Network Security & Hardware - eWeek

Network Security & Hardware: A Day in the Life of the Rustock Botnet


It's a busy time for botnets.

According to Marshal8e6, spam levels are up 60 percent between January and June. The vast majority of that spam comes from massive botnets such as Cutwail and Mega-D.

Today, eWEEK is focusing on just one of those botnets—Rustock—which has been spamming users for the past few years. In its latest biannual report, TRACELabs Marshal8e6 noted Rustock uses rootkit functionality to hide itself, and changes spam templates often. It typically uses HTML templates from legitimate newsletters and inserts its own images and links to give Rustock spam a mask of respectability. This also allows it to dodge spam filters.

In this slideshow, eWEEK has gathered images of Rustock in action to help illustrate a day in the life a prolific botnet. (Images courtesy of SecureWorks, Symantec, Marshal8e6 and FireEye)
 
  • A Day in the Life of the Rustock Botnet
    by Brian Prince
  • Evolution of Rustock
    This is a picture of the early evolution of the Rustock backdoor Trojan. Totmau is a Trojan Symantec found a few months before Rustock was discovered. Researchers there suspect the malware authors may be the same or connected, but that has not been established.
  • Rustock Code
    This is the actual code Rustock uses to target victims.
  • Cracking Rustock's Code
    Here is a flowchart of a Rustock sample using a method to make things difficult for analysts. The malware author twists the code on purpose in an attempt to obfuscate the real intention.
  • How It Happens
    In this diagram, researchers outlined how the botnet works to infect users and spread spam.
  • A Side of Spam
    Rustock is a sophisticated and prolific spamming machine. The individual spambots are among the fastest at sending spam that we have observed—we clocked one individual bot at 25,000 messages per hour from a standard desktop PC.
  • Communication Is Key
    This image shows the flow of information a bot goes through when it queries the C&C server.
xڽZ[s۸~~d_nw7ŗXbwIHB ,JVeSjy|8oi&4oAuB>K9lHbc.!KvfzC7o``ƛVYQ|v$UK*7-;RLDL1OwҨxLO^>.B࿎F:|=F#mX021q #yF.#An{R7Yh[((6j{A،LQLDruzH&$fvȿ+|>o~QLg\M<4#9 "L7'f*Ή{'_tt6g4Wln(3сױ1,?ۈnS3aܰ)M)vtZ4ܪwP臑WhNdm\)I;-<><:1)+Vʢ M&x9tKS:f:bLÃnF1>PC ';!{0#p\V5Ra5G\攪1O|؈{G{(a(;}eq+)P0nC-U̥zU\Ɋn'p` Ձ ^2R`-*T հq셜Þݙo&)?>d R_E!*aR= ׼>Iqv* .[1aCuTD,O4͌3Ky W&?׀c:sBrZ)ĺQĴdv-[9Ϛ 7s.9n ٝօrI/ ah~I%_zlgŎvjf]ffSO0[h>\ !I$STؖN ik'?aWyQq& XR?Ó,)uN~t@|@>c/1)rd|>s\MbSH;{$+}7icqD8 +9 (< ^0ZV {7VeLt"dY> "6#h9p\+ɻtqO@"f.[㑙CB0e_.Ն^ovﶍ#+𫄐Х$^Xr:= vA͘wsN%!JfI+knsqeQapS#Z7>g67c 3O#$vjڧDw% vӂֽWˆלWestOuO~)\9c.4ga-q a cp+)=jѤ:>*7p}SUA^8/VK@V ncFјfTT>g_Y#xO3+(XP.u1sgֽ]0? V|țjUxמo4g{l qEig`oiXI%k#׉x`+,B!S]OLmSgNVӪ2讞]BU:m-.U3g`GG*ar;LmTkqء9j[Xo2cQ JvV_ܔ&˼C]`I`z#p7PD'RMApuPy#y&յy8$Pc.kEb oDz j*cnW~#Z3H䈘 M؞(.D-bt7")th8ɗn &5 ;όF)xp98R.'2]([yw~ޑZuU )RX^c݆̪f;OY*@Λ5`(3<>яv&NXyB)@ SPpxdMADfTaz8ak`9 &*nZS4,PB qٓu"fˆI^KerDdT!Ǫl or AmkB Cs.)(iͩu ?YdbPds[6d$ͺ4X9X؅$ wwv3]»C.0x` acmA4sǑg,Rm.!?^>qL玩&G \01cX{}=+rx>qekZFEbp\|rvP~|x{/: L"s}{zap'xtOO{Wp QXa,m7:~y3Ne`)7}x/\t| Zh3Ow?7mXΊF+c+Ѩ~=ŴYI2UeTF,7vZFSƼ ܟ.^: w%16:tq@N㭲P ƫzD>,