2017 Annual ADFSL Conference on Digital Forensics, Security and Law Proceedings May 15th, 10:00 AM Kelihos Botnet: A Never-Ending Saga Arsh Arora University of Alabama, Birmingham, [email protected] Max Gannon University of Alabama, Birmingham, [email protected] Gary Warner University of Alabama, Birmingham, [email protected] Follow this and additional works at: https://commons.erau.edu/adfsl Part of the Defense and Security Studies Commons, Forensic Science and Technology Commons, Information Security Commons, OS and Networks Commons, Other Computer Sciences Commons, and the Science and Technology Studies Commons Scholarly Commons Citation Arora, Arsh; Gannon, Max; and Warner, Gary, "Kelihos Botnet: A Never-Ending Saga" (2017). Annual ADFSL Conference on Digital Forensics, Security and Law. 4. https://commons.erau.edu/adfsl/2017/papers/4 This Peer Reviewed Paper is brought to you for free and open access by the Conferences at Scholarly Commons. It has been accepted for inclusion in Annual ADFSL Conference on Digital Forensics, Security and Law by an (c)ADFSL authorized administrator of Scholarly Commons. For more information, please contact [email protected]. Kelihos Botnet: A Never-Ending Saga CDFSL Proceedings 2017 KELIHOS BOTNET: A NEVER-ENDING SAGA Arsh Arora, Max Gannon, Gary Warner University of Alabama at Birmingham 1201 University Blvd, Birmingham, AL 35233 fararora, gannonm, [email protected] ABSTRACT This paper investigates the recent behavior of the Kelihos botnet, a spam-sending botnet that accounts for many millions of emails sent each day. The paper demonstrates how a team of students are able to perform a longitudinal malware study, making significant observations and contributions to the understanding of a major botnet using tools and techniques taught in the classroom. From this perspective, the paper has two objectives: encouragement and observation. First, by providing insight into the methodology and tools used by student researchers to document and understand a botnet, the paper strives to embolden other academic programs to follow a similar path and to encourage such discovery. Second, the paper shares observations and insights gathered about the botnet's recent spam activity showing evidence of the \spam as a service" model and demonstrating a variety of unique and dangerous spam campaigns conducted via the Kelihos botnet, including banking trojans, credential phishing, and ransomware attacks. Keywords: Kelihos, Botnet, Malware, Spam, Ransomware, Banking Trojan, Pharma, Pump and Dump, Geo-Targeting 1. INTRODUCTION CrowdStrike, Dell Secureworks, Kaspersky, and others sinkholed 100,000 nodes of the While the Kelihos botnet first debuted in Kelihos.B malware [Kerkers et al., 2014]. At 2009, the current botnet is a functional deriva- RSA Conference 2013, CrowdStrike demon- tive of two other famous botnets, Waledac, strated a repeat performance, targeted Ke- and the Storm Worm [Adair, 2012, Bureau, lihos.C [Rossow et al., 2013, Werner, 2013]. 2011]. The Kelihos botnet is known by a Despite these admirable attempts, Kelihos number of aliases in the community includ- continues to send significant volumes of spam ing Hlux and Slenfbot [Singh et al., 2014]. on a daily basis [Stringhini et al., 2014]. Even Kelihos evolved and became sophisticated after all of the takedown attempts, Kelihos over time, but no interruption could stop the was still ranked as the top spam-sending bot- working of Kelihos. Two widely celebrated net in 2015 and continues to yield a signifi- takedowns of Kelihos have been performed by cant spam volume today [McAfee, 2016, Tech, security companies. The first was Operation 2016]. b79, conducted by Microsoft in September of 2009 [Nadji et al., 2013]. In March of 2012, The Kelihos botnet utilizes a peer to peer c 2017 ADFSL Page 9 CDFSL Proceedings 2017 Kelihos Botnet: A Never-Ending Saga network infrastructure that hides the loca- ilies. tion of the true command and control server Another addition to the spam campaign [Dietrich et al., 2013]. Kelihos-infected com- is sending links to a Word document that puters communicate with one another and will drop a variant of Zeus, specifically, geo- are used in two primary ways, depending targeting for German and United Kingdom on whether they have a publicly reachable banks. In the current iteration, it uses stolen IP address or not. Nodes which cannot be SMTP credentials to login as a legitimate addressed from the Internet just send spam. user to a large number of mail servers and Internet addressable nodes help to anonymize sends spam. the location of the C&C server by acting as a multi-tiered proxy, receiving requests for 2. NETWORK spam details from spamming nodes, and re- questing those same details from other nodes, eventually leading to a job server which is leased infrastructure and communicates with the C&C server, as documented by Fortinet's Kyle Yang at BlackHat [Yang, 2012]. The most unique aspect of Kelihos is the di- versity in its spam and its delivery mechanism. The spam diversity is primarily because Keli- hos provides \spam as a service" offering the use of its spamming infrastructure for hire to deliver any messages for a sender who is will- ing to pay their fees. The spam messages are Figure 1. Courtesy: Kyle Yang outlining Kelihos dominated by pharmaceutical spam, but are distribution network [Yang, 2012] not limited to it. Pharma spam seems to be Although the division of the botnet's oper- the fall-back position, when other higher pay- ation appears to be clear in Figure 1, the path ing customers have not hired the botnet to is actually complex. Starting from the bot- deliver something else. Kelihos has been ob- tom, the chart displays the worker or client served sending spam for pump and dump ma- nodes, which sends spam to the end user and nipulation of different stock symbols, money only communicate to the servers at the proxy mule job applications, and credential phish- level. The proxy level is the most interesting ing for Polish and French financial institu- one as it connects with other proxies, clients, tions. In the summer of 2016, Kelihos began and job servers. This 3-way communication geo-targeting for email delivery sending dif- makes it the most attractive and the one that ferent messages and payloads based on the contains maximum information. The proxy country-code Top Level Domain (ccTLD) of level receives templates from other proxies the email recipient ('.pl','.uk'). Malware, in- and also communicates with the job servers. cluding ransomware and Zeus banking tro- While Kelihos-infected Windows computers jans, were delivered only to certain geogra- serve as the proxy and worker nodes, job phies using this technique. Kelihos has been servers are leased hardware controlled by the seen spamming ransomware, sending Wild- criminals. Job servers are the ones that serve Fire [Arora & Warner, 2016b], CryptFile2 as the main operators to the command and [Arora & Warner, 2016a] and Troldesh [Arora control center. Job servers are often in dis- & Warner, 2016f] encryption ransomware fam- guise and try to be invisible under the shadow Page 10 c 2017 ADFSL Kelihos Botnet: A Never-Ending Saga CDFSL Proceedings 2017 of different proxies; thus, making detection extremely complex and difficult. Lastly, the command and control center is handled by the bot herder and provides the information, spam templates, and updates needed to be distributed across the botnet. 3. INITIALIZATION In this section, researchers will describe the pattern that is followed by the Kelihos bi- nary to initiate, then communicate to its command and control center and eventually send spam. The process will be illustrated with screen captures from OllyDbg and Wire- shark. The details are shared so that they can be easily replicated by any individual Figure 2. Architecture of Kelihos Malware who has expertise with OllyDbg. The fol- lowing analysis was performed in a virtual 3.1.1 Parent Process environment (VMWare) operating in NAT In the following sub-section, researchers will network mode. demonstrate some breakpoints in OllyDbg 3.1 Processes that are helpful in performing the analysis. To attain optimum results, the following steps In the subsequent section, researchers will should be followed in the order mentioned. describe the process of how a Kelihos binary After introducing a Kelihos binary into performs when we try to self-infect. The pre- the virtual environment, start Process Hacker liminary observations can be viewed with the and OllyDbg as an administrator. Next, open help of programs such as Wireshark, Process the Kelihos binary in OllyDbg. Now, one Hacker, and OllyDbg 2.0 version. Next, we can see a process being activated in Process will explain the process of self-infecting with Hacker. The following breakpoints should a complete description of the process as de- be enabled under the Executables (E) tab of picted in Figure 2. As soon as we launch the OllyDbg: binary, it initiates and starts a child process. 1. Ntdll.dll Once the child process gets fully activated, it terminates the parent process and starts the (a) RtlReportSilentProcessExit communication process. Initially, it tries to (b) NtTeminateProcess make a TCP connection with several Internet (c) NtResumeThread Protocol (IP) addresses which are hard-coded 2. kernel32.dll in the binary. There is a unique identifier in the message that helps to authenticate the (a) Resume Thread communication coming from the Kelihos bi- nary. Once a connection is established, it makes a request for configuration (config) files. The config files contain the information Figure 3. Breakpoints for Parent Process about the spam template and the email ad- The researchers provide the specific break- dresses to be used for sending spam messages. points in Figure 3, so that the results may be c 2017 ADFSL Page 11 CDFSL Proceedings 2017 Kelihos Botnet: A Never-Ending Saga easily replicated. Once we start debugging the program, it will stop at the breakpoints in the following manner: 1.