Few days back, we found another Pastebin entry that contains a source which looks to be malicious botnet code. As I wrote in my earlier blog, malware authors also use Pastebin to trade botnet kits. Many times, snippets of a botnet help researchers understand the workings of the botnet and write detections for it.
The code posted was fairly simple to understand, appearing fully tested and complete. The code provides insights to the coding skills and techniques used by the botnet author. This bot uses fairly standard installation, copying itself into the Windows\System32\ folder and then sending and receiving commands from a hard-coded control server. The source contains two interesting antianalysis functions, which check for the presence of a sandbox or tools such as OllyDbg or Wireshark. If it detects countermeasures, the bot terminates its process. Below are the two functions used for antianalysis:
BOOL bIsSandbox (void)
- Check GetModuleFileNameA() for presence of string “sample” in the PATH
- Or Check GetUserNameA() for presence of string like “HfreAnzr” or “sandbox” or “currentuser” or “vmware” or “nepenthes”
- Or Check GetComputerNameA() for presence of string like “ComputerName” or “COMPUTERNAME”
- Or Check GetModuleHandle() for presence of DLL like “SbieDll.dll” or “api_log.dll” or “dbghelp.dll” or “dir_watch.dll”
- If anything matches, terminate the bot process
DWORD WINAPI tScanner (LPVOID)
- Use FindWindowA() function to check for name “CommView”
- Or “TCPViewClass”
- Or “TCPView – Sysinternals: www.sysinternals.com”
- Or “PROCMON_WINDOW_CLASS”
- Or “OLLYDBG”
- Or “gdkWindowToplevel”
- Or “CommView – The Team ZWT 2008”
- Or “The Wireshark Network Analyzer”
- Or “SysAnalyzer”
- If anything matches, terminate the bot process
Both of the preceding function help a bot to terminate its process from being analyzed by researchers. The bot sends OS version, Username, botID, and other information to its hard-coded control server in the ns/clients.php?os=%s&name=%s&id=%i&loc=%s format and waits for other commands.
This bot supports the following commands, among others:
install: Download and install another binary
uninstall: Clears registry entries and exit()
open: Open a specified file
update: Update to a new bot binary
qkill: Exit
Examining the code gives us a fair idea of the network communications of this botnet and helps researchers easily write detections. The availability of the source also helps us understand different techniques or methods used by the botnet authors. It’s no surprise that Pastebin has become a communications channel for bad guys-not only for selling botnets but also for sharing code snippets.
Leave a reply
