The Latest in IT Security

Pastebin Shares Botnet Source Code

08
May
2012

Few days back, we found another Pastebin entry that contains a source which looks to be malicious botnet code. As I wrote in my earlier blog, malware authors also use Pastebin to trade botnet kits. Many times, snippets of a botnet help researchers understand the workings of the botnet and write detections for it.

The code posted was fairly simple to understand, appearing fully tested and complete. The code provides insights to the coding skills and techniques used by the botnet author. This bot uses fairly standard installation, copying itself into the Windows\System32\ folder and then sending and receiving commands from a hard-coded control server. The source contains two interesting antianalysis functions, which check for the presence of a sandbox or tools such as OllyDbg or Wireshark. If it detects countermeasures, the bot terminates its process. Below are the two functions used for antianalysis:

BOOL bIsSandbox (void)

  • Check GetModuleFileNameA() for presence of string “sample” in the PATH
  • Or Check GetUserNameA() for presence of string like “HfreAnzr” or “sandbox” or “currentuser” or “vmware” or “nepenthes”
  • Or Check GetComputerNameA() for presence of string like “ComputerName” or “COMPUTERNAME”
  • Or Check GetModuleHandle() for presence of DLL like “SbieDll.dll” or “api_log.dll” or “dbghelp.dll” or “dir_watch.dll”
  • If anything matches, terminate the bot process

DWORD WINAPI tScanner (LPVOID)

  • Use FindWindowA() function to check for name “CommView”
  • Or “TCPViewClass”
  • Or “TCPView – Sysinternals: www.sysinternals.com”
  • Or “PROCMON_WINDOW_CLASS”
  • Or “OLLYDBG”
  • Or “gdkWindowToplevel”
  • Or “CommView – The Team ZWT 2008”
  • Or “The Wireshark Network Analyzer”
  • Or “SysAnalyzer”
  • If anything matches, terminate the bot process

Both of the preceding function help a bot to terminate its process from being analyzed by researchers. The bot sends OS version, Username, botID, and other information to its hard-coded control server in the ns/clients.php?os=%s&name=%s&id=%i&loc=%s format and waits for other commands.

This bot supports the following commands, among others:

install: Download and install another binary

uninstall: Clears registry entries and exit()

open: Open a specified file

update: Update to a new bot binary

qkill: Exit

Examining the code gives us a fair idea of the network communications of this botnet and helps researchers easily write detections. The availability of the source also helps us understand different techniques or methods used by the botnet authors. It’s no surprise that Pastebin has become a communications channel for bad guys-not only for selling botnets but also for sharing code snippets.

Leave a reply


Categories

TUESDAY, NOVEMBER 19, 2019
WHITE PAPERS

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...

Featured

Archives

Latest Comments