View source for W32.Xpaj.B: making easy money from complex code

{{Publication
|Image=making easy money from complex code.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_xpaj_b.pdf (PDF)
|Author=Sean Kiernan, Piotr Krysiuk, Andrea Lelli, Gavin O’Gorman , 
|NomRevue=Symantec Security Response
|Date=
|Editor=Symantec
|Year=2011
|ISBN=
|Page=
|Abstract=W32.Xpaj.B is one of the most complex and sophisticated file infectors 
Symantec has encountered. Given this level of complexity, it was decided to conduct a deep analysis of this threat. The analysis revealed 
IP addresses for the command and control (C&C) servers. These servers are used to deliver encrypted binary large objects or ’blobs’ to the 
infected client. Without obtaining one of these blobs it was not possible to determine the purpose of the threat. An investigation of the 
server revealed not only copies of these blobs, but details of a clickfraud operation spread over multiple computers hosted in several 
countries. The server contained logs and databases of the criminal’s 
activities, including a record of earnings from late September of 2010 
up to June 28th of this year. The maximum earnings in a single day 
were US$450, with an average of US$170 a day. Overall, the scheme 
grossed approximately US$46,000. This paper gives a detailed analysis 
of the infrastructure of the threat, the malware involved, a breakdown 
of earnings, and information about the criminals behind the scam.
|Botnet=Xpaj, 
|Malware=Xpaj (bot), Sality (bot), Virut (bot), 
|CCProtocol=, 
|Operation=, 
|Keyword=, 
}}