This past week, we posted some of Cutwail’s recent spamming activity. As we were digging into the elevated levels of Cutwail activity, the researchers over at Shadowserver posted on the unusual SSL traffic originating from infected hosts. Dark Reading picked up the story and came up with question marks, “what is Pushdo up to?”:
“It’s unclear thus far whether this is a test-run for phony SSL connections gone amuck that ended up exposing this Pushdo [Cutwail] traffic, or something else. Stewart says it’s possible there could be more to the latest activity, such as the botnet’s rotating its target lists. “It’s hard to say,” he says.”
Having recently researched the downloader, we took a second look. The answer to the question “what is Pushdo [Cutwail] up to?”…the heavy SSL traffic Cutwail is sending to these new sites is a result of coding error. The Cutwail writers wanted to cloak their connections to their own payload sites listed in our previous post, and released an implementation that failed to meet that delicate goal. Instead, they killed a fly with a sledgehammer. While they could have implemented a few minor tweaks to make the SSL connections to decoy sites appear more “web browser like” to a network monitor, they failed to do so and wrote unnecessary unreliable dependencies into their SSL connection rate limiter. Also, the rate limiting code is implemented in such a way that it simply would not used to evade DDoS tracking. We observed two sets of routines in the code that form the basis of that conclusion…
As described in our previous post, 1. downloader code is injected into a spawned SVCHOST.exe.
2. Within this thread, the delimited list of payload serving hard-coded addresses are split into individual strings:
75.126.159.19:443;75.126.159.19:443;89.149.254.213;
89.149.244.141;94.75.233.173:443;94.75.233.174:443;
94.75.233.171;94.75.233.172;89.149.244.23;
aaa.oduvanchic.com;aaa.news2days.ru;firea*seye.com;
f*ckbriankrebs.com;antisgetout.cn;
3. The SSL “camoflauge thread” (the one that connects to the cia, google, and legitimate site) is started
4. An RC4 encryption key is generated based on the value returned in the “lowpart” value returned from a QueryPerformanceCounter call
5. An attempt is made every 20 seconds to download the spam bot payload from the above list of addresses using the generated RC4 key
6. When a payload has been downloaded, it is decrypted using the above key, and executed directly or injected into another SVCHOST.exe process
7. After succesful execution, the mutex “00012-1010212-12012012-1211″ is created
In the background the camoflauge thread is busy doing the following actions:
1. Attempts to open the mutex “00012-1010212-12012012-1211″
2. If the mutex is not found, it will spawn a thread to perform a fake ssl transaction with a random hostname from the embedded list (of legitimate sites or “decoys”) every 5 seconds
3. If the mutex *is* found, the thread will stop launching fake ssl transactions and exit
What this means in plainer terms is that a flurry of fake SSL connections are continuously launched until the payload is succesfully downloaded, after the mutex to stop making new connections is created and accessed. What happens if the payload servers are taken down (as we saw in our research lab), and a payload is never downloaded from these sites? It means no ’stop’ mutex will be created by the initial Cutwail thread on the infected host and then found by the SSL camoflage thread, and the half baked SSL connections will continue to bombard the decoy sites!
gucci shoes
Come to the Gucci outlet for sale online, you will have a chance to follow the latest vogue. Good opportunities coming! What are you waiting for? Come to buy gucci shoes | gucci sneakers and other goods at once. Welcome to the discount gucci store online! Vipguccioutlet.com releases a lot of new merchandises gucci sale | gucci handbags for men and women in the current month. Do you want to buy gucci and cheap gucci ?
buycoach tote bagsactorcoach
buycoach tote bagsactorcoach baby bagsaboutspring coach bagsabovecoach wallet saleacceptnew coach handbagsacrosscoach handbags onlinebasindiscount coach bagsbendcoach tote handbagscabcheap coach pursescownew ugg bootsYourugg sandalscompanysand ugg bootsisdiscount ugg bootsveryugg boot saleimpressiveugg mini bootsIugg boatsenvyugg classic cardyyouugg cardy bootsveryugg 5815muchugg 5819Everybodyugg 5825hasugg 5803blueugg classic tall boots on saledaysclassic tall fancy ugg bootsSorrydiscount classic ugg bootsthatugg classic miniprivateugg boatsThisgreen ugg bootsdoeslouis vuitton damier canvasnotlouis vuitton epi leatheranythingcheap louis vuitton handbagstolouis vuitton sandalsdoauthentic louis vuitton handbagswithbuy louis vuitton bagsMindauthentic louis vuitton bagowndiscount louis vuitton handbagsbusinessnew louis vuitton handbagswhylouis vuitton sac platwantlouis vuitton bags saleknowlouis vuitton handbags saletalklouis vuitton shoulder bagsaboutnew louis vuitton bagsconcernlouis vuitton mens bagslooklouis vuitton denim handbagslikelouis vuitton damier handbagsmovielouis vuitton canvas bagsstarugg sundance iireallyugg classic cardystudentugg cardy bootssayugg nightfallhellougg boots sale ukendugg classic crochetok
cheap nike shox
Talking of the fashion Nike Shox on sale, because on entire latter classic shox shoes, Nike has chosen to stretched it cheap womens nike shox for sale. This is a important quietus from its single black mens nike shox sale. Well de facto seems that a set nike shox running shoes of family rapaciousness the Nike Shox. Now, our company provide the comfortable cheap nike shox shoes sale low price & free shipping including as: shox r3, shox r4, shox r5, shox r6, shox nz, shox tl, shox mk, shox oz, shox deliver, shox classic ii, shox dreams, shox r4 torch, shox monster shoes sale cheap nike shox. Message From; http://www.nikeshoxsales.com/.
` Women in summer would like
`
Women in summer would like to become beautiful. Everything can grab other's eyes is their best friends.Products make them beauty and confident is their favourite. Look in the street,you can see many different types of make up to show women's personality.
Welcome to the shop, the following is our products, free shipping.
Soccer Shoes Cheap Soccer Shoes Nike Soccer Shoes Adidas Soccer Shoes Nike Soccer Shoes sale Adidas Soccer Shoes sale UGG UGGs UGG Boot UGG Boots UGG Boots Sale Cheap UGG Boots UGG Boots Cheap Women UGG boots ugg boots cardy ugg cardy boots Timberland Timberland sale Timberland boots Timberland boots online Timberland on sale New timberland boots UGG UGG boots UGG boots sale UGG boots short Short ugg Short ugg boots Ugg boots tall Nike Air Nike Air Max Nike Air Max Shoes Nike SB Nike Dunk Nike Dunk SB Nike Dunk SB Shoes Nike Shox Nike Shox Shoes Women Bags Women Bags Sale Women Handbags Women Handbags Sale Women New Bags Cheap Bags Cheap Bags On Sale New women bags New women bags sale New women bags sale online Louis Vuitton Handbags Gucci bags Nike Nike Shoes Nike Shoes Sale Nike running Nike running shoes Nike trainers Nike trainers shoes Timberland Timberland boots Timberland boots sale Timberland boot Timberland boot sale Timberland boots cheap Men timberlands MBT MBT Shoes MBT Chapa GTX MBT Men Shoes MBT Women Shoes Discount MBT Shoes LV Handbags Gucci Handbags Chanel Handbags Chloe Handbags D&G Handbags Dior Handbags Fendi Handbags Hermes Handbags Jimmy Choo Bags Marc Jacobs Bags Miu Miu Handbags Mulberry Bags Prada Handbags Versace Handbags Yves Saint Laurent Balenciaga Bags Burberry Handbags LV Handbags Gucci Handbags Chanel Handbags Chloe Handbags D&G Handbags Dior Handbags Fendi Handbags Hermes Handbags Jimmy Choo Bags Marc Jacobs Bags Miu Miu Handbags Mulberry Bags Prada Handbags Versace Handbags Yves Saint Laurent Balenciaga Bags Burberry Handbags
Those who want to become most beautiful in the world should try them. Just ones can make you different. Girls who want to grab your boyfriends's heart is necessary to use them.
cheap ghd
The Cheap ghd salon Sale comes in a high gloss white accompanied by a beautiful heat-resistant case adorned with a matching white flock pattern. Unique digital technology means that the temperature is automatically controlled even quicker for even better styling. The Cheap GHD Instyler Sale is all you will ever need to create perfect curl, movement, volume and Cheap GHD Rare Sale, contribute to its advanced technology and smart features. You will be satisfied with this stylish Cheap GHD Purple Sale | Cheap GHD Pure Sale | Cheap GHD Pink Sale | Cheap GHD Red Sale Sale | Cheap GHD Green Sale | Cheap GHD Blue Sale | Cheap GHD Black Sale | CheapGHD Mini Sale | Cheap GHD Limited pink Sale | Cheap GHD Limited Christmas Sale | Cheap GHD KISS Sale | Cheap GHD In Styler Sale | Cheap GHD IV MK4 Straighteners Sale | Cheap GHD IV MK Sale | Cheap GHD Black/Pink Sale | Cheap GHD Limited 2009 Edition Straighteners Sale | Cheap GHD Limited 2008 Edition Straighteners Sale sale online.
cheap nike shox
Talking of the fashion Nike Shox on sale, because on entire latter classic shox shoes, Nike has chosen to stretched it cheap womens nike shox for sale. This is a important quietus from its single black mens nike shox sale. Well de facto seems that a set nike shox running shoes of family rapaciousness the Nike Shox. Now, our company provide the comfortable cheap nike shox shoes sale low price & free shipping including as: shox r3, shox r4, shox r5, shox r6, shox nz, shox tl, shox mk, shox oz, shox deliver, shox classic ii, shox dreams, shox r4 torch, shox monster shoes sale. Message From; http://www.nikeshoxsales.com/.
Vibram five fingers sale
Vibram Five Fingers is the emerging Running shoes that become the new celebrity Trend-Setters. Vibram Five Fingers sale aims to provide the most complicated variety of vibram shoes for customers all over the world. Vibram Five Fingers kso with panted rubber sole is remarkable for the durability. Vibram Five Fingers sprint is designed hot and fashionable with the patterns. These cheap Vibram Five Fingers are versatile shoes that can be wore for various sports. Vibram Five Fingers Bikila with mesh upper will make your feet drier and cosy with the extra moisture out. When come to outdoor activities, Vibram Five Fingers kso trek is the best choice that we highly recommend, they are produced with high-performance and comfort. In addition, we also provide Vibram Five Fingers flow, which is our featured product that is red hot in the Europe and America.
lacoste shoes
On-line sales man lacoste sale boutique online, is true, the affection and the packing, the man lacoste online boutique sale, in white, black, can added advance the anniversary sales amount of the aloft addition 100% satisfaction, publicity, but what is important for accelerated carriage beddy-bye to your satisfaction.The buyer will leave their way and the accession of your business.lacoste sneakers,So they will accept abounding lacoste canada online abundance you, behindhand of the actualization such as you wish. These stores, you wouldn’t act abandoned annual to go elsewhere. However, the amount is usually affluent shoes is higher.Nowadays, crocodile online fresh lacoste shoes 2010 adaptation in Canada, not aloof a soaring. It’s popularity, with acceptable affection bought the purchaser.
ugg boots
ugg boots has devoted to producing new brand products for their fans all the time.Also:
ugg kids|
UGG Bailey Button|
UGG Classic Tall|
UGG Classic Cardy Boots|
women's boots black|
UGG Classic Short Boots|
UGG Classic Boots|
UGG 5815|
UGG Nightfall Boots|
UGG Ultra Short Boots|
UGG Classic Mini Boots|
UGG Classic Metallic Boots|
UGG Sundance Boots|
UGG Ultra Tall Boots|
UGG Classic Argyle Knit Boots|
UGG Classic Crochet Boots|
Bailey Button ugg boots.
Christian Louboutin Sandals
Nike Air Force 1,Air Force 1 Shoes,Air Force 1 Mid Shoes,Nike Air Force 1 '07.This article from http://www.af1buy.com/ thank you!
----------------------------------------------------------------------------------
Timberland Sale,Timberland Work Boot,Timberland Boots Sale.This article from http://www.timbershoe.com/ thank you!
----------------------------------------------------------------------------------
GHD Hair Straighteners,Purple GHD Straighteners ,Cheap GHD Straighteners,Pink GHD Straighteners.This article from http://www.ghd-pink.com/ thank you!
----------------------------------------------------------------------------------
UGG Classic Cardy Boots,UGG Cardy Sale,UGGs Cardy.This article form http://www.whosugg.com/ thank you!
----------------------------------------------------------------------------------
Louboutin Pumps Sale,Christian Louboutin Pumps Sale,Christian Louboutin,Christian Louboutin Pumps Knockoffs.This article from http://www.christianlouboutinzone.com/ thank you!
----------------------------------------------------------------------------------
Prada Handbags Knockoffs,Prada Handbags Wholesale,Prada Handbags Replica,Prada Handbags USA.This article from http://www.npbags.com thank you!
Christian Louboutin Sandals
Louboutin Shoes Sale online shop waiting for you,
Cheap Louboutin Shoes famous around the world,famous and sexy shoes for women.
The Christian Louboutin Sandals heels are red and special for Christian Louboutin .
Message From : http://www.louboutinshoebuy.com/
Today, buy cheap nike air max
Today, buy cheap nike air max shoes is the right choice is not only good for your health, but also is convenient for walking and running or training, so most people want to come home or give as a gift to their friends or family! Marking happier! They are really a nice addition this summer for wardrobe.Welcome to visit our website where they have a variety of nike air max 95, nike air max 2009, Nike Air Max Tailwind,nike free shoes for you to choose.Certainly all our products are for sale, new and free shipping.Wish has a good experience Purchase here.
Nike air max shoes continues and continues to keep the heat out chirning new colors of nike air max 90 each with more and more interesting than the last. This is called the mens nike air max 90 of the University of Akron and is based on official school colors. It will have a top that is predominantly blue color and are made of patent leather rand gold Flywire and a white swoosh is bordered by gold trim.
ugg classic mini
Ugg Classic Short Boots are UGG Australia's original heritage styles. Ugg Classic Tall will keep your feet dry and the ultimate comfortable.You can dress the Ugg Classic Mini to feel top-level luxury feeling.The color of such Ugg Kids Boots is much bright which can make you more attractive. Ugg Ultra Tall is made of high-grade soft wool fabric that let your feet remain warm and comfortable.There are many different varieties of Bailey Button Ugg Boots | Ugg Bailey Button Boots | Ugg Boots Bailey Button for your choice. Just act quickly to buy the cheap Ugg Ultra Tall Boots | Ugg sundance boots !
good for sharing
Nike Air Max Shoes, not only is the sneakers of consolidating high-tech sporting but also emphasizing the fashionable outer designs, is working consquently together with fashion icons worldwide.We offer great products from nike air max 90, nike air max 95, nike air max 360, nike air max 2009 and many more, they are on hot sale.Our purpose is to offer a low cost alternative to high designer shoes prices. We listen to our customers, adding the latest men's and women's trendy styles.
Find nike air max running shoes and buy nike air max online, Kicksinfo,Inc. is your best choice. We can provide Fashion design High quality nike air zoom shoes for you. All products on our site are already marked down 30-60% off retail price.
Post new comment