by Ryan Naraine - eWEEK
Veteran malware researcher Joe Stewart was fairly sure he'd seen it
all until he started poking at the SpamThru Trojan -- a piece of
malware designed to send spam from an infected computer.
The Trojan, which uses peer-to-peer technology to send commands to
hijacked computers, has been fitted with its own anti-virus
scanner -- a level of complexity and sophistication that rivals some
commercial software.
"This the first time I've seen this done. [It] gets points for
originality," says Stewart, senior security researcher at SecureWorks,
in Atlanta, Ga.
"It is simply to keep all the system resources for themselves; if they
have to compete with, say, a mass-mailer virus, it really puts a
damper on how much spam they can send," he added.
Most viruses and Trojans already attempt to block anti-virus software
from downloading updates by tweaking hosts file to the anti-virus
update sites to the localhost address.
Malicious hackers battling for control over an infected system have
also removed competing malware by killing processes, removing registry
keys, or setting up mutexes that fool the other malware into thinking
it is already running and then exiting at start.
But, as Stewart discovered during his analysis, SpamThru takes the
game to a new level, actually using an anti-virus engine against
potential rivals.
At start-up, the Trojan requests and loads a DLL from the author's
command-and-control server.
This then downloads a pirated copy of Kaspersky AntiVirus for WinGate
into a concealed directory on the infected system.
It patches the license signature check in-memory in the Kaspersky DLL
to avoid having Kaspersky refuse to run due to an invalid or expired
license, Stewart said.
Ten minutes after the download of the DLL, it begins to scan the
system for malware, skipping files which it detects are part of its
own installation.
"Any other malware found on the system is then set up to be deleted by
Windows at the next reboot," he added.
At first, Stewart said he was confused about the purpose of the
Kaspersky anti-virus scanner.
"I theorized at first that distributed scanning and morphing of the
code before sending the updates via P2P would be a clever way to evade
detection indefinitely," he said, but it wasn't until he looked
closely at the way rival malware files were removed that he realized
this was a highly sophisticated operation working hard to make full
use of stolen bandwidth for spam runs.
Stewart also found SpamThru using a clever command-and control
structure to avoid shutdown.
The Trojan uses a custom P2P protocol to share information with other
peers including the IP addresses and ports and software version of the
control server.
"Control is still maintained by a central server, but in case the
control server is shut down, the spammer can update the rest of the
peers with the location of a new control server, as long as he/she
controls at least one peer," he said.
Stewart found that the network generally consists of one control
server (running multiple peer-nets on different ports), several
template servers, and around 500 peers per port.
There appears to be a limit to how many peers each port can
effectively control, as the overhead in sharing information between
hosts is fairly large, he added.
"The estimated number of infected hosts connected to the one control
server we looked at was between one and two thousand across all open
ports," Stewart added.
The operation uses template-based spam, setting up a system where each
SpamThru client is its own spam engine, downloading a template
containing the spam, random phrases to use as hash-busters, random
"from" names, and a list of several hundred e-mail addresses to send
advertising.
The templates are encrypted and use a challenge-response
authentication method to prevent third parties from being able to
download the templates from the template server.
Stewart also found that the Trojan was randomizing the GIF files --
changing the width and height of the images -- to defeat anti-spam
solutions that reject e-mail based on a static image.
"Although we've seen automated spam networks set up by malware before,
this is one of the more sophisticated efforts. The complexity and
scope of the project rivals some commercial software. Clearly the
spammers have made quite an investment in infrastructure in order to
maintain their level of income," Stewart said.
During his analysis, Stewart found that SpamThru was being used to
operate a spam-based pump-and-dump stock scheme.
Check out eWEEK.com's Security Center for the latest security news,
reviews and analysis. And for insights on security coverage around the
Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's
Weblog.
Copyright 2006 Ziff Davis Inc.
NOTE: For more telecom/internet/networking/computer news from the
daily media, check out our feature 'Telecom Digest Extra' each day at
http://telecom-digest.org/td-extra/more-news.html . Hundreds of new
articles daily. And, discuss this and other topics in our forum at
http://telecom-digest.org/forum (or)
http://telecom-digest.org/chat/index.html
For more news and headlines, please go go:
http://telecom-digest.news/td-extra/newstoday.html
Ryan Naraine eWeek (eweek@telecom-digest.org)