View source for Xpaj Botnet intercepts up to 87 million searches per year

{{Publication
|Image=xpaj-botnet-intercepts-87-million-searches-year.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.symantec.com/connect/blogs/xpaj-botnet-intercepts-87-million-searches-year
|Author=Gavin O Gorman, 
|NomRevue=Symantec Connect Community
|Date=26 Aug 2011 
|Editor=Symantec
|Year=2011
|ISBN=
|Page=
|Abstract=W32.Xpaj.B is one of the most complex and sophisticated file infectors Symantec has encountered. In an older blog post, Piotr Krysiuk calls it an “upper crust file infector.” He describes several different approaches that the infector uses to increase the difficulty in detecting infected samples. The techniques W32.Xpaj.B uses to conceal itself within an executable are far beyond the norm. Given this level of complexity, it was decided to analyze the threat in detail.

The analysis revealed IP addresses for the command & control (C&C) servers. Infected W32.Xpaj.B executables send a download request to these C&C servers. Analysis of the threat’s backend control infrastructure revealed more than just the data sent from the server to infected clients. The servers contained encrypted binary data, encryption keys, databases, and Web applications. These were all elements of what transpired to be a fraud operation spread over multiple computers hosted in several countries.

Reverse engineering the binary data, in conjunction with analyzing the Web applications, has built up a picture of a convoluted click-fraud scheme. The intricate details of how the fraud was implemented are fully described in the associated technical paper, W32.Xpaj.B: Making easy money from complex code [PDF]. An overview is presented here along with details of how widespread the threat was and how much money was earned.
|Botnet=Xpaj, 
|Malware=, 
|CCProtocol=, 
|Operation=, 
|Keyword=, 
}}