Deconstructing a Pump-and-Dump Spam Trojan

 
 
By eweek  |  Posted 2012-05-28
 
 
 

Deconstructing a Pump-and-Dump Spam Trojan

The bot herder is hacking into smaller investment news Web sites and other e-businesses and downloading their user databases for targeted spam runs. In this image, we see the result of one such hack -- the MySQL database of an online shop appears to ha

Deconstructing a Pump-and-Dump Spam Trojan

Deconstructing a Pump-and-Dump Spam Trojan - r57shell

r57shell is a PHP script that is the handiwork of a Russian hacking group. It is uploaded to a vulnerable Web site and gives the hacker the ability to download and upload files, create backdoor listeners, send e-mail, bounce a connection to another s

Deconstructing a Pump-and-Dump Spam Trojan - r57shell

Deconstructing a Pump-and-Dump Spam Trojan - Infected Files

The names of infected files include the entire path to the file on the users system. Since a large number of viruses and trojans utilize the users temporary directory (under C:\Documents and Settings\[USERNAME]\Local Settings\Temp) as a drop point, t

Deconstructing a Pump-and-Dump Spam Trojan - Infected Files

Deconstructing a Pump-and-Dump Spam Trojan - SpamThru Bots by OS Version

The SpamThru controller keeps statistics on which version of Windows each infected client is running, down to the service pack level. In this chart, we see Windows XP SP2 dominating the makeup of the botnet, indicating that even fairly up-to-date syste

Deconstructing a Pump-and-Dump Spam Trojan - SpamThru Bots by OS Version

Deconstructing a Pump-and-Dump Spam Trojan - SpamThru Bots per Server Port

SpamThru bots are segmented into different server ports, determined by which variant of the Trojan is installed. The bots are further segmented into peer groups of no more than 512 bots, keeping the overhead involved in exchanging information about oth

Deconstructing a Pump-and-Dump Spam Trojan - SpamThru Bots per Server Port

Deconstructing a Pump-and-Dump Spam Trojan - Top 20 Other Malware on SpamThru Bots

The SpamThru bot comes with its own anti-virus scanner -- a pirated copy of Kaspersky Anti-Virus. The scanning generates a report that shows a list of infected files along with the name of the detected malware. Overall, 3,863 different named malware va

Deconstructing a Pump-and-Dump Spam Trojan - Top 20 Other Malware on SpamThru Bots

Deconstructing a Pump-and-Dump Spam Trojan - Top 20 SpamThru Bot Locales

The SpamThru controller keeps statistics on the country of origin of all bots in the botnet. Athough the United States has the highest number of infections, bot distribution is not limited to any particular country. All in all, computers in 166 countri

Deconstructing a Pump-and-Dump Spam Trojan - Top 20 SpamThru Bot Locales

Deconstructing a Pump-and-Dump Spam Trojan - SpamThru Bot Control Connections

This chart shows the number of connections each control port received each day from the bots. The 2236 and 2238 variants gained a lot more infected users than any of the other variants, sometimes bringing up to 3 million connections to the control serv

Deconstructing a Pump-and-Dump Spam Trojan - SpamThru Bot Control Connections

Rocket Fuel