The "Pobelka" botnet

The Pobelka Botnet - a Command and Control case study.

Date: Dec-17-2012 Author: Rickey Gevers

General info
The Pobelka Botnet is a case study about -just another- citadel botnet. The botnet was dubbed Pobelka because the Command and Control that hid behind proxies used the domain name Pobelka***.***. Pobelka in Russian means "Money Laundering". Never was this domain used in any campaign nor malware url.

Botnet Charateristics
The botnet started operating in early January and at the time showed signs of amateurism, as the first used domain was mango.myvnc.com.
It quickly switched to its default url pattern and started with the domain http://secshopping.ru/mandarinas/vrata.php.
The url pattern was always the same. http:// * .ru/[A fruit or vegetable]/[dropzone].php. The botnet did 4 notable campaigns:
- Mandarinas started in early January and ended in February
- Mango started in February and ended in March
- Lime started in March and ended in August
- Pepper started in June and is still continuing
Below is a graph that visualizes the number of reports submitted by the malware to the botnet C&C per day:

Below is an overview showing the number of unique bot_id's connecting per day of respectively the Mango, Lime and Pepper campaigns:

The campaigns themselves were divided into several botnets on their own:
- Ftp (Pepper)
- QUARK (Lime, Pepper)
- General (Mango, Lime, Pepper)
- Test (Mango, Lime, Pepper)
- Kassyl (Pepper)
- OPLEXNL (Mango, Lime)
- KASSNL (Mango, Lime)
- DENL (Mango, Lime)
- XSHANL (Mango)
Directly from the beginning its goal was specifically determined to infect computers in Germany and The Netherlands. This was partly obtained by using mod_rewrite in combination with mod_geoip on the Command and Control server.

" RewriteCond %{ENV:GEOIP_COUNTRY_CODE} !^DE|NL|AE|FI|FR|PT|US|AU|UK|GB "

How exactly it was able to target computers from Germany and The Netherlands is uncertain. But we can say that the botnet was effective in selecting its victims. The botnet contained 264.339 unique bot_id's. The following graph shows the IP addresses used by the bots per location.

The following graph shows the languages of the operating systems used by the bots.

As clearly visible victims from other countries than Germany and The Netherlands can be ignored.
During the campaign the malware at least used the following primary domain names (backup domains not added):
- http://belmandoandco.ru
- http://electricityrobot.ru
- http://gendalfurod.ru
- http://gniloiiphone.ru
- http://helloseclaborber.ru
- http://holloseculabor.ru
- http://hollosecurity.ru
- http://kavabangastudio.ru
- http://kikimorarok.ru
- http://krugvkube.ru
- http://kvaskirogas.ru
- http://logicaltrading.ru
- http://lokaltriper.ru
- http://mango.myvnc.com
- http://mangorina1.com
- http://mangorina2.com
- http://openlocalsnet.ru
- http://paranormalsouls.ru
- http://polekolbasy.ru
- http://radugavmore.ru
- http://securenetsolutions.ru
- http://stoleranavole.ru
- http://stupaperestupa.ru
- http://tarelkasupa.ru
- http://travokurrr.ru
- http://uronilimishku.ru
Investigating the domains on blacklists show that only a small portion of the domain names were eventually discovered and blacklisted.

Botnet server setup / Modus Operandi
The server setup was always the same, a dedicated server in Germany functioned as the main Command and Control server and VPS/dedicated servers were rented at bulletproof hosters in especially Russia and Ukraine functioning as a proxy in between.
The domains were always registrated at freedns.ws/afraid.org and always ended with the TLD of Russia.

Banking fraud
Citadel is often referred to as a banking Trojan. I would consider it more, as the logo of the Citadel portal says correctly, a universal spyware system, it just has some built-in banking features. And stealing money is attractive and very visible.

The domains used for hosting injection code were of the TLD .com and .net and used valid certificates for https traffic.
The following banks were attacked:
Barclays.co.uk was attacked by injecting code from https://tros***.com
finanzportal.fiducia.de was attacked by injecting code from https://powermech***.net
Domains containing *privatebanking*, *firmenkunden*, *module* or *privatkunden* were attacked by injecting code from https://powermech***.net
ASN, ABN and ING Bank were attacked via injects received from http://trikolorhost***.net (91.220.35.*)
Other websites like facebook, paypal, ebay and amazon received injection code from https://securehomserv.com. Strangely this domain got locked on 17th Feb 2012 but was never changed in the config files though.

Banking (server) setup / Modus Operandi
Some of the domains ment for injection used whois guard, while others had full (fake) details entered. Some servers used proxies whilst others didn't.
This whole setup and the complete different approaches of registering domains and configuring these servers raises suspicion on the number of gangs involved.
It seems one party manages the botnet, and another arranges the banking fraud. This last service is probably offered for rent to the botherders. The banking fraud servers keep specific access portals, log files and jabber accounts for the harvested bank accounts, each devided per botnet.

The "De Telegraaf" case
On the 6th of September 2012 the website of "De Telegraaf" was spreading malware. The malware spread contained a citadel sample connecting to this specific Command and Control server. In the below graph a spike of unique bot_id's can been seen on that date. The number of unique bot_id's climbs from a little more than 5000 to more than 14000 connecting that day.
On the Command and Control server we found evidence that links to this particular case and connects this botnet to the whole breach. Ftp data was stolen from two computers in February and March containing login credentials with the phrase "telegraaf" and "tmg". These ftp data blobs also contained login credentials for anp-foto.nl, tmg.nl, gpd.nl, output-online.nl, sdu.nl, reedbusiness.nl and persgroep.nl.
Below is a list of malware outbreaks in the Netherlands, it is -not- sure these can be linked to this botnet:

Date	Website
14 maart 2012	NU.nl via CMS
29 maart 2012	Omroepzeeland, via adserver
6 juni 2012	Weeronline.nl via adserver
19 juni 2012	deparade.nl
5 juli 2012	NUjij.nl via adserver
16 augustus 2012	Omroep West
29 augustus 2012	Beslist.nl via adserver
6 september 2012	Telegraaf.nl via adserver

The "Dorifel" connection
On the 9th of August the Netherlands had a big outbreak of the Dorifel virus. (more info)
As can be seen in the below Graph on the 2th of August the botnet went silent and it didn't return until the 9th of august. The day of the Dorifel outbreak.
Dorifel kept statistics of its infections and according to its own statics a little more than 3300 infections were noted. That day the proxy server at ip address 91.218.36.248 (UKR) was used for the botnet, using the domain kvaskirogas.ru. A total of 3670 unique bot_id's made a connection that day. If we look and the infection list (p11, pdf alert) provided by the Ministry of Security and Justice, we can confirm some of the noted infected parties are within the unique bot_id's connecting that day. Same goes for all infected customers handled that day by the Digital Investigation CERT team. And SurfRight B.V. provided us an ip list with found infections, 46% of those ip addresses was in the botnet list.
Regarding the above we can say that Dorifel was probably spread via this citadel botnet, sadly we cannot prove it as it is not uncommon infected machine's contain multiple variants of malware. And there's a possibility multiple citadel botnets were used to spread the Dorifel virus.

Take down
During the live time of this botnet several take-down attempts were made (by unknown companies), none of them were completely successful, most of them had no impact at all. Last few days the criminals left the building for some reason and the Command and Control server was replaced by another (windows) server. The right time for us to come into action. The latest domains seem down by now, no reaction has been noted in our labs. But as it is possible there are configurations or domains we are not aware of, we can never be sure enough, and that is why we want to provide every individual the ability to check whether they have ever been a part of this botnet. This provides you the ability to grab some responsibility yourself, and check whether data has ever been stolen from you.

Doing coordinated take downs like these pays lip service to stopping these kind of botnets, tomorrow this one will just be replaced.

In all activities in this investigation the Dutch High Tech Crime Unit was consulted to optimize chances of criminal prosecution.

The Pobelka Botnet - a Command and Control case study.

Maybe you are infected as well...