systemd user service under ~/.config/systemd/user to maintain persistence across reboots.

• Functionality: Supports command execution, file theft, system inspection, process enumeration, and screenshot capture.

• Testing Behavior: Many observed infected hosts are disposable cloud instances, indicating active testing. Distribution of executables has been linked to Dosya.co file-sharing services.

• Attribution Clues: Repeated references to the name “Halil” and Turkish IP telemetry suggest a likely single developer or small operator team.

Recommendations

• Block Telegram Bot Traffic: Restrict or block outbound connections to api.telegram.org and known bot endpoints at the firewall or proxy layer.

• Monitor for New systemd User Services: Detect and alert on suspicious files within ~/.config/systemd/user.

• Apply Least Privilege: Avoid running everyday accounts with administrative rights to limit malware capabilities if compromised.

• Control File-Sharing Access: Restrict downloads from public file-sharing services (like Dosya.co) on critical systems and sandbox suspicious files before execution.

• Deploy Advanced Endpoint Security: Utilize NGAV/EDR solutions with behavioral and ML-based detections to catch memory-resident RAT activity.

Indicators of Compromise (IoCs)

SHA256 Hashes

• 037e5fe028a60604523b840794d06c8f70a9c523a832a97ecaaccd9f419e364a

• 47338da15a35c49bcd3989125df5b082eef64ba646bb7a2db1565bb413b69323

• c890c6e6b7cc6984cd9d9061d285d814841e0b8136286e6fd943013260eb8461

• 237a40e522f2f1e6c71415997766b4b23f1526e2f141d68ff334de3ff5b0c89f

• 48c2a8453feea72f8d9bfb9c2731d811e7c300f3e1935bddd7188324aab7d30d

• 4cd270b49c8d5c31560ef94dc0bee2c7927d6f3e77173f660e2f3106ae7131c3

• a6c450f9abff8a22445ba539c21b24508dd326522df525977e14ec17e11f7d65

• bceccc566fe3ae3675f7e20100f979eaf2053d9a4f3a3619a550a496a4268ef5

• 8b09ba6e006718371486b3655588b438ade953beecf221af38160cbe6fedd40a

• f9eb2a54e500b3ce42950fb75af30955180360c978c00d081ea561c86e54262d

Domain

• api[.]telegram[.]org

MITRE ATT&CK TTPs

• Execution: T1059 (Command and Scripting Interpreter)

• Persistence: T1543 (Create or Modify System Process), T1543.002 (systemd Service)

• Discovery: T1057 (Process Discovery), T1083 (File and Directory Discovery)

• Collection: T1113 (Screen Capture)

• Exfiltration: T1041 (Exfiltration Over C2 Channel)

• Command & Control: T1071 (Application Layer Protocol), T1102 (Web Service), T1102.002 (Bidirectional Communication)

References

• Sysdig – ZynorRAT Technical Analysis