A case study of the rustock rootkit and spam bot

1st Workshop on Hot Topics in Understanding Botnets, HotBots 2007

Volumn , Issue , 2007, Pages

  Chiang, Ken ^a   Lloyd, Levi ^a  

^a SANDIA NATIONAL LABORATORIES   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNET; CRYPTOGRAPHY; EXTRACTION;

COMMAND AND CONTROL; ENCRYPTION KEY;

MALWARE;

EID: 85093822270     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (16)

1. Paul Bacher, Thorsten Holz, Markus Kotter, and Georg Wicherski, Know Your Enemy: Tracking Botnets, http://www.honeynet.org/papers/bots/, (2005).
2. Paul Barford and Vinod Yegneswaran, An Inside Look at Botnets, http://www.cs.wisc.edu/pb/botnets_final.pdf
3. Nicholas Ianelli and Aaron Hackworth, Botnets as a Vehicle for Online Crime, http://www.cert.org/archive/pdf/Botnets.pdf, (2005).
4. Phatbot Trojan Analysis, LURHQ Threat Intelligence Group, http://www.lurhq.com/phatbot.html, (2004).
5. Sinit P2P Trojan Analysis, LURHQ Threat Intelligence Group, http://www.lurhq.com/sinit.html, (2004).
6. Robert Lemos, Bot software looks to improve peerage, SecurityFocus, http://www.securityfocus.com/news/11390, (2006).
7. Backdoor.Rustock.B, Symantec, http://www.sarc.com/avcenter/venc/ data/backdoor.rustock.b.html, (2006).
8. Spam-Mailbot.c, McAfee, http://vil.nai.com/vil/content/v_140181.htm, (2006).
9. Frank Boldewin, A Journey to the Center of the Rustock.B Rootkit, http: //www.reconstructer.org/papers/ A%20Journey%20to%20the%20Center% 20of%20the%20Rustock.B%20Rootkit. zip, (2007).
10. IDA Pro, http://www.datarescue.com/ idabase
11. The x86 Emulator plugin for IDAPro, Chris Eagle, http://ida-x86emu.sourceforge.net
12. Bruce Schneier, Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition, John Wiley and Sons, New York, NY, (1996).
13. RC4 C source code, http://www.cypherspace.org/adam/rsa/rc4.c
14. Microsoft User Mode Process Dumper, http://www.microsoft.com/downloads/details.aspx?FamilyID=E089CA41-6A87-40C8-BF69-28AC08570B7E& displaylang=en
15. Microsoft windbg, http://www.microsoft.com/whdc/devtools/debugging/ default.mspx
16. Paul Royal, Mitch Halpin, David Dagon, Robert Edmonds, and Wenke Lee, PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware. In Proceedings of the 22nd Annual Computer Security Applications Conference (ACSAC 2006) (December 2006).