1 / 23

The hidden part of TDSS

The hidden part of TDSS. Sergey (k1k) Golovanov, Malware Expert Global Research and Analysis Team Kaspersky Lab. Content. TDSS Overview Reversing TDSS networking Analyzing p2p functionality Monitoring active bot Getting CnC stats. TDSS Overview . Main modules.

saskia
Download Presentation

The hidden part of TDSS

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. The hidden part of TDSS Sergey (k1k) Golovanov, Malware Expert Global Research and Analysis Team Kaspersky Lab

  2. Content TDSS Overview Reversing TDSS networking Analyzing p2p functionality Monitoring active bot Getting CnC stats

  3. TDSSOverview

  4. Main modules • MBR infector – bypass drivers digital signatures protection • x64rootkit – TDSS works on every modern Windows system • Clicker – clicks banners and links • Target on Black SEO – promoting web site via Google, Bing, Altavista and more

  5. Affiliate Network • Two Affiliate Networks are spreading TDSS • 20 - 200 USD for 1 000 installs • Affiliates installs TDSS via SPAM, Worms, Exploits and etc.

  6. Malicious DHCP

  7. Boot

  8. Reversing TDSS networking.

  9. Client to Server 1. Original request command|noname|30127|0|0.03|0.15|5.1 2600 SP2.0|en-us|iexplore|351|0 and Benchmark(20000000,md5(1))|1614895754 2. RC4 or its modification where Key is the targeted host name ХЪ7U>tюjЇ\+_Э→/CИY>Kо↓н>4L•xoУч¶@_►F_M!аw♀:Ыp↔d;_fщ☻§ю¶♥0язl 3. BASE64 r1writ0aL0PIWZtL7hntuzRMB3hv0/cUQL4QRrxNIeB3 4. Additional trash 4EszDdXaN1U+dP5qr1writ0aL0PIWZtL7hntuzRMB3hv0/cUQL4QRrxNIeB3DDr 5. HTTPS

  10. Server to Client 1. Set Name parameter – additional unique key for RC4 or its modification

  11. Analyzingp2pfunctionality

  12. Analyzing p2p functionality KAD.DLL algorithm: Share encrypted file named as “ktzrules” Upload kad.dll on TDSS infected PCs Kad.dll loads public nodes.dat file with KAD Client/Servers IPs Kad.dll searchsfor “ktzrules” file in public KAD network Kad.dll downloads “ktzrules” and executes commands

  13. Public KAD Net Defaultnodes.dat. TDSS KAD Net Nodes.dat with Clean and Infected users IPs Analyzing p2p functionality KAD.DLL functions: SearchCfg – find “ktzrules” file with commands LoadExe – Find and download exe file from KAD ConfigWrite – write in configuration file Search – find specified file in KAD Publish – publish specified file Knock – download new nodes.dat file

  14. Monitoringactive bot

  15. Installs and proxy

  16. Anti-Virus • Gbot • ZeuS • Clishmic • Optima • Full list includes ~30 malware families name

  17. GettingCnCstats

  18. Getting CnC stats 60 proxy CnCs 3MySQL DBs 5M infected PCs in 3 months

  19. Summary • MBR infector – bypass drivers digital signatures protection • x64rootkit – TDSS works on every modern Windows system • Clicker – clickbanners and links • Target on Black SEO – promoting web site via Google, Bing, Altavista and more • P2P botnet – no servers, no centers, sophisticated crypto protection for command file in hidden KAD network. • Own AV – detects more then 30 malware families • Clients Proxy –additional anonymizer via infected PCs • 5 millions infected computers

  20. http://www.facebook.com/KasperskyConference http://www.kaspersky.com/educational-events

  21. Kaspersky Lab PowerPoint Template

  22. Qu35t10n5? • Sergey (k1k) Golovanov, Malware Expert Global Research and Analysis Team Kaspersky Lab

More Related