Few days back, we found another Pastebin entry that contains a source which looks to be malicious botnet code. As I wrote in my earlier blog, malware authors also use Pastebin to trade botnet kits. Many times, snippets of a botnet help researchers understand the workings of the botnet and write detections for it.
The code posted was fairly simple to understand, appearing fully tested and complete. The code provides insights to the coding skills and techniques used by the botnet author. This bot uses fairly standard installation, copying itself into the Windows\System32\ folder and then sending and receiving commands from a hard-coded control server. The source contains two interesting antianalysis functions, which check for the presence of a sandbox or tools such as OllyDbg or Wireshark. If it detects countermeasures, the bot terminates its process. Below are the two functions used for antianalysis:
BOOL bIsSandbox (void)
DWORD WINAPI tScanner (LPVOID)
Both of the preceding function help a bot to terminate its process from being analyzed by researchers. The bot sends OS version, Username, botID, and other information to its hard-coded control server in the ns/clients.php?os=%s&name=%s&id=%i&loc=%s format and waits for other commands.
This bot supports the following commands, among others:
install: Download and install another binary
uninstall: Clears registry entries and exit()
open: Open a specified file
update: Update to a new bot binary
Examining the code gives us a fair idea of the network communications of this botnet and helps researchers easily write detections. The availability of the source also helps us understand different techniques or methods used by the botnet authors. It’s no surprise that Pastebin has become a communications channel for bad guys–not only for selling botnets but also for sharing code snippets.