Large-scale analysis of malware downloaders - Revision history

Eric.freyssinet at 21:31, 30 July 2015

2015-07-30T21:31:48Z

← Older revision		Revision as of 21:31, 30 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Botnet=Renos, Sality, Gbot, Karagany, Gamarue, Dofoil, Emit, GoldInstall, Rodecap, TDSS, Cycbot, Artro, Virut, Winwebsec, Dabvegi, Buzus~~, dldr#3~~, Vobfus, Changeup, Zwangi, Harnig, LoaderAdv~~, dldr-#2~~, ZeuS - P2P+DGA, dldr-#1, dldr-#2, dldr-#3,		\|Botnet=Renos, Sality, Gbot, Karagany, Gamarue, Dofoil, Emit, GoldInstall, Rodecap, TDSS, Cycbot, Artro, Virut, Winwebsec, Dabvegi, Buzus, Vobfus, Changeup, Zwangi, Harnig, LoaderAdv, ZeuS - P2P+DGA, dldr-#1, dldr-#2, dldr-#3,
	\|Year=2012		\|Year=2012
	\|Editor=DIMVA		\|Editor=DIMVA

Eric.freyssinet at 21:21, 30 July 2015

2015-07-30T21:21:25Z

← Older revision		Revision as of 21:21, 30 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Botnet=Renos, Sality, Gbot, Karagany, Gamarue, Dofoil, Emit, GoldInstall, Rodecap, TDSS		\|Botnet=Renos, Sality, Gbot, Karagany, Gamarue, Dofoil, Emit, GoldInstall, Rodecap, TDSS, Cycbot, Artro, Virut, Winwebsec, Dabvegi, Buzus, dldr#3, Vobfus, Changeup, Zwangi, Harnig, LoaderAdv, dldr-#2, ZeuS - P2P+DGA, dldr-#1, dldr-#2, dldr-#3,
	\|Year=2012		\|Year=2012
	~~\|Date=9th~~
	\|Editor=DIMVA		\|Editor=DIMVA
	\|Link=http://www.christian-rossow.de/publications/downloaders-dimva12.pdf		\|Link=http://www.christian-rossow.de/publications/downloaders-dimva12.pdf

Eric.freyssinet at 21:12, 30 July 2015

2015-07-30T21:12:19Z

← Older revision		Revision as of 21:12, 30 July 2015
Line 4:		Line 4:
	\|Date=9th		\|Date=9th
	\|Editor=DIMVA		\|Editor=DIMVA
	\|Link=http://www.christian-rossow.de/publications/downloaders-dimva12.pdf ~~www.christian-rossow.de~~		\|Link=http://www.christian-rossow.de/publications/downloaders-dimva12.pdf
	\|Author=Christian Rossow, Christian Dietrich, Herbert Bosz		\|Author=Christian Rossow, Christian Dietrich, Herbert Bosz
	\|Abstract=Downloaders are malicious programs with the goal to subversively		\|Abstract=Downloaders are malicious programs with the goal to subversively download and install malware (eggs) on a victim’s machine. In this paper, we analyze and characterize 23 Windows-based malware downloaders. We ﬁrst show a high diversity in downloaders’ communication architectures (e.g., P2P), carrier protocols and encryption schemes. Using dynamic malware analysis traces
	download and install malware (eggs) on a victim’s machine. In this paper, we analyze and characterize 23 Windows-based malware downloaders. We ﬁrst show		from over two years, we observe that 11 of these downloaders actively operated for at least one year, and identify 18 downloaders to be still active. We then describe how attackers choose resilient server infrastructures. For example, we
	a high diversity in downloaders’ communication architectures (e.g., P2P), carrier protocols and encryption schemes. Using dynamic malware analysis traces		reveal that 20% of the C&C servers remain operable on long term. Moreover, we observe steady migrations between different domains and TLD registrars, and notice attackers to deploy critical infrastructures redundantly across providers.
	from over two years, we observe that 11 of these downloaders actively operated for at least one year, and identify 18 downloaders to be still active. We then		After revealing the complexity of possible counter-measures against downloaders, we present two generic techniques enabling defenders to actively acquire malware samples. To do so, we leverage the publicly accessible downloader infrastructures by replaying download dialogs or observing a downloader’s process activities from within the Windows kernel. With these two techniques, we successfully milk and analyze a diverse set of eggs from downloaders with both plain
	describe how attackers choose resilient server infrastructures. For example, we
	reveal that 20% of the C&C servers remain operable on long term. Moreover,
	we observe steady migrations between different domains and TLD registrars, and
	notice attackers to deploy critical infrastructures redundantly across providers.
	After revealing the complexity of possible counter-measures against downloaders, we present two generic techniques enabling defenders to actively acquire
	malware samples. To do so, we leverage the publicly accessible downloader infrastructures by replaying download dialogs or observing a downloader’s process
	activities from within the Windows kernel. With these two techniques, we successfully milk and analyze a diverse set of eggs from downloaders with both plain
	and encrypted communication channels.		and encrypted communication channels.
	\|NomRevue=Conference on Detection of Intrusions and Malware & Vulnerability Assessment		\|NomRevue=Conference on Detection of Intrusions and Malware & Vulnerability Assessment

Eric.freyssinet at 21:11, 30 July 2015

2015-07-30T21:11:23Z

← Older revision		Revision as of 21:11, 30 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
			\|Botnet=Renos, Sality, Gbot, Karagany, Gamarue, Dofoil, Emit, GoldInstall, Rodecap, TDSS
			\|Year=2012
			\|Date=9th
			\|Editor=DIMVA
	\|Link=http://www.christian-rossow.de/publications/downloaders-dimva12.pdf www.christian-rossow.de		\|Link=http://www.christian-rossow.de/publications/downloaders-dimva12.pdf www.christian-rossow.de
	\|Author=Christian Rossow, Christian Dietrich, Herbert Bosz		\|Author=Christian Rossow, Christian Dietrich, Herbert Bosz
	~~\|NomRevue=Conference on Detection of Intrusions and Malware & Vulnerability Assessment~~
	~~\|Date=9th~~
	~~\|Editor=DIMVA~~
	~~\|Year=2012~~
	~~\|Botnet=Renos, Sality, Gbot, Karagany, Gamarue, Dofoil, Emit, GoldInstall, Rodecap, TDSS~~
	\|Abstract=Downloaders are malicious programs with the goal to subversively		\|Abstract=Downloaders are malicious programs with the goal to subversively
	download and install malware (eggs) on a victim’s machine. In this paper, we analyze and characterize 23 Windows-based malware downloaders. We ﬁrst show		download and install malware (eggs) on a victim’s machine. In this paper, we analyze and characterize 23 Windows-based malware downloaders. We ﬁrst show
Line 19:		Line 18:
	activities from within the Windows kernel. With these two techniques, we successfully milk and analyze a diverse set of eggs from downloaders with both plain		activities from within the Windows kernel. With these two techniques, we successfully milk and analyze a diverse set of eggs from downloaders with both plain
	and encrypted communication channels.		and encrypted communication channels.
			\|NomRevue=Conference on Detection of Intrusions and Malware & Vulnerability Assessment
	\|Keyword=Malware, Downloader, Dropper, Dynamic Analysis		\|Keyword=Malware, Downloader, Dropper, Dynamic Analysis
	\|Botnet11=Virut		\|Botnet11=Virut

Eric.freyssinet: 1 revision imported

2015-02-07T14:26:52Z

1 revision imported

← Older revision		Revision as of 14:26, 7 February 2015
(No difference)

Eric.freyssinet at 19:02, 12 September 2012

2012-09-12T19:02:17Z

New page

{{Publication
|Link=http://www.christian-rossow.de/publications/downloaders-dimva12.pdf www.christian-rossow.de
|Author=Christian Rossow, Christian Dietrich, Herbert Bosz
|NomRevue=Conference on Detection of Intrusions and Malware & Vulnerability Assessment
|Date=9th
|Editor=DIMVA
|Year=2012
|Botnet=Renos, Sality, Gbot, Karagany, Gamarue, Dofoil, Emit, GoldInstall, Rodecap, TDSS
|Abstract=Downloaders are malicious programs with the goal to subversively
download and install malware (eggs) on a victim’s machine. In this paper, we analyze and characterize 23 Windows-based malware downloaders. We ﬁrst show
a high diversity in downloaders’ communication architectures (e.g., P2P), carrier protocols and encryption schemes. Using dynamic malware analysis traces
from over two years, we observe that 11 of these downloaders actively operated for at least one year, and identify 18 downloaders to be still active. We then
describe how attackers choose resilient server infrastructures. For example, we
reveal that 20% of the C&C servers remain operable on long term. Moreover,
we observe steady migrations between different domains and TLD registrars, and
notice attackers to deploy critical infrastructures redundantly across providers.
After revealing the complexity of possible counter-measures against downloaders, we present two generic techniques enabling defenders to actively acquire
malware samples. To do so, we leverage the publicly accessible downloader infrastructures by replaying download dialogs or observing a downloader’s process
activities from within the Windows kernel. With these two techniques, we successfully milk and analyze a diverse set of eggs from downloaders with both plain
and encrypted communication channels.
|Keyword=Malware, Downloader, Dropper, Dynamic Analysis
|Botnet11=Virut
|Botnet12=Winwebsec
|Botnet13=Dabvegi
|Botnet14=Buzus
|Botnet15=Zwangi
|Botnet16=Vobfus
}}