McAfee Labs

Ramnit Malware Creates FTP Network From Victims’ Computers

0
By on Sep 30, 2013

The Ramnit worm appeared in 2010. Within a year more than eight million PCs were infected worldwide. Initially the malware was just file infector spread by removable drives. Later it became better know for stealing user data via browser injection, targeting banking or game users.

While reviewing the malware recently, we found new samples with active domains.

20130930 Ramniit-1

 

Ramnit is still prevalent and old domains are regularly updated. Some of the domains have already been “sinkholed” (redirected to communicate only with a controlled server and not with its malicious developers) by other security researchers.

Apart from its typical malware characteristics (infecting .exe/html files, hooking Internet Explorer process) Ramnit sets up an FTP server on a victim’s machine. That FTP server becomes part of the RMNetwork FTP.

This FTP server supports following commands:

USER, PASS, CWD, CDUP, QUIT, PORT, PASV, TYPE, MODE, RETR, STOR, APPE, REST, RNFR, RNTO, ABOR, DELE, RMD, MKD, LIST, NLST, SYST, STAT, HELP, NOOP, SIZE, EXEC, and PWD.

20130930 Ramniit-2

Using these commands attackers can control the machine remotely, steal other sensitive files, and execute other malicious files. Infected machines that are firewalled or sit behind network address translation cannot “join” RMNetwork FTP, but they can communicate with the control server using TCP port 443 or 447 with custom encryption.

20130930 Ramniit-3

By looking at the malware’s domain names, they seem to be created a domain generation algorithm. However, these active domains are hardcoded in the binary. This means new binaries are being created with the malware’s builder tool and are spreading by other malware or phishing scams. These domains are encrypted using the XOR algorithm with different keys for every sample.

20130930 Ramniit-4

McAfee customers are already protected from this threat.

 

 

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>