It seems like a new spam bot is currently being developed. Few days ago, a fellow researcher posted a pretty good analysis of a relatively simple spam bot, which Trend Micro detects as TROJ_PROXY.AIF.

This spam bot is quite straightforward. On execution, the Trojan (TROJ_PROXY.AIF) issues a DNS query to a single domain in order to obtain an IP address in order to connect to a C&C (Command and Control ). The C&C traffic is in plain text and one can easily identify how the C&C works (Figure 1).

We say the TROJ_PROXY.AIF is simple because, unlike other spam bots like WALEDAC, the former does not have any C&C command encryption or a robust C&C (take down the domain and they’re out of business).

One saving grace of this spam bot however, is its implementation of certain techniques to avoid spam filters. Take a look at a sample spam mail generated by TROJ_PROXY.AIF (Figure 2).

A short glance introduces a simple spam email, but a closer look reveals that there are 5 intended recipients of the spam mail. This is quite uncommon for a spam mail since most spam email out there have a 1-spam-per-target email address format and this technique might actually throw off some spam filters.

Another technique used by this spam bot is it uses a Google group to link to in the email body which acts as a middle-man for the actual spam site advertising penis enlargement pills.

The two techniques mentioned, combined with the usual random lettered words and normal words in the e-mail subject and body give the spam a better chance of passing through Bayesian filters and anti-spam signatures.

Mentionable is that most of the target email addresses are Yahoo! or other webmail users, which then again slightly increases the spam’s chances of passing through since most of these webmails are free services and have slightly lower level of spam protection as compared to corporate networks with a stronger anti-spam product and stringent email policies.

In all, TROJ_PROXY.AIF may be relatively simple now, but it is possible this spam bot is still in the early stages of development and may one day evolve into something more complex.

If you're new here, you may want to subscribe to our RSS feed. Thanks for visiting!

TrendLabs researchers have recently published their research on two of the most prevalent botnets in the threat landscape to date:

Infiltrating WALEDAC Botnet’s Covert Operations

Spam is not a mere inbox annoyance anymore but is the first step toward executing more dangerous kinds of system infiltration. Malware are no longer discrete executables but a motley group of related components and files that work together to surreptitiously get inside systems. The technologies malware crime fighters are using are—in some cases—being used against us. The people behind these cybercrimes are no longer fame-seeking script kiddies, they are now professional criminals who have created robust cybercrime businesses.

This paper provides a comprehensive view of the WALEDAC botnet—its activities, methodology, involved technologies, purpose, and business model—in order to paint a picture of the complex and intricate nature of the threats that we see today.

Pushdo / Cutwail Botnet

The Pushdo botnet has been with us since January 2007, and while it does not grab as many headlines as its attention-seeking peers such as Storm or Conficker, it is the second largest spam botnet on the planet – sending approximately 7.7 Billion emails per day, making it single-handedly responsible for about 1 out of every 25 emails sent.

There are several reasons for Pushdo’s lack of notoriety – the authors have actively used several techniques to help keep its activity “under the radar.” Not only is Pushdo responsible for a huge amount of spam activity, it also is one of the primary conduits for other criminal gangs to spread their malware creations.

The two abovementioned papers, as well as other previously released white papers can be downloaded from this page.