Inside a Modern Malware Distribution System

SecureWorks anti-malware guru Joe Stewart is not one to be intimidated by advances in online crime activity.

But, when he reversed the backend code associated with the Pushdo Trojan downloader, he discovered a modern malware distribution system fitted with complex tracking mechanisms and hiding techniques—another clear sign that virus fighters are up against a clever and sophisticated enemy.

Stewart, a veteran reverse-engineer who spends the majority of his time breaking apart malware samples, said the control server that powers Pushdo is preloaded with about 421 different malware executables—waiting to be delivered to infected Windows machines.

The malware itself uses electronic greeting card lures—spammed to e-mail inboxes—to trick Windows users into launching the executable.

Once the Trojan is executed, Pushdo immediately reports back to an IP address embedded in the code and connects to a server that pretends to be an Apache Web server and listens on TCP port 80.

“We’ve seen examples of sophisticated Trojan downloaders but this is the first time I’ve gotten into the backend controller to see the level of tracking it’s doing,” Stewart said in an interview with eWEEK. “This one does a lot of high-level reconnaissance, making sure it hits the right targets,” he said.

For starters, the Pushdo controller also uses the GeoIP geolocation database in conjunction with whitelists and blacklists of country codes to allow the malware distributor to limit one of the malware loads from infecting users located in a particular country. This also provides to target a specific country or countries with a specific payload, Stewart said.

Every victim is tracked meticulously. Stewart found that Pushdo logs the IP address of the infected machine, whether or not it was an administrator account on the machine.

Read the full article at eWEEK.