• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Botnets   »   The Good and the Bad of Being A New Spam Bot

The Good and the Bad of Being A New Spam Bot

  • Posted on:June 11, 2009 at 9:52 pm
  • Posted in:Botnets, Malware, Spam
  • Author:
    Ryan Flores (Threat Research Manager)
3

It seems like a new spam bot is currently being developed. Few days ago, a fellow researcher posted a pretty good analysis of a relatively simple spam bot, which Trend Micro detects as TROJ_PROXY.AIF.

This spam bot is quite straightforward. On execution, the Trojan (TROJ_PROXY.AIF) issues a DNS query to a single domain in order to obtain an IP address in order to connect to a C&C (Command and Control ). The C&C traffic is in plain text and one can easily identify how the C&C works (Figure 1).

We say the TROJ_PROXY.AIF is simple because, unlike other spam bots like WALEDAC, the former does not have any C&C command encryption or a robust C&C (take down the domain and they’re out of business).

One saving grace of this spam bot however, is its implementation of certain techniques to avoid spam filters. Take a look at a sample spam mail generated by TROJ_PROXY.AIF (Figure 2).

Click for larger view Click for larger view

A short glance introduces a simple spam email, but a closer look reveals that there are 5 intended recipients of the spam mail. This is quite uncommon for a spam mail since most spam email out there have a 1-spam-per-target email address format and this technique might actually throw off some spam filters.

Another technique used by this spam bot is it uses a Google group to link to in the email body which acts as a middle-man for the actual spam site advertising penis enlargement pills.

Click for larger view Click for larger view

The two techniques mentioned, combined with the usual random lettered words and normal words in the e-mail subject and body give the spam a better chance of passing through Bayesian filters and anti-spam signatures.

Mentionable is that most of the target email addresses are Yahoo! or other webmail users, which then again slightly increases the spam’s chances of passing through since most of these webmails are free services and have slightly lower level of spam protection as compared to corporate networks with a stronger anti-spam product and stringent email policies.

Click for larger view

In all, TROJ_PROXY.AIF may be relatively simple now, but it is possible this spam bot is still in the early stages of development and may one day evolve into something more complex.

Related posts:

  • XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails
  • Monero-Mining RETADUP Worm Goes Polymorphic, Gets an AutoHotKey Variant
Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»

Featured Stories

  • systemd Vulnerability Leads to Denial of Service on Linux
  • qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware
  • Mitigating CVE-2017-5689, an Intel Management Engine Vulnerability
  • A Closer Look at North Korea’s Internet
  • From Cybercrime to Cyberpropaganda

Security Predictions for 2019

  • Our security predictions for 2019 are based on our experts’ analysis of the progress of current and emerging technologies, user behavior, and market trends, and their impact on the threat landscape. We have categorized them according to the main areas that are likely to be affected, given the sprawling nature of the technological and sociopolitical changes under consideration.
    Read our security predictions for 2019.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server
  • Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire
  • Windows App Runs on Mac, Downloads Info Stealer and Adware
  • Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners
  • Various Google Play ‘Beauty Camera’ Apps Send Users Pornographic Content, Redirect Them to Phishing Websites and Collect Their Pictures

Popular Posts

  • Going In-depth with Emotet: Multilayer Operating Mechanisms
  • February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server
  • Various Google Play ‘Beauty Camera’ Apps Send Users Pornographic Content, Redirect Them to Phishing Websites and Collect Their Pictures
  • Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners
  • Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.