Beebone Malware: FBI Praises Cooperation With Dutch Cyber Cops

The FBI is proud to work with the High Tech Crime Team (THTC) of the Dutch police that this week along a botnet pulled off the air. It was a joint operation of the THTC, the FBI, Europol and various security companies was against the malware, which in the press releases of the various investigative services Beebone or AAEH was mentioned.

However, the malware also known as Vobfus and Changeup, Symantec, so let know . It is a worm that first appeared in 2009 and spread through the Autorun feature of Windows. A year later, the worm used the LNK vulnerability allowing the Stuxnet worm spread knew. There were also social engineering used by Changeup.

Working of Beebone Malware

On infected USB drives and network folders worm placed a copy of itself with the names Porn.exe, Sexy.exe, Passwords.exe and Secret.exe and created the executable files with the names of all existing files. These files have a folder icon, so it seemed like it was a folder. Since Windows file extensions by default does not show users could thereby unintentionally activate the malware.

Additional malware

Changeup active once installed all sorts of malware, including malware that tried Internet banking data and passwords to steal, as well as fake virus scanners and ransomware, according to the FBI. The US investigation service went to court with a request to take up 100 domain names that use the botnet to communicate with infected computers. Something the judge gave permission. Then the investigative services were these domains to the servers of Internet providers and Computer Emergency Response Teams (CERTs) of views on the world.

"Botnets as Beebone have made ​​all over the world victims, which shows why a joint approach to global investigative services with the private sector is so important. The FBI is proud to cooperate in the fight against botnets with our partners in the European Cybercrime Centre of Europol, the Joint Action Cybercrime Task Force (J-CAT) and the Dutch High Tech Crime Team, " said FBI Assistant Director Joseph Demarest.

Fanny Malware: "11.000 Computers Precursor Stuxnet Infected"

Still 11,000 computers worldwide are infected with a sophisticated worm that was developed in 2008 and is considered the forerunner of the infamous Stuxnet worm. The Fanny worm was yesterday already revealed by Kaspersky Lab, and today there are more details disclosed.

The worm used two zero-day vulnerabilities in Windows to spread via USB sticks. Connecting an infected USB drive on a Windows computer, even if it is disabled Autorun, was enough to get infected. The worm the LNK vulnerability used in this case that later was used by the Stuxnet worm. The second vulnerability used Fanny made sure that the malware had administrator rights. The vulnerabilities were patched by Microsoft in 2009 and 2010.

Although Stuxnet known as the first malware that used the LNK vulnerability, a Trojan horse in 2010 it was discovered that already spread through the leak. It was the Zlob Trojan, part of a large family of malware. However, no one paid attention given to this instance of malware in the anti-virus industry. The makers of Fanny used a common method to load the malware while starting Windows, making the creation as Zlob was detected.

Indeed, it was a registry value created to start automatically. According to researchers, the malware writers have done this deliberately, so as automatic control of anti-virus companies and researchers to lead the garden. That would detect the malware and namely because of the widely used starting technique, pay no further attention. Therefore, the deeper operation and functionality of Fanny remained hidden.

The main functionality of the worm is in the mapping of systems and networks that are not connected to the Internet. Where Stuxnet worked only on specific systems, Fanny infected all Windows computers where it landed. Not only could easily infect the worm computers. Once USB drives were connected to an infected computer, which also became infected and could spread the worm further.

The researchers knew the Command & Control server that the attackers used to control infected computers take over. In total still made 11,200 unique IP addresses connecting to this server. Sixty percent of it comes from Pakistan, followed by Indonesia (16%) and Vietnam (14%). Whether Pakistan was the original target of Fanny is unknown. The situation may be different when the worm was used between 2008 and 2010. However, the researchers note that the group that Fanny has also developed other malware made that it had provided to Pakistan.

However, the real targets of Fanny is unknown, say the researchers. Possible that the worm is used to select potential targets for Stuxnet. Another remarkable fact is the large number of infections in Pakistan. The use of USB drives is indeed a slow diffusion method. Therefore, the researchers also think that the first infections occurred in Pakistan.