A study of the Ilomo / Clampi botnet - Revision history

Eric.freyssinet: Text replacement - " août " to " aug"

2015-08-05T19:31:31Z

Text replacement - " août " to " aug"

← Older revision		Revision as of 19:31, 5 August 2015
Line 5:		Line 5:
	\|Operation=,		\|Operation=,
	\|Year=2009		\|Year=2009
	\|Date=20 ~~août 2009~~		\|Date=20 aug2009
	\|Editor=Trend Micro		\|Editor=Trend Micro
	\|Link=http://www.trendmicro.com/us/security-intelligence/research-and-analysis/index.html		\|Link=http://www.trendmicro.com/us/security-intelligence/research-and-analysis/index.html

Eric.freyssinet at 19:30, 5 August 2015

2015-08-05T19:30:00Z

← Older revision		Revision as of 19:30, 5 August 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|~~Image~~=		\|Botnet=Clampi, Ilomo,
	\|~~Legend~~=		\|Malware=Ilomo (injecteur), Ilomo (bot),
	\|~~Document~~=		\|CCProtocol=,
	\|~~Licence~~=		\|Operation=,
	~~\|Video=~~		\|Year=2009
	~~\|Link=http://www.trendmicro.com/us/security-intelligence/research-and-analysis/index.html No live link~~
	~~\|Author=Alice Decker, David Sancho, Max Goncharov, Robert McArdle~~,
	\|~~NomRevue~~=~~Trend Micro Research Papers~~
	\|Date=20 août 2009		\|Date=20 août 2009
	\|Editor=Trend Micro		\|Editor=Trend Micro
	\|~~Year~~=~~2009~~		\|Link=http://www.trendmicro.com/us/security-intelligence/research-and-analysis/index.html
	\|~~ISBN=~~		\|Author=Alice Decker, David Sancho, Max Goncharov, Robert McArdle,
	~~\|Page~~=
	\|Abstract=Ilomo has been present in the malware landscape since at least the end of 2005, making it a veteran of the modern malware era. During that time it has changed its code constantly with an emphasis being placed on making the malware very difficult to reverse engineer, and also with the goal of staying under the radar. As with all malware it has picked up several names over that time but the most common are Ilomo, Clampi, Ligats or Rscan – we will use Ilomo in this report.<br/>		\|Abstract=Ilomo has been present in the malware landscape since at least the end of 2005, making it a veteran of the modern malware era. During that time it has changed its code constantly with an emphasis being placed on making the malware very difficult to reverse engineer, and also with the goal of staying under the radar. As with all malware it has picked up several names over that time but the most common are Ilomo, Clampi, Ligats or Rscan – we will use Ilomo in this report.<br/>
	Evidence of the lengths which Ilomo has gone to in order to make analysis of the threat difficult is immediately clear as soon as a researcher disassembles the malware binary. In addition to its own unusual techniques (such as its method for injecting code into other processes, which we describe in detail) Ilomo employs a commercial obfuscator known as VMProtect. This obfuscator is available for as little as $200, easily affordable for any modern cybercriminal.<br/>		Evidence of the lengths which Ilomo has gone to in order to make analysis of the threat difficult is immediately clear as soon as a researcher disassembles the malware binary. In addition to its own unusual techniques (such as its method for injecting code into other processes, which we describe in detail) Ilomo employs a commercial obfuscator known as VMProtect. This obfuscator is available for as little as $200, easily affordable for any modern cybercriminal.<br/>
Line 26:		Line 22:
	Lastly, we have also included Appendices, which detail some additional information.<br/>		Lastly, we have also included Appendices, which detail some additional information.<br/>
	NOTE: All URLs, filenames, etc are correct at time of writing.		NOTE: All URLs, filenames, etc are correct at time of writing.
	\|~~Botnet~~=~~Clampi, Ilomo,~~		\|Document=
	\|~~Malware~~=~~Ilomo (injecteur), Ilomo (bot),~~		\|Licence=
	\|~~CCProtocol~~=,		\|Video=
	\|~~Operation~~=,		\|NomRevue=Trend Micro Research Papers
			\|ISBN=
			\|Page=
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:22:55Z

1 revision imported

← Older revision		Revision as of 14:22, 7 February 2015
(No difference)

Eric.freyssinet at 19:20, 5 February 2012

2012-02-05T19:20:03Z

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.trendmicro.com/us/security-intelligence/research-and-analysis/index.html No live link
|Author=Alice Decker, David Sancho, Max Goncharov, Robert McArdle,
|NomRevue=Trend Micro Research Papers
|Date=20 août 2009
|Editor=Trend Micro
|Year=2009
|ISBN=
|Page=
|Abstract=Ilomo has been present in the malware landscape since at least the end of 2005, making it a veteran of the modern malware era. During that time it has changed its code constantly with an emphasis being placed on making the malware very difficult to reverse engineer, and also with the goal of staying under the radar. As with all malware it has picked up several names over that time but the most common are Ilomo, Clampi, Ligats or Rscan – we will use Ilomo in this report. 
Evidence of the lengths which Ilomo has gone to in order to make analysis of the threat difficult is immediately clear as soon as a researcher disassembles the malware binary. In addition to its own unusual techniques (such as its method for injecting code into other processes, which we describe in detail) Ilomo employs a commercial obfuscator known as VMProtect. This obfuscator is available for as little as $200, easily affordable for any modern cybercriminal. 
Each Ilomo node comes pre-configured with the locations of two Command & Control (C&C) servers, known as “gates” from which it can download updates, receive instructions, and download a larger list of gates. These gates are generally hosted machines (most likely compromised web servers), as opposed to ADSL home connections, more commonly seen in the case of other botnets. 
The purpose behind Ilomo is very simple – information theft. Ilomo steals all password details from the infected machine (e.g. those held in protected storage) and also monitors all web traffic from the machine, with the goal of stealing login credentials for online banking, online email accounts, etc.
The original origin of Ilomo is unclear. Taking into account our underground research in conjunction with the list of sites targets, it appears that Ilomo predominantly targets US users, and does not appear to be Russia or Eastern European in origin. 
We have split this report into five main sections:
* Firstly, we start with Ilomo Analysis, a section dealing with a step by step analysis of the behavior of the Ilomo malware.
* The second section, VMProtect Obfuscator, aims to convey the methods of obfuscation used by the VMProtect packer.
* The third section, Propagation, explains how Ilomo spreads from machine to machine.
* The fourth section, Ilomo Symptoms, calls out the defining characteristics of Ilomo on one page, helping a system administrator to identify signs of an Ilomo infection
* The fifth section, Protection, details the various components of Trend Micro’s Smart Protection Network which help defend against the Ilomo malware family.
Lastly, we have also included Appendices, which detail some additional information. 
NOTE: All URLs, filenames, etc are correct at time of writing.
|Botnet=Clampi, Ilomo,
|Malware=Ilomo (injecteur), Ilomo (bot),
|CCProtocol=,
|Operation=,
}}