Ramnit Malware Creates FTP Network From Victims’ Computers

By on

This blog post was written by Vikas Taneja.

The Ramnit worm appeared in 2010. Within a year more than eight million PCs were infected worldwide. Initially the malware was just file infector spread by removable drives. Later it became better know for stealing user data via browser injection, targeting banking or game users.

While reviewing the malware recently, we found new samples with active domains.

20130930 Ramniit-1

 

Ramnit is still prevalent and old domains are regularly updated. Some of the domains have already been “sinkholed” (redirected to communicate only with a controlled server and not with its malicious developers) by other security researchers.

Apart from its typical malware characteristics (infecting .exe/html files, hooking Internet Explorer process) Ramnit sets up an FTP server on a victim’s machine. That FTP server becomes part of the RMNetwork FTP.

This FTP server supports following commands:

USER, PASS, CWD, CDUP, QUIT, PORT, PASV, TYPE, MODE, RETR, STOR, APPE, REST, RNFR, RNTO, ABOR, DELE, RMD, MKD, LIST, NLST, SYST, STAT, HELP, NOOP, SIZE, EXEC, and PWD.

20130930 Ramniit-2

Using these commands attackers can control the machine remotely, steal other sensitive files, and execute other malicious files. Infected machines that are firewalled or sit behind network address translation cannot “join” RMNetwork FTP, but they can communicate with the control server using TCP port 443 or 447 with custom encryption.

20130930 Ramniit-3

By looking at the malware’s domain names, they seem to be created a domain generation algorithm. However, these active domains are hardcoded in the binary. This means new binaries are being created with the malware’s builder tool and are spreading by other malware or phishing scams. These domains are encrypted using the XOR algorithm with different keys for every sample.

20130930 Ramniit-4

McAfee customers are already protected from this threat.

 

 

Leave a Comment

Similar articles

Messaging apps are a common form of digital communication these days, with Facebook’s WhatsApp being one of the most popular options out there. The communication platform boasts over 1.5 billion users – who now need to immediately update the app due to a new security threat. In fact, WhatsApp just announced a recently discovered security ...
Read Blog
Many of us use social media to keep our family and friends up-to-date on our everyday lives. We don’t typically expect social media companies to keep their partners updated on our every move as well. But for some Twitter users, this is exactly the situation they’ve found themselves in. On Monday afternoon, the social media ...
Read Blog