FireEye Malware Intelligence Lab

Smashing the Mega-d/Ozdok botnet in 24 hours

FE Malware Researcher — 2009-11-06T06:00:00-08:00

In my previous article, I talked about the Ozdok command and control architecture and its fallback mechanisms in great detail. That article was an attempt to highlight different approaches to take down this botnet theoretically. But when it comes to the actual shutdown, it's far more complex than just finding out the command and control server coordinates and fallback mechanisms. An actual shut down attempt requires someone to take the initiative and start a combined...

Killing the beast...Part 4 (Ozdok)

FE Malware Researcher — 2009-11-03T20:58:00-08:00

Note: Updates are available at the bottom of this article. Ozdok a.k.a Mega-d is one of those botnets that has been very successful flying under the radar over the past few years. Recent stats by Marshal TRACE show Ozdok is currently responsible for about 4.2% of the world's overall SPAM. The question that arises again is who are the guys controlling this botnet, and more importantly from where? I recently conducted a detailed study of...

A little more on Donbot...

FE Malware Researcher — 2009-10-28T11:26:50-07:00

Donbot is primarily a spam bot, one of the few spam botnets whose growth was not hampered by the McColo shutdown earlier this year. As a matter of fact, the sudden shut down of big spammers like Srizbi and Rustock helped Donbot climb the spam botnet rankings. In this article I am going discuss different aspects of Donbot, first as a malware and then in the later half I will try to shed some light...

Gumblar... Not Gumby!

FE Malware Researcher — 2009-10-23T12:18:23-07:00

Ok, I admit this blog post is not about our childhood TV friend, Gumby... Instead it's about a much more sinister character, Gumblar & its malware henchmen... Originally making its debut back in March/April of this year (see here , here and here) and then suddenly it went quiet for a few months, until recently... Yes, Gumblar is back with a vengeance & still causing problems for it's unsuspecting victims. The primary delivery mechanism is...

A leap into the unknown - Part 1

FE Malware Researcher — 2009-10-01T17:36:31-07:00

A leap into the unknown is a series which will discuss some lesser known malware, that has a reasonably good command and control structure. Most of this malware might not be totally new to the AVs, but they were never considered for more than just creating a signature. Little or no effort has been made to disclose the motivation behind creating this malware, the CnC architecture, or the people behind it. These articles are not...

Killing the beast...Part 3

FE Malware Researcher — 2009-09-29T18:15:39-07:00

In the third part of this series, I'm going to discuss the command and control structure of another famous botnet, Clampi a.k.a ilomo. Clampi is all about data stealing and is famous for its anti-reversing and evasion techniques. The financial damage this information stealer can cause is evident from the fact that it has recently been publicly disclosed of a cyber theft of more than $150,000. Notorious isn't it..? Like the first two parts where...

Who is Exploiting the Adobe Flash 0-day? - Part 2

FE Malware Researcher — 2009-07-24T13:34:55-07:00

The new Flash 0-day has opened multiple avenues for malware authors. In my last article I showed how this vulnerability is being exploited via the PDF reader's support for SWF files. However, this vulnerability can just as easily be exploited in a standard drive-by fashion purely in Flash as well. This is precisely what has started to happen. Here is the snippet of the javascript which is actively targeting this 0-day vulnerability. This exploit successfully...

Who is Exploiting the Adobe Flash 0-day?

FE Malware Researcher — 2009-07-23T06:24:00-07:00

It looks like Zero-day discoveries for the month of July are not quite over yet. I have already talked about two vulnerabilities inside MS products earlier this month: July 7th 2009: Who is Exploiting the Windows 0-day (MSVIDCTL.DLL) ? July 14th 2009: Who is Exploiting the Office Web Components 0-day? Then came the 3rd one inside Mozilla FireFox 3.5, almost at the exact same time. Sadly enough, this article is about another 0-day (fourth in...

Heap Spraying with Actionscript

FE Malware Researcher — 2009-07-23T06:04:23-07:00

Flash has it's own version of ECMAScript called Actionscript, and whoever wrote this new 0-day, finally did something new by implementing the heap-spray routine with Actionscript inside of Flash.

Bad Actors Part 7 - 3fn (Or: Cutwail - How to do it right)

FE Malware Researcher — 2009-07-21T13:37:09-07:00

“Wait … *beep beep* back up for a second, Alex. I heard 3fn was brought down by the FTC!” That would be correct! On June 4th the FTC served a takedown notice that essentially dropped 3fn (aka “Triple Fiber Network”, Pricewert, APX Telecom, APS Communications) off the Internet. I was approached by law enforcement looking for evidence of malicious activities, and luckily, I was in the midst of writing up an article for my Bad...