Similar Searches

  • W32/Xpaj: Know Your Polymorphic Enemy (September 21, 2009)

    Nowadays, most anti-virus products can deal with viruses relatively easily using a variety of technologies. Decent emulator-based scan engines can handle a majority of polymorphic and metamorphic viruses, including those that use the entry-point obscuring technique (EPO). But when it

  • Creating a Simple Botnet Using the AutoIT Scripting Language (October 14, 2009)

    This post is made on behalf of my colleague Manoj Venugopalan, Malware Analyst for Symantec Hosted Services. AutoIT, a free automation language for Windows platform-based development, is often used for scripting Windows-based applications and sometimes misused for creating malware. AutoIT scripts

  • The Sality Botnet (May 14, 2010)

    As discussed in a previous blog entry, Sality-infected computers become part of a peer-to-peer (P2P) botnet. This botnet is used by peers to exchange lists of URLs pointing to malicious software, which Sality will decrypt, download and install. Though the

  • Security lessons in Zeus botnet raid on UK bank accounts (August 11, 2010)

    The well-read UK security news site The Register is carrying a story detailing how the operators of the Zeus botnet planted their sophisticated malware on thousands of UK bank customers’ computers, stole log-in information then raided the accounts for more

  • Insights into Shutting Down the Virut Botnet (July 22, 2010)

    Virut is a Windows file infector that propagates by infecting executable and Web-related files (such as .html, .php or .asp files). Its payload runs as a remote thread inside winlogon.exe, a well-known, critical Windows process. The payload does two things:It infects

Related News

  • W32/Xpaj: Know Your Polymorphic Enemy (September 21, 2009)

    Nowadays, most anti-virus products can deal with viruses relatively easily using a variety of technologies. Decent emulator-based scan engines can handle a majority of polymorphic and metamorphic viruses, including those that use the entry-point obscuring technique (EPO). But when it

  • Creating a Simple Botnet Using the AutoIT Scripting Language (October 14, 2009)

    This post is made on behalf of my colleague Manoj Venugopalan, Malware Analyst for Symantec Hosted Services. AutoIT, a free automation language for Windows platform-based development, is often used for scripting Windows-based applications and sometimes misused for creating malware. AutoIT scripts

  • The Sality Botnet (May 14, 2010)

    As discussed in a previous blog entry, Sality-infected computers become part of a peer-to-peer (P2P) botnet. This botnet is used by peers to exchange lists of URLs pointing to malicious software, which Sality will decrypt, download and install. Though the

  • Security lessons in Zeus botnet raid on UK bank accounts (August 11, 2010)

    The well-read UK security news site The Register is carrying a story detailing how the operators of the Zeus botnet planted their sophisticated malware on thousands of UK bank customers’ computers, stole log-in information then raided the accounts for more

  • Insights into Shutting Down the Virut Botnet (July 22, 2010)

    Virut is a Windows file infector that propagates by infecting executable and Web-related files (such as .html, .php or .asp files). Its payload runs as a remote thread inside winlogon.exe, a well-known, critical Windows process. The payload does two things:It infects

W32/Xpaj Botnet Growing Rapidly

Two weeks ago I blogged about a new virus–W32/Xpaj–found in the wild by McAfee researchers and actively spreading around the world. Since then we have closely monitored the change in spread and severity of the virus, improved generic detection for future W32/Xpaj instances, and added cleaning and proper repair for all the files infected by the virus. Today I want to share more news related to this threat.

Further analysis has revealed some interesting details about the malicious behavior of W32/Xpaj. The Virus is building a widespread “zombie” network, by taking control thousands of Internet-connected computers. The new botnet is in its infancy, although thousands of machines have been infected during last two weeks. The botnet infects computers around the world and has spread across many countries. The attacks are mostly aimed at enterprises, but they have now spread to consumer machines as well. Based on multiple characteristics and our own research, the virus is most probably the work of eastern European cybercriminals.

Most bots are connected to a central location from where one machine can control the entire botnet. W32/Xpaj, on the other hand, deploys several control channels to communicate and control its bots. It employs the same techniques used by Srizbi and Conficker; that is, it uses randomly generated DNS names for backup control servers. Even though W32/Xpaj does not know where the control

Continue reading...


Write a Comment

Copyright © 2010 The Security Blog. All rights reserved.