StealRat Botnet

From Leo's Notes
Revision as of 06:38, 20 September 2015 by Leo (talk | contribs) (→Exploits Used)
This page was last edited on 20 September 2015, at 06:38.

This is an in depth look at the StealRat Botnet first discussed by TrendMicro in their paper at http://blog.trendmicro.com/trendlabs-security-intelligence/compromised-sites-conceal-stealrat-botnet-operations/.

One of the sites I host became compromised and began sending thousands of spam messages per hour. Being in the position I am, I was able to honeypot the exploit and learned much of the inner workings of this spam operation.

Overview

The StealRat botnet operates with the following components:

  1. A Command and Control server
  2. Botnet agents
  3. Compromised websites acting as botnet agents
  4. Compromised websites acting as mail gateways
  5. Compromised websites acting as a HTTP redirect

The control server isolates itself from the actual act of spamming through the botnet agents and compromised websites. Each of these components will be discussed in detail below.

Command and Control Server

My knowledge of the C&C server is based solely on the exploit that is executed remotely by botnet agents and therefore may be incomplete.

The C&C server provides the 3 things for the malware.

  1. Email addresses to spapm
  2. A message to send, including the actual message, the subject, the sender name, and email address
  3. URLs to compromised websites to use as mail gateways.

The command and control server is hosted by LeaseWeb in Amsterdam with the domain 'touchpadz.com'.

Botnet Agents

The StealRat botnet has agents which make the actual HTTP request against compromised websites which either directly sends spam through a PHP mail script on a compromised website, or sends spam through a PHP shell on a compromised website.

Compromised Websites

Exploits Used

The PHP Mailer Script

The PHP Shell

Computers part of the botnet will make requests similar to the one below to a PHP shell that allows arbitrary code to be executed.

<phorkie>https://phorkie.leo.home.steamr.com/1/embed</phorkie>

The PHP Exploit Creator

More about the C&C Server

Encryption Method

The email address list is encrypted by XORing the requesting key with the payload.

See Also