StealRat Botnet
This is an in depth look at the StealRat Botnet first discussed by TrendMicro in their paper at http://blog.trendmicro.com/trendlabs-security-intelligence/compromised-sites-conceal-stealrat-botnet-operations/.
One of the sites I host became compromised and began sending thousands of spam messages per hour. Being in the position I am, I was able to honeypot the exploit and learned much of the inner workings of this spam operation.
Overview
The StealRat botnet operates with the following components:
- A Command and Control server
- Botnet agents
- Compromised websites acting as botnet agents
- Compromised websites acting as mail gateways
- Compromised websites acting as a HTTP redirect
The control server isolates itself from the actual act of spamming through the botnet agents and compromised websites. Each of these components will be discussed in detail below.
Command and Control Server
My knowledge of the C&C server is based solely on the exploit that is executed remotely by botnet agents and therefore may be incomplete.
The C&C server provides the 3 things for the malware.
- Email addresses to spapm
- A message to send, including the actual message, the subject, the sender name, and email address
- URLs to compromised websites to use as mail gateways.
The command and control server is hosted by LeaseWeb in Amsterdam with the domain 'touchpadz.com'.
Botnet Agents
The StealRat botnet has agents which make the actual HTTP request against compromised websites which either directly sends spam through a PHP mail script on a compromised website, or sends spam through a PHP shell on a compromised website.
Compromised Websites
Exploits Used
The PHP Mailer Script
The PHP Shell
The PHP Exploit Creator
More about the C&C Server
Encryption Method
The email address list is encrypted by XORing the requesting key with the payload.