DOCSLIB.ORG

Kuluoz: Malware and Botnet Analysis

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Kuluoz: Malware and Botnet Analysis IDC Herzliya Efi Arazi School of Computer Science MSc in Computer Science Kuluoz: Malware and botnet analysis M.Sc. dissertation for applied project Submitted by: Shaked Bar ID: 300895224 Supervisor: Mr. Amichai Shulman August 15, 2013 Kuluoz – malware and botnet analysis Shaked Bar, IDC, Hertzelia, Israel Table of Contents 1. Abstract ..............................................................................................4 2. Introduction ........................................................................................4 3. Related Work ......................................................................................5 4. Infection Process and Summary of Capabilities ........................................6 4.1. Infection and Distribution ................................................................6 4.2. Revision History ..............................................................................7 4.3. Software Engineering ......................................................................8 5. Module Overview ................................................................................9 5.1. Botnet Expansion Module .............................................................. 10 5.1.1. General description .................................................................. 10 5.1.2. Flow ........................................................................................ 10 5.1.3. Configuration ........................................................................... 11 5.1.4. Manipulating the C&C ............................................................... 13 5.2. Vulnerability Scanning Module ....................................................... 14 5.3. Information Stealing Module .......................................................... 15 5.4. Commercial Spam Module ............................................................. 15 6. Malware injected through the Botnet................................................... 16 6.1. Win32/FakeAV .............................................................................. 16 6.2. Win32/ZBot .................................................................................. 17 6.3. Win32/ZeroAccess ........................................................................ 18 7. C&C Communications ......................................................................... 19 7.1. Victim ID ...................................................................................... 19 7.2. C&C protocols overview ................................................................. 19 7.3. “Next action” Request ................................................................... 20 7.4. Update C&C Server List .................................................................. 22 7.5. Additional Requests....................................................................... 23 7.6. Multiple C&C Networks.................................................................. 23 2 7.7. Encryption algorithms .................................................................... 24 7.7.1. Module encryption ................................................................... 24 7.7.2. C&C protocol encryption ........................................................... 24 7.7.3. Module communications encryption ........................................... 24 8. C&C Network Structure ...................................................................... 25 8.1. Overview...................................................................................... 25 8.2. Number of C&C Servers by Date ..................................................... 25 8.3. C&C Servers Life Span .................................................................... 26 8.3.1. Life span by version .................................................................. 26 8.3.2. Life Span by Geography ............................................................. 26 8.4. Servers by Geography .................................................................... 27 9. Malware Changes Over Time ............................................................... 29 9.1. DLL Revision Changes .................................................................... 29 9.2. C&C Request Protocol .................................................................... 29 9.3. C&C Response Protocol.................................................................. 29 10. Analysis Protection ............................................................................. 30 10.1. Blacklisting ................................................................................... 30 10.1.1. Identifier based blacklisting ....................................................... 30 10.1.2. IP based blacklisting .................................................................. 30 10.1.3. Empty responses on error .......................................................... 31 10.1.4. Using IP addresses rather than domain addresses ........................ 31 11. Mother-Ship Investigation ................................................................... 32 11.1. Triangulation ................................................................................ 32 11.2. Injection and Request Smuggling Attempts ...................................... 34 11.2.1. SQL Injection attempts .............................................................. 34 11.2.2. Cross Side Scripting (XSS) attempts ............................................. 34 11.2.3. Request Smuggling Attempts ..................................................... 35 12. Conclusions ....................................................................................... 36 13. Table of figures .................................................................................. 38 13.1. Figures ......................................................................................... 38 13.2. Tables .......................................................................................... 38 14. References ........................................................................................ 39 תקציר 14 3 1. Abstract Kuluoz is a commercial malware that infected a large number of machines around the world, and produced a significant amount of spam. The botnet induced by the malware, also known as the Asprox botnet, has drawn the interest of security researchers worldwide, and was covered by a report by Trend Micro1. The Asprox botnet is an old botnet, which achieved great success a few years ago2, mainly at 2008, and have gone off the radar since 2010. This work extends the report, using research results from work on a large amount of data, from the last 10 months. Our work presents a view on the malware and its capabilities, and adding new information on its structure, C&C network, and changes to the malware over time, and different protection mechanisms. We will try to spot the main keys for its success and long run – the ability to make changes quickly and easily, features that help it to stay off the radar, and its C&C architecture, which hides the core servers by a series of hacked proxy servers that are easily replaced. The report will also try to shed light on the C&C's "Mothership" – in terms of location, roles, and security. 2. Introduction This report describes a family of malware, spread by spear-Phishing, which is identified by most antivirus vendors as Kuluoz. The malware, despite being rather simple in terms of infection process, reached impressive spread and created a large botnet with many capabilities – generating a large amount of spam, spreading various third party viruses, and stealing information from users. We analyzed the malware for the last 10 months, focusing on functional analysis – trying to understand the Trojans capabilities, methods of infection and distribution, and C&C protocols. We dynamically analyzed the malware, both in open (Internet) and closed (local virtual network simulation) environments. We used network captures, system monitoring tools and a variety of scripts, developed specifically for the analysis of the data. After understanding the C&C protocols, we also created simulations for the different modules, in order to test the C&C responses and understand how it works, and to try to learn about its core – the C&C's "Mothership". 1 Asprox report on Trend Micro 2 An Analysis of the Asprox Botnet, Ravishankar Borgaonkar 4 3. Related Work Initial reports on the malware Kuluoz have been published at June 2012. Most of the preliminary reports were basic anti-virus vendors' reports, such as [21], which had basic information about the malware's capabilities, and ways to remove it. However Asprox, the botnet induced by the malware, has drawn attention, mainly at 2008, and was covered by reports such as [2], that explained its previous structure and actions. The main and only extensive report on Kuluoz and the updated Asprox botnet so far was published by Trend Micro [1] on March 2013, during the later stages of our research. The report covered the malware's infection methods, its main modules and affiliates, the network communications and the C&C network. Our work extends the view on the malware in a number of aspects: Explaining in detail the malware's modular structure, that helped it to succeed for a long period of time. Adding more data on some of the malwares modules and affiliate malware, especially on the botnet expansion module, including interesting discoveries on their network communications and C&C network. Focusing on the malware's improvements
Load more

Recommended publications
  • The Botnet Chronicles a Journey to Infamy
    The Botnet Chronicles A Journey to Infamy Trend Micro, Incorporated Rik Ferguson Senior Security Advisor A Trend Micro White Paper I November 2010 The Botnet Chronicles A Journey to Infamy CONTENTS A Prelude to Evolution ....................................................................................................................4 The Botnet Saga Begins .................................................................................................................5 The Birth of Organized Crime .........................................................................................................7 The Security War Rages On ........................................................................................................... 8 Lost in the White Noise................................................................................................................. 10 Where Do We Go from Here? .......................................................................................................... 11 References ...................................................................................................................................... 12 2 WHITE PAPER I THE BOTNET CHRONICLES: A JOURNEY TO INFAMY The Botnet Chronicles A Journey to Infamy The botnet time line below shows a rundown of the botnets discussed in this white paper. Clicking each botnet’s name in blue will bring you to the page where it is described in more detail. To go back to the time line below from each page, click the ~ at the end of the section. 3 WHITE
    [Show full text]
  • An Analysis of the Asprox Botnet
    An Analysis of the Asprox Botnet Ravishankar Borgaonkar Technical University of Berlin Email: [email protected] Abstract—The presence of large pools of compromised com- motives. Exploitable vulnerabilities may exist in the Internet puters, also known as botnets, or zombie armies, represents a infrastructure, in the clients and servers, in the people, and in very serious threat to Internet security. This paper describes the way money is controlled and transferred from the Internet the architecture of a contemporary advanced bot commonly known as Asprox. Asprox is a type of malware that combines into traditional cash. Many security firms and researchers are the two threat vectors of forming a botnet and of generating working on developing new methods to fight botnets and to SQL injection attacks. The main features of the Asprox botnet mitigate against threats from botnets [7], [8], [9]. are the use of centralized command and control structure, HTTP based communication, use of advanced double fast-flux service Unfortunately, there are still many questions that need to networks, use of SQL injection attacks for recruiting new bots be addressed to find effective ways of protecting against the and social engineering tricks to spread malware binaries. The threats from botnets. In order to fight against botnets in future, objective of this paper is to contribute to a deeper understanding of Asprox in particular and a better understanding of modern it is not enough to study the botnets of past. Botnets are botnet designs in general. This knowledge can be used to develop constantly evolving, and we need to understand the design more effective methods for detecting botnets, and stopping the and structure of the emerging advanced botnets.
    [Show full text]
  • C&C Botnet Detection Over
    C&C Botnet Detection over SSL Riccardo Bortolameotti University of Twente - EIT ICT Labs masterschool [email protected] Dedicated to my parents Remo and Chiara, and to my sister Anna 2 Abstract Nowadays botnets are playing an important role in the panorama of cyber- crime. These cyber weapons are used to perform malicious activities such fi- nancial frauds, cyber-espionage, etc... using infected computers. This threat can be mitigated by detecting C&C channels on the network. In literature many solutions have been proposed. However, botnet are becoming more and more complex, and currently they are trying to move towards encrypted solutions. In this work, we have designed, implemented and validated a method to detect botnet C&C communication channels over SSL, the se- curity protocol standard de-facto. We provide a set of SSL features that can be used to detect malicious connections. Using our features, the results indicate that we are able to detect, what we believe to be, a botnet and ma- licious connections. Our system can also be considered privacy-preserving and lightweight, because the payload is not analyzed and the portion of an- alyzed traffic is very small. Our analysis also indicates that 0.6% of the SSL connections were broken. Limitations of the system, its applications and possible future works are also discussed. 3 4 Contents 1 Introduction 7 1.1 Problem Statement . .9 1.2 Research questions . 10 1.2.1 Layout of the thesis . 11 2 State of the Art 13 2.1 Preliminary concepts . 13 2.1.1 FFSN .
    [Show full text]
  • Zerohack Zer0pwn Youranonnews Yevgeniy Anikin Yes Men
    Zerohack Zer0Pwn YourAnonNews Yevgeniy Anikin Yes Men YamaTough Xtreme x-Leader xenu xen0nymous www.oem.com.mx www.nytimes.com/pages/world/asia/index.html www.informador.com.mx www.futuregov.asia www.cronica.com.mx www.asiapacificsecuritymagazine.com Worm Wolfy Withdrawal* WillyFoReal Wikileaks IRC 88.80.16.13/9999 IRC Channel WikiLeaks WiiSpellWhy whitekidney Wells Fargo weed WallRoad w0rmware Vulnerability Vladislav Khorokhorin Visa Inc. Virus Virgin Islands "Viewpointe Archive Services, LLC" Versability Verizon Venezuela Vegas Vatican City USB US Trust US Bankcorp Uruguay Uran0n unusedcrayon United Kingdom UnicormCr3w unfittoprint unelected.org UndisclosedAnon Ukraine UGNazi ua_musti_1905 U.S. Bankcorp TYLER Turkey trosec113 Trojan Horse Trojan Trivette TriCk Tribalzer0 Transnistria transaction Traitor traffic court Tradecraft Trade Secrets "Total System Services, Inc." Topiary Top Secret Tom Stracener TibitXimer Thumb Drive Thomson Reuters TheWikiBoat thepeoplescause the_infecti0n The Unknowns The UnderTaker The Syrian electronic army The Jokerhack Thailand ThaCosmo th3j35t3r testeux1 TEST Telecomix TehWongZ Teddy Bigglesworth TeaMp0isoN TeamHav0k Team Ghost Shell Team Digi7al tdl4 taxes TARP tango down Tampa Tammy Shapiro Taiwan Tabu T0x1c t0wN T.A.R.P. Syrian Electronic Army syndiv Symantec Corporation Switzerland Swingers Club SWIFT Sweden Swan SwaggSec Swagg Security "SunGard Data Systems, Inc." Stuxnet Stringer Streamroller Stole* Sterlok SteelAnne st0rm SQLi Spyware Spying Spydevilz Spy Camera Sposed Spook Spoofing Splendide
    [Show full text]
  • Downloading and Running
    City Research Online City, University of London Institutional Repository Citation: Meng, X. (2018). An integrated networkbased mobile botnet detection system. (Unpublished Doctoral thesis, City, Universtiy of London) This is the accepted version of the paper. This version of the publication may differ from the final published version. Permanent repository link: https://openaccess.city.ac.uk/id/eprint/19840/ Link to published version: Copyright: City Research Online aims to make research outputs of City, University of London available to a wider audience. Copyright and Moral Rights remain with the author(s) and/or copyright holders. URLs from City Research Online may be freely distributed and linked to. Reuse: Copies of full items can be used for personal research or study, educational, or not-for-profit purposes without prior permission or charge. Provided that the authors, title and full bibliographic details are credited, a hyperlink and/or URL is given for the original metadata page and the content is not changed in any way. City Research Online: http://openaccess.city.ac.uk/ [email protected] AN INTEGRATED NETWORK- BASED MOBILE BOTNET DETECTION SYSTEM Xin Meng Department of Computer Science City, University of London This dissertation is submitted for the degree of Doctor of Philosophy City University London June 2017 Declaration I hereby declare that except where specific reference is made to the work of others, the contents of this dissertation are original and have not been submitted in whole or in part for consideration for any other degree or qualification in this, or any other University. This dissertation is the result of my own work and includes nothing which is the outcome of work done in collaboration, except where specifically indicated in the text.
    [Show full text]
  • City Research Online
    City Research Online City, University of London Institutional Repository Citation: Acarali, D., Rajarajan, M., Komninos, N. and Herwono, I. (2016). Survey of Approaches and Features for the Identification of HTTP-Based Botnet Traffic. Journal of Network and Computer Applications, doi: 10.1016/j.jnca.2016.10.007 This is the accepted version of the paper. This version of the publication may differ from the final published version. Permanent repository link: https://openaccess.city.ac.uk/id/eprint/15580/ Link to published version: http://dx.doi.org/10.1016/j.jnca.2016.10.007 Copyright: City Research Online aims to make research outputs of City, University of London available to a wider audience. Copyright and Moral Rights remain with the author(s) and/or copyright holders. URLs from City Research Online may be freely distributed and linked to. Reuse: Copies of full items can be used for personal research or study, educational, or not-for-profit purposes without prior permission or charge. Provided that the authors, title and full bibliographic details are credited, a hyperlink and/or URL is given for the original metadata page and the content is not changed in any way. City Research Online: http://openaccess.city.ac.uk/ [email protected] Journal Logo 00 (2016) 1{19 Survey of Approaches and Features for the Identification of HTTP-Based Botnet Traffic Dilara Acaralia, Muttukrishnan Rajarajana, Nikos Komninosa, Ian Herwonob aSchool of Engineering and Mathematical Science, City University London, London, United Kingdom. bSecurity Futures Practice, Research & Innovation, British Telecom, Ipswich IP5 3RE, United Kingdom. Abstract Botnet use is on the rise, with a growing number of botmasters now switching to the HTTP-based C&C infrastructure.
    [Show full text]
  • Detecting HTTP Botnet Using Artificial Immune System (AIS)
    International Journal of Applied Information Systems (IJAIS) – ISSN : 2249-0868 Foundation of Computer Science FCS, New York, USA Volume 2– No.6, May 2012 – www.ijais.org Detecting HTTP Botnet using Artificial Immune System (AIS) Amit Kumar Tyagi Sadique Nayeem Department of Computer Science, Department of Computer Science School of Engineering and Technology, School of Engineering and Technology, Pondicherry University, Puducherry-605014, INDIA Pondicherry University, Puducherry-605014, INDIA ABSTRACT „Bot‟ is nothing but a derived term from “ro-Bot” [40] which is Today‟s various malicious programs are “installed” on a generic term used to describe a script or sets of scripts machines all around the world, without any permission of the designed to perform predefined function in automated fashion. users, and transform these machines into Bots, i.e., hosts Botnet is a collection of compromised Internet hosts (thousands completely under to control of the attackers. Botnet is a of Bots) that have been installed with remote control software collection of compromised Internet hosts (thousands of Bots) developed by malicious users to maximize the profit from that have been installed with remote control software developed performing illegal activities on online network. After the Bot by malicious users to maximize the profit performing illegal code has been installed into the compromised computers, activities like DDoS, Spamming, and Phishing etc attack on following services are provided by Bots to its Botmaster: online network. Moreover various types of Command and Robust network connectivity Control(C&C) infrastructure based Botnets are existing today Individual encryption and control traffic dispersion e.g. IRC, P2P, HTTP Botnet.
    [Show full text]
  • Peer to Peer Botnet Detection Based on Flow Intervals and Fast Flux Network Capture
    Peer to Peer Botnet Detection Based on Flow Intervals and Fast Flux Network Capture by David Zhao B. Eng., University of Victoria, 2010 A Thesis Submitted in Partial Fulfillment of the Requirements for the Degree of M.A.Sc. in the Faculty of Engineering David Zhao, 2012 University of Victoria All rights reserved. This thesis may not be reproduced in whole or in part, by photocopy or other means, without the permission of the author. ii Supervisory Committee Peer to Peer Botnet Detection Based on Flow Intervals and Fast Flux Network Capture by David Zhao B. Eng., University of Victoria, 2010 Supervisory Committee Dr. Issa Traore, Department of Electrical and Computer Engineering Supervisor Dr. Kin Li, Department of Electrical and Computer Engineering Departmental Member iii Abstract Supervisory Committee Dr. Issa Traore, Department of Electrical and Computer Engineering Supervisor Dr. Kin Li, Department of Electrical and Computer Engineering Botnets are becoming the predominant threat on the Internet today and is the primary vector for carrying out attacks against organizations and individuals. Botnets have been used in a variety of cybercrime, from click-fraud to DDOS attacks to the generation of spam. In this thesis we propose an approach to detect botnet activity using two different strategies both based on machine learning techniques. In one, we examine the network flow based metrics of potential botnet traffic and show that we are able to detect botnets with only data from a small time interval of operation. For our second technique, we use a similar strategy to identify botnets based on their potential fast flux behavior.
    [Show full text]
  • Slide Credit: Vitaly Shmatikov
    Malware: Botnets, Viruses, and Worms Damon McCoy Slide Credit: Vitaly Shmatikov slide 1 Malware u Malicious code often masquerades as good software or attaches itself to good software u Some malicious programs need host programs • Trojan horses (malicious code hidden in a useful program), logic bombs, backdoors u Others can exist and propagate independently • Worms, automated viruses u Many infection vectors and propagation methods u Modern malware often combines trojan, rootkit, and worm functionality slide 2 PUP u Potentially unwanted programs • Software the user agreed to install or was installed with another wanted program but is, spyware, adware slide 3 Viruses vs. Worms VIRUS WORM u Propagates by u Propagates infecting other automatically by programs copying itself to target systems u Usually inserted into u A standalone program host code (not a standalone program) slide 5 “Reflections on Trusting Trust” u Ken Thompson’s 1983 Turing Award lecture 1. Added a backdoor-opening Trojan to login program 2. Anyone looking at source code would see this, so changed the compiler to add backdoor at compile- time 3. Anyone looking at compiler source code would see this, so changed the compiler to recognize when it’s compiling a new compiler and to insert Trojan into it u “The moral is obvious. You can’t trust code you did not totally create yourself. (Especially code from companies that employ people like me).” slide 6 Viruses u Virus propagates by infecting other programs • Automatically creates copies of itself, but to propagate, a human
    [Show full text]
  • P0w3d for Botnet Cnc
    OWASP AppSec USA 2010 P0w3d for Botnet CnC Gunter Ollmann, VP Research [email protected] About • Gunter Ollmann – VP of Research, Damballa Inc. – Board of Advisors, IOActive Inc. • Brief Bio: – Formerly Chief Security Strategist for IBM, Director of X-Force for ISS, Professional Services Director for NGS Software, Head of Attack Services EMEA, etc. – Frequent writer, columnist and blogger with lots of whitepapers… • http://blog.damballa.com & http://technicalinfodotnet.blogspot.com/ • Special thanks to Sean Bodmer and Lance James… OWASP AppSec 2010 USA – P0wn3d for Botnet CnC – Gunter Ollmann Bots 9/6/2010 4 Shifting sands of botnet CnC • Everyday access to 100k-2M bots – Price range from $200 (24hr use) to $50k (to own) • Self-build botnet provisioning – Off-the-shelf tools – Avg. 20k bots within a week (500k if optimized) • Globally distributed CnC infrastructure (normal) 9/6/2010 OWASP AppSec 2010 USA – P0wn3d for Botnet CnC – Gunter Ollmann 5 Changes in Attack Strategy Old way New way (1) Recon the location (1) Target the entire location (2) Select the most vulnerable site (2) Launch all exploits, against all targets, (3) Recon the target simultaneously (4) Test defenses (5) Exploit weakest vulnerability “lowest hanging fruit” “the Monte Carlo method” 9/6/2010 OWASP AppSec 2010 USA – P0wn3d for Botnet CnC – Gunter Ollmann 6 Ecosystem • One-to-one relationships are dead – One botnet per malware (fiction) – One botnet per operator (fiction) • Federated ecosystem – Professional service provisioning – Cottage industry of plug-ins – Talented and specialist contractors 9/6/2010 OWASP AppSec 2010 USA – P0wn3d for Botnet CnC – Gunter Ollmann 7 Botnet Ecosystem Affiliates Resellers Distribution, infection, etc.
    [Show full text]
  • 151682582.Pdf
    CYBER SECURITY ESSENTIALS CYBER SECURITY ESSENTIALS Edited by James Graham Richard Howard Ryan Olson Auerbach Publications Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2011 by Taylor and Francis Group, LLC Auerbach Publications is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S. Government works Printed in the United States of America on acid-free paper 10 9 8 7 6 5 4 3 2 1 International Standard Book Number-13: 978-1-4398-5126-5 (Ebook-PDF) This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information stor- age or retrieval system, without written permission from the publishers. For permission to photocopy or use material electronically from this work, please access www.copy- right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc.
    [Show full text]
  • Botnet Detection Using Passive DNS
    Botnet Detection Using Passive DNS Master Thesis Pedro Marques da Luz [email protected] Supervisors: Erik Poll (RU) Harald Vranken (RU & OU) Sicco Verwer (TUDelft) Barry Weymes (Fox-IT) Department of Computing Science Radboud University Nijmegen 2013/2014 Abstract The Domain Name System (DNS) is a distributed naming system fundamental for the normal operation of the Internet. It provides a mapping between user-friendly domain names and IP addresses. Cyber criminals use the flexibility provided by the DNS to deploy certain techniques that allow them to hide the Command and Control (CnC) servers used to manage their botnets and frustrate the detection efforts. Passive DNS (pDNS) data allows us to analyse the DNS history of a given domain name. Such is achieved by passively collecting DNS queries and the respective answers that can then be stored and easily queried. By analyzing pDNS data, one can try to follow the traces left by such techniques and be able to identify the real addresses of the botnet Command and Control servers. For instance, we expect malware-related domain names to have lower Time-to-Live (TTL) values than legitimate and benign domains. The aim of this research is the development of a proof-of-concept able to automatically analyze and identify botnet activity using pDNS data. We propose the use of machine learning techniques and devise a set of 36 different features to be used in the classification process. With two weeks of pDNS data we were able to set up, create and test different classifiers, namely k-Nearest Neighbours (kNN), Decision Trees and Random Forests.
    [Show full text]