Your name or email adress:
Do you already have an account?
Forgot your password?
  • Log in or Sign up

    Results 1 to 2 of 2
    1. #1
      Jahness's Avatar
      Jahness is offline OniOni Warrior

      Join Date
      Mar 2005
      In amerikkka! Stolen from Afrika!
      Thumbs Up/Down
      Received: 1/0
      Given: 18/0
      Rep Power

      Arrow Inside a Modern Malware Distribution System

      0 Not allowed! Not allowed!
      Inside a Modern Malware Distribution System

      Ryan Naraine -

      SecureWorks anti-malware guru Joe Stewart is not one to be intimidated by advances in online crime activity.

      But, when he reversed the backend code associated with the Pushdo Trojan downloader, he discovered a modern malware distribution system fitted with complex tracking mechanisms and hiding techniques—another clear sign that virus fighters are up against a clever and sophisticated enemy.

      Stewart, a veteran reverse-engineer who spends the majority of his time breaking apart malware samples, said the control server that powers Pushdo is preloaded with about 421 different malware executables—waiting to be delivered to infected Windows machines.

      The malware itself uses electronic greeting card lures—spammed to e-mail inboxes—to trick Windows users into launching the executable.

      Once the Trojan is executed, Pushdo immediately reports back to an IP address embedded in the code and connects to a server that pretends to be an Apache Web server and listens on TCP port 80.

      "We've seen examples of sophisticated Trojan downloaders but this is the first time I've gotten into the backend controller to see the level of tracking it's doing," Stewart said in an interview with eWEEK. "This one does a lot of high-level reconnaissance, making sure it hits the right targets," he said.

      For starters, the Pushdo controller also uses the GeoIP geolocation database in conjunction with whitelists and blacklists of country codes to allow the malware distributor to limit one of the malware loads from infecting users located in a particular country. This also provides to target a specific country or countries with a specific payload, Stewart said.

      Every victim is tracked meticulously. Stewart found that Pushdo logs the IP address of the infected machine, whether or not it was an administrator account on the machine.

      It also goes a step further, logging the victim's primary hard drive serial number, tracking whether the file system is NTFS, the number of times the victim system has launched a Pushdo variant, and the Windows OS version that executed the malware.

      Stewart was baffled by the need to track the hard drive serial number but suggests this is being done to provide a unique ID for the infected system and to figure out if a VM (virtual machine) is being used to analyze the malware. This is significant, Stewart said, because anti-virus providers use VM to pick apart malware files in controlled environments.

      "They already have VM detection in malware files but, now that it's in the downloader, the malware author can do the detection upfront and completely avoid anti-virus detection," he said. "This could be a way for the malware author to spy on anti-virus companies using automated tools to monitor the malware download points," he explained in a detailed technical analysis of the Pushdo controller.

      Click here to read more about how the latest Trojans are using RSS feeds to communicate.

      Stewart also found what he calls an "anti-anti-malware function" in Pushdo. The Trojan downloader looks at the names of all running processes and compares them to a pre-loaded list of anti-virus and personal firewall process names. "My hunch is they're just tracking which firewalls are easier targets, figuring out which ones they need to do more work on," he added.

      Unlike other virus samples that attempt to kill anti-virus software processes, Pushdo merely reports back to the controller which ones are running, "a type of reconnaissance" that helps to determine which anti-virus engines or firewalls are preventing the malware from running or phoning home. "This way the Pushdo author doesn't have to maintain a test environment for each anti-virus or firewall product," he added.

      The last time Stewart peeked at the controller, he found more than malware samples—all with rootkit characteristics that help maintain a stealthy presence of the infected computer. He also found evidence of a spam botnet that can be used to deliver massive amounts of unwanted e-mail advertisements, or to launch debilitating distributed DoS (denial-of-service) attacks on businesses.

      "We're dealing with an entire malware ecosystem," Stewart declared. "It's really interesting how the [malware] business is now compartmentalized. Distribution of downloaders is handled by one set of guys, who get paid for that. Then, there are the botnet guys who rent out their services. Then, we have the spam guys using those botnets to blast out e-mails."

      Stewart also stumbled upon another interesting fact—multiple malware families being distributed using the Pushdo system. This, he reckons, is a sign that the author is also willing to take payments from other malware authors in return for use of his distribution channel.

      "[These] arrangements are becoming more and more common, as participants in the malware economy seek out niches in which to provide services in the underground marketplace," he said.

      Check out's Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraine's Security Watch blog.

      Copyright © 2007 Ziff Davis Inc. All Rights Reserved.
      Posted In The Spirit of Learning & Sharing
      One Love & Respect Always

      The Quest for knowledge stops at the grave.
      HIM Emperor Haile Selassie I.

      If you fail to prepare,
      you are preparing to fail!

      Mind what you want, because someone wants your mind.

      Working together, the ants ate the elephant.

    2. #2
      Im The Truth's Avatar
      Im The Truth is offline Organizer

      Join Date
      Jan 2004
      Atlanta, GA by way of Afrika
      Blog Entries
      Thumbs Up/Down
      Received: 12/1
      Given: 7/0
      Rep Power

      0 Not allowed! Not allowed!
      This is why it's important to have a good virus scanner that up to date, most importantly up to date.
      "If the enemy is not doing anything against you, you are not doing anything"
      -Ahmed Skou Tour

      "speak truth, do justice, be kind and do not do evil."
      -Baba Orunmila

      "Cowardice asks the question: is it safe? Expediency asks the question: is it political? Vanity asks the question: is it popular? But conscience asks the question: is it right? And there comes a time when one must take a position that is neither safe, nor political, nor popular - but one must take it simply because it is right."
      --Dr. Martin L. King

      Get Involved!

    Thread Information

    Users Browsing this Thread

    There are currently 1 users browsing this thread. (0 members and 1 guests)

    Similar Threads

    1. Nigeria: Lagos Govt to Introduce Water Distribution Kiosk System
      By TTDC Bot in forum Afrikan News RSS Feed
      Replies: 0
      Last Post: 06-01-2016, 01:33 AM
    2. Women in Solitary Confinement: Buried Inside the Federal Prison System
      By TTDC Bot in forum Political Prisoners Freedom Campaign (PPFC)
      Replies: 0
      Last Post: 02-10-2014, 01:00 AM
    3. South Africa: Using Modern Technology to Combat Modern Slavery
      By TTDC Bot in forum Afrikan News RSS Feed
      Replies: 0
      Last Post: 08-31-2012, 01:00 AM
    4. Hard-Core Truth About The Modern Education System
      By Black7Sun in forum Open Forum
      Replies: 5
      Last Post: 10-25-2010, 08:31 AM
    5. malware
      By MamaDahomey in forum P C Tech Advice & Technology
      Replies: 1
      Last Post: 06-08-2010, 12:08 AM

    Thread Participants: 1

    Posting Permissions

    • You may not post new threads
    • You may not post replies
    • You may not post attachments
    • You may not edit your posts


      Assata Shakur Speaks is an Forum Devoted To Assata Shakur And All Political Prisoners Around The World.
      Assata Shakur Speaks Is An Oasis Of Pan African Information Geared Towards The Liberation Of Afrikan People.

    Follow Us On

    Twitter Facebook youtube Flickr DavianArt Dribbble RSS Feed