Pushdo Trojan infects 11,000 systems in 24 hours

[Jack]

Bitdefender has discovered that a new variant of the Trojan component, Pushdo, has emerged. 77 machines have been infected in the UK via the botnet in the past 24 hours, with more than 11,000 infections reported worldwide in the same period.

The countries most affected so far by the Pushdo variant are India, Vietnam and Turkey.

Since Pushdo has resurfaced, the public and private keys used to protect the communication between the bots and the Command and Control Servers have been changed, but the communication protocol remains the same.

Another significant change has been made at the binary level, with new Pushdo binaries containing an encrypted overlay, having the role of a check-up. If the conditions specified in the overlay are not met, the sample does not run properly.

Bitdefender advises that a new DGA (Domain Generation Algorithm) is also currently in use. Although the main structure of the algorithm was preserved, the generated domain names look very different. Only some constants and lists of letters used to compute the domain name length and choose the domain name characters have been updated.

“Yesterday, we managed to successfully intercept Pushdo traffic and gain some idea of the size of this botnet,” states Catalin Cosoi, Chief Security Strategist at Bitdefender. “The sheer scale of this criminal operation, unsophisticated as it may be, is rather troubling and there are indications that the botnet is still in a growth phase. We shall be continuing our investigation as a key priority and further updates shall be made available in the coming days.”

Read more: http://www.net-security.org/malware_news.php?id=2809

 

[Littlebits]

The article never says how this Trojan was distributed.

Thanks.

 

[Jack]

The article never says how this Trojan was distributed.

Thanks.

Pushdo is generally spread by drive-by download attacks, which means if you visit a website or you click on a link and your machine is vulnerable to the threat, it can automatically download the malware without you seeing anything.

The 'Drive-by-Download' Attack

'Drive-by-download' attacks occur when a visitor navigates to a site that injects malware onto the victim's PC. Crucially, these attacks are usually downloaded and run in the background in a manner that is invisible to the user - and without the user taking any conscious 'action steps' to initiate the attack. Just the act of viewing a web-page that harbors this malicious code is enough for the attack to run. The downloaded malware often initiates a buffer-overflow attack.

A buffer-overflow attack occurs when the downloaded malicious program or script deliberately sends more data to a target applications memory buffer than the buffer can handle - which can be exploited to create a back door to the system though which a hacker can gain access. The goal of most attacks is to install malware onto the compromised PC whereby the hacker can reformat the hard drive, steal sensitive user information, or even install programs that transform the machine into a zombie PC.

There are many types of buffer overflow attack, including stack attacks, heap attacks and ret2libc attacks. In each case, the goal is to destabilize or crash a computer system by deliberately causing a buffer overflow – creating the opportunity for the hacker to run malicious code and even gain control of the entire operating system. As would be expected, the applications most vulnerable to a buffer overflow attacks are those whose primary function involves Internet connectivity - such as web-browsers, e-mail clients and instant messaging applications.

More here: http://www.comodo.com/resources/home/newsletters/nov-10/ask-geekbuddy.php

 

[Littlebits]

Pushdo is generally spread by drive-by download attacks, which means if you visit a website or you click on a link and your machine is vulnerable to the threat, it can automatically download the malware without you seeing anything.

According to Wikipedia and other sources Pushdo is distributed by mostly spam emails tricking users into manually downloading an infected attachment. Usually target large companies, government, military, etc.

Enjoy!!

 

[Arakasi]

Sounds like how crypto spreads majority of the time. SMTP and the like...