Posts tagged “BlackEnergy”

A Random Walk Through the Malware Ecosystem



The forum at darkcc.com is a location where buyers and sellers of stolen credit card information conduct exchanges. There are many forums like this that are part of the thriving market that sustain the “botnet ecosystem.” The servers that host these types of forums are typically involved in a variety of nefarious activities. This one hosts a variety of malicious software:

www.sokam .info /admnew2/Dr.exe (VT: 33/40 (82.50%)
infoshok .info /exe.php?606717496665bcba (VT: 20/40 (50.00%))
superhomelawn .com /per4d/load/load.exe (VT: 5/41 (12.20%))
senders2010 .com /sites/up.bin (zbot/zeus)
keroholek .net /tt/stat/index.php (zbot/zeus)
newdaypeace .org /npd2e/bb.php?… (oficla/sasfis)

The sites are hosted on 121.101.216.195 – SUNINFO-MDC which is located in China.

One “trusted” seller (meaning that the forum administrator had vouched for him/her) known as mrdump caught my attention. mrdump’s minimum order is now $1000 USD. In addition to advertising his/her services on the forum, mrdump included his/her website, mrdump.biz.

The site is hosted on 121.101.216.205 – SUNINFO-MDC in China and, as usual, these a fair amount of nasty stuff, mostly zeus/zbot (heroladaaw.biz, ddkom.biz, herakert.net) hosted on the same server. Another zeus/zbot command and control server found on the same server is: www.kalekets.net/tt/cfg/config.bin

There is also a BlackEnergy command and control server hosted on the same server: sinergy-dl.com. It was a fairly small botnet (total bot’s: 171, bot’s per hour: 213, bot’s per day:437, bot’s for all time:1816) and was issuing the following command “flood http kirbyservice.ru” — instructing the bots to DDoS kirbyservice.ru. Recently, the command has been changed to “die”.

One interesting find pertains to the rivalry between Zeus and SpyEye. The same server hosts www.coolparts31.tw which is a known zeus/zbot command and control server. Well it turns out that it is also a Spy Eye command and control server:

www.coolparts31.tw/S_main/bin/upload/build.exe (27/41 (65.85%))
www.coolparts31.tw/S_main/bin/upload/33.exe (VT: 10/41 (24.4%))
www.coolparts31.tw/S_main/bin/upload/server.exe (VT: 35/41 (85.37%))
www.coolparts31.tw/S_main/bin/upload/server12.exe (VT: 35/40 (87.5%))
www.coolparts31.tw/S_main/bin/upload/xServer.exe (VT: 8/40 (20%))

I recall someone (I am pretty sure it was Dancho Danchev — UPDATE: and it was here and here (thx @danchodanchev)) — reacting to this rivalry by saying that the criminals don’t really care, they’ll use any malware kit that works.

Or something like that.

Sometimes, we get sidetracked by the tools, but it’s the crime that pays.