Recently, more than 150 individuals around the world have been arrested on bank fraud related charges after using the Zeus malware to acquire credentials that enabled the criminals to steal more than $70 million dollars. Those arrested include five Ukrainian individuals that are believed to be the masterminds behind the operation. Brian Krebs notes that there is a correlation between the decreasing number of active Zeus command and control servers and the timing of the arrests.
This is interesting because while “the media” often portrays Zeus as “a botnet” the security community rightly points out that Zeus is a malware toolkit not “a” botnet and that there are multiple Zeus botnets. However, what explains the decrease in Zeus command and control servers with the disruption of just one Zeus operation? While it is certainly true that any aspiring criminal can acquire Zeus and begin his or her own operation, is there a Zeus “core” that is organized and connected through links the criminal underground? Having just returned from Palantir’s Govcon feeling inspired I imported Zeus data from the MalwareDomainList and the ZeusTracker to explore the links between Zeus command and control servers.
While there are definitely more indicators, I focused on three: IP addresses, domain names, and email addresses used to register domain names. The IP addresses represent the servers that are used to host command and control servers. One such server may host multiple command and control servers allowing one to cluster malicious domain names that are hosted on the same server. Domain names are useful indicators but essential have a one-to-one relationship so it is more valuable to cluster them by the email address used to register the domain name. Using these indicators the Zeus command and control domain names can be clustered based on co-hosting (on the same IP address) and mutual registration (same email address). This may provide some indication if there is a “core” or Zeus activity.
However, there are significant limitations to bear in mind. Malicious hosting services are available in the criminal underground, so while a single server may be a hotspot of malware activity, it may not be directly related. On the other hand, some command and control servers may be using fast flux which would negate clustering by IP address altogether. Some command and control servers are based on IP addresses only and do not have domain names associated with them. On the other hand, a single domain name may be used for a variety of purposes. (For example, I have found a domain name that hosts both a Zeus and a SpyEye command and control server, despite the reported rivalry between them). In addition, the botnet operators may register a variety of domain names from a variety of email addresses. In such cases, clustering by email addresses would not yield significant links. Finally, there may be suppliers of domain names in them malware underground that register domain names with email addresses under their control, but sell the domains names to other criminals. In such cases, while the email address may be the same, the operators of botnets may not be directly related.
The data set used contains 5,907 domain names (control servers) and 4,505 IP addresses (servers) drawn from ZeusTracker and MalwareDomainList (where the activity on MDL contains “zeus”). Here, 4,505 IP addresses have been geocoded (not all were successfully geocoded) and displayed using Palantir’s heatmap. While there is Zeus activity hosted all over the world, there are noticeable concentrations in Europe, the Unites States and China.
This cluster on the Palantir graph represents the relationship between 5,907 domain names (control servers) and 4,505 IP addresses (servers). This initial display highlights a few interesting indicators. There are several clusters that are visually apparent which show multiple domain names hosted on one server (there are three prominent “star” clusters and several smaller ones) and there is a discernible “tree” structure in the center indicating relationships between single domain names that have been hosted on multiple IP addresses. And we can see thaht there are some familiar IP addresses used to register multiple domain names, the most notable being “hilarykneber@yahoo.com” which is the email addresses behind the Kneber botnet.
Zooming in to some of the clusters reveals some interesting behaviors. In this example, one server is hosting 60 domain names. These 60 domain names were registered with 17 different email addresses. And when some additional information from MDL is brought in, we see that most of the domains are hosting a Zeus executable with the same name “patch.exe” and that there is a naming convention. For example, “1-adm.com/patch.exe” was registered with “obeys@infotorrent.ru” while “1-adm.net/patch.exe” was registered with “yam@ml3.ru”. These domain names were all added to MDL around the same time and despite the multiple email addresses it does appear as if this is a single campaign.
In order to explore the question of whether or not there is a Zeus “core” of some sort, I filtered the domain names and IP addresses to those registered with the top five appearing email addresses (with the exception of contact@privacyprotect.org which is the email address given for those who have used this domain privacy service). Domain names registered with these five email addresses account for 6.09% (360/5907) of the Zeus command and control servers. However, this number increases to 17.9% (360/2004) when the number of control servers is restricted to those that contain email data. In addition to several “star” clusters as well a “tree” in the middle of the graph, we see that these email addresses have been actively propagating Zeus for approximately one year. (The time is derived from when the domain is added to either the MDL or ZeusTracker lists, which is used a rough indicator of when a domain became active).
When the selection is restricted to only those domain names registered by “hilarykneber@yahoo.com” we can see that these domains are represented across most of the clusters indicating that many of these domain are co-hosted on the same IP addresses with those registered by our other top email addresses. In addition, the “kneber” domain names are active through this year long period of data.
While a wide variety of criminals may set up disparate Zeus operations, clustering the Zeus command and control infrastructure in this way indicates that there is some evidence to support claims of a “core” set of Zeus operations. This may be one explanation for the observed decrease in active Zeus command and control servers.
However, this data only reflects only the relationships between IP addresses, domain names and the email addresses used to register the domain names. There are a variety of additional factors, especially those related to analysis of Zeus malware binaries that may support these linkages, provide additional linkages or challenge these linkages. Historical data showing coordinated movements to new IP addresses and name servers would provide additional means to cluster command and control servers with a higher degree of accuracy.
In Part 2 of this post I will broaden the analysis in order to see if the tentative conclusion hold with the introduction of additional data.
