Post on 29-Jan-2022
!
!
!
!
!
!
!!!!!!!!
!
!! !
!2015( !
!!
! !
1!
!! !
4 1 ! oh
uj
oh uj R
n BC . :(C&C)
.hk . !
!
HKCERT H 4
M oh 6 oh IP
BC uj n t
— uj uj !
HKCERT- Information!Feed!Analysis!System!(IFAS)! m uj
v uj ! ( 1)! s S
!
I uj T uj
!
oh ! T !
n
BC . !
!
N 6 u !
:
(C&C)!
!
N 6 IP u !
!
!
N 6 IP
u !
!
!
2!
!
I uj S n I
ujn I hkcert@hkcert.org I
C !
!
!
uj Z m y m y.
uj
!
!
: w uj
, j Z :
uj G d :
!
!
X !
Z ! CC! ! 4.0! !X HKCERT
!
http://creativecommons.org/licenses/by/4.0/!
!
! !
3!
! !!
� !..................................................................................................................................!4!
!
uj!................................................................................................................................!11!
1.! n!..........................................................................................................!11!
1.1! uj !....................................................................................................!11!
2.! !..........................................................................................................!13!
2.1! uj !....................................................................................................!13!
3.! BC . !..................................................................................................!15!
3.1! uj !....................................................................................................!15!
4.! !..........................................................................................................!17!
4.1! :(C&C)!...........................................................................!17!
4.2! !....................................................................................................!18!
!
!........................................................................................................................................!20!
1!– v !..........................................................................................................!20!
2!– y !..........................................................................................!20!
3!– !..................................................................................................!21!
!
4!
� !
(
!
( ohuj uj
m Nm p
!
1!–3
!
99% 10,851 2013( w
!
!
:!BC . n
:!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!1
! IFAS!S!Information!Feed!Analysis!System(IFAS)! HKCERT!- m
uj !
2
! 1!S v !
3
!u t n !
16,589!
18,087!
12,437!
10,936!
21,787!
Q2!2014 Q3!2014 Q4!2014 Q1!2015 Q2!2015
Unique!security!events
������
5!
!
2!–4
!
u 2015( 7 5,867 16,338
BC . w !
noh u 9 5% A oh BC . oh
168% 412% !
) oh oh
L oh
N oh H oh
u
! !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!4
!u t n !
4,522!
2,926!
1,644! 1,604! 1,692!
2,557!
3,048!
1,883!2,934!
7,836!
1,561!
5,760!
2,735!1,329!
6,810!
S
2,000!
4,000!
6,000!
8,000!
10,000!
12,000!
14,000!
16,000!
18,000!
Q2!2014 Q3!2014 Q4!2014 Q1!2015 Q2!2015
Malware!
hosting!
����
�
Phishing!
�"��
Defacement!!!
�!�
6!
BC . 41% 2828 HTML/Drop.Agent.ABBC .
BC . Ramnit !
!
3SHTML/Drop.Agent.AB !
7 3 HTML/Drop.Agent.AB Ramnit
Ramnit 5 Ramnit BC .
BC . 5 8 I
!
!
G .
!! w . w
!! w G . a w
!! U M
!! M G .
!! 0
!! ?
!
!
!
:(C&C)! ! ! ug 0 ─
T 2 ! !
! ! m :(C&C)! T
2 !
0
200
400
600
800
1000
1200
1400
1600
2015S01 2015S02 2015S03 2015S04 2015S05 2015S06
HTML/Drop.Agent.AB ��
7!
!
: !
:(C&C) :!
!
4!– :(C&C) !
!
: u S !
!
4! : Zeus :
IRC : !
!
!
:!
2!
5!
3!
4! 4!
Q2!2014 Q3!2014 Q4!2014 Q1!2015 Q2!2015
:(C&C)
Botnet!(C&Cs)
��������(C&C)
8!
!
!
5!S !
!
9 2014( !
!
2015( D u 8% Virut 87%
ZeusH ! ( 14)! !
H
( 13)!
Ramnit!
Ramnit rD v R Fj FTP
Fj cookies oh i
BC . !
Ramnit 2010( cs D5
R 9 i Ramnit g
Ramnit H !
Ramnit D oh FTP
sf !
!
Tinba!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!5
! http://www.symantec.com/connect/blogs/ramnitScybercrimeSgroupShitSmajorSlawSenforcementSoperation!
7947
63486172
5065
5445
Q2!2014 Q3!2014 Q4!2014 Q1!2015 Q2!2015
Trend!of!Botnet!(Bots)!security!events
( )
Botnet!(Bots)
�� �
9!
. oh Fj
( M 5 V 6
P 7
M n
.
4
oh sf
. (H u 8
M
M M T
P 5 M
M 33 H 5 s.
x oh M d
P 9 P
:u g : .
k : g : P
q H BC
.
sf
!! w . w
!! q W_
!! 0
!!
!! w
2013( 6 : m G
)
R
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!6
! https://blog.avast.com/2014/09/15/tinySbankerStrojanStargetsScustomersSofSmajorSbanksSworldwide/!
7
! https://www.fSsecure.com/weblog/archives/00002810.html!
8
! http://securityintelligence.com/dyreSwolf/!
9
! http://www.seculert.com/blog/2015/04/newSdyreSversionSevadesSsandboxes.html!
10!
: BC .D
S
!
T/
!! T/
! !
11!
uj!
1.! n!
1.1! uj !
!
6!–! n10
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!10
u t n !
4522
2926
1644 16041692
683 654478 441
569
Q2 Q3 Q4 Q1 Q2
n
Unique!URL!
���
Unique!IP
��IP
n
!! n X ohy n
2
!! t
!!
!! g d
!! oh
12!
!
!
7!–! n /IP !
!
!
v :! !
!! ZoneSH! !
! !
6.62!
4.47!
3.44!3.64!
2.97!
Q2 Q3 Q4 Q1 Q2
n /IP
URL/IP!ratio
���/IP�
! ! /IP !
!! u IP
u !
!
!! u u
4 !
!! IP u u !
!! !
13!
2.! !
2.1!uj !
! ! !
8!–! !
2557
3048
1883
2934
7836
443 354 280 208373
Q2 Q3 Q4 Q1 Q2
Unique!URL
���
Unique!IP
��IP
!!
2
!! v d
!!
!! g d
!! oh
14!
!
!
9!–! /IP !
!
!
v :! !
!! ArborNetwork!–!Atlas!SRF! !
!! CleanMX!–!phishing! !
!! Millersmiles! !
!! Phishtank! !
! !
5.77!
8.61!
6.73!
14.11!
21.01!
Q2 Q3 Q4 Q1 Q2
/IP
URL/IP!ratio
���/IP�
! ! /IP !
!! u IP
u !
!
!! u u
4 !
!! IP u u !
!! !
15!
3.! BC . !
3.1!uj !
!
! !
10!–!BC . !
!
1561
5760
2735
1329
6810
351 408603
391664
Q2 Q3 Q4 Q1 Q2
BC .
Unique!URL
���
Unique!IP
��IP
BC .
!! BC . sfBC .
2
!! BC . BC .
!!
!! g d
!! oh
16!
!
11!–!BC . /IP !
!
!
!
!
v :!
!! Abuse.ch:!Zeus!Tracker!–!Binary!URL! !
!! Abuse.ch:!SpyEye!Tracker!–!Binary!URL!
!! CleanMX!–!Malware! !
!! Malc0de! !
!! MalwareDomainList! !
!! Sacour.cn!
! !
4.45!
14.12!
4.54!
3.40!
10.26!
Q2 Q3 Q4 Q1 Q2
BC . /IP
URL/IP!ratio
���/IP�
! ! /IP !
!! u IP
u !
!
!! u u
4 !
!! IP u u !
!! !
17!
4.! !
4.1! :(C&C)!
! !
!
12!–! ( :) !
!
!
v :!
!! Zeus!Tracker! !
!! SpyEye!Tracker! !
!! Palevo!Tracker! !
!! Shadowserver!–!C&Cs! !
1
2 2
3 31
3
1
1 1
0
1
2
3
4
5
6
Q2 Q3 Q4 Q1 Q2
:
HTTP
IRC
:
!! : ─
BC ? ? s.
x oh
2
!! 4
!! m uj
18!
4.2! !
4.2.1! 11!
IP u
b N
G N u !
!
!
!
! "#! !
IP !
( u )!
!
1! S! Conficker! ! 2,083! ! S5%!
2! "! Virut! ! 1,101! ! 87%!
3! # Zeus! ! 765! ! S25%!
4! S ZeroAccess! ! 523! ! S8%!
5! S! Pushdo! ! 352! ! S4%!
6! NEW! Ramnit! ! 146! ! NA!
7! NEW! Tinba! ! 94! ! NA!
8! # Citadel! ! 91! ! S13%!
9! NEW! Dyre! ! 55! ! NA!
10! " Wapomi! ! 25! ! S22%!
13!–! u !
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!11
T S uj !
2,083!
1,101!
765!523!
352!
146!
94!
91!
55!
54!
Conficker
Virut
Zeus
ZeroAccess
Pushdo
Ramnit
Tinba
Citadel
Dyre
19!
!
14!–12!
!
v :!
!! ArborNetwork!–!Atlas!SRF!–!conficker! !
!! ShadowServer!–!botnet_drone!
!! ShadowServer!–!sinkhole_http_drone!
!! ShadowServer!–!Microsoft_sinkhole!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!12
! Virut u t!
Q2!2014 Q3!2014 Q4!2014 Q1!2015 Q2!2015
Conficker 2945 2597 2419 2185 2083
Virut 277 263 559 588 1101
Zeus 2512 1897 1472 1020 765
ZeroAccess 1407 1062 838 569 523
Pushdo 211 63 406 367 352
0
500
1000
1500
2000
2500
3000
3500
!! H u –
BC .D H D 5 BC . y
6 T oh
2
!!
!! v d
!! T BC sfBC . s.
x oh
20!
��!
1!– v !
v :!
oh v
n
BC .
BC .
BC .
BC .
BC .
BC .
:
:
:
:
!
!
!!
2!– y !
I Z y y !
!
y w
!!!
21!
3!–
!
D y oh2
BankPatch! !!MultiBanker!
!!Patcher!
!!BankPatcher!.
!! H !
!!
!
!! !
!! !
!!
M
v rD uj!
BlackEnergy!
.
!! rootkitP S !
!! P !
!!g 0 P
!
!! s. x o
h(DDoS)!
Citadel!
.
!!
!
!
!! v
rD v!
!!U !
!!K l !
!! l !
!! oe!
!! !
Conficker! !!Downadup!
!!Kido!
!! E !
(DGA)! !
!! P2P !
!! !
!! Window
MS08S067 !
!!
f!
!! Window
(autoSrun)
f!
Dyre! !
.
!! ! !!
v!
!! ─ !
Gamarue! !!Andromeda! !! oh !
!! !
!!9 Word !
!! !
!! rD !
!! X !
!! BC .!
22!
Glupteba! ! . !! .
(driveSbySdownload)D
!
!! ─ !
!! h S!
IRC!Botnet! . !! IRC ! !!5 . X
!
!! s. x o
h(DDoS)!
!! ─ !
Palevo! !!Rimecud!
!!Butterfly!
bot!
!!Pilleuz!
!!Mariposa!
!!Vaklik!
!! ,!
!
!!5 . X
!
!! v r
D v!
!! O
!
Pushdo! !!Cutwail!
!!Pandex!
!! BC !
!! E !
(DGA)! !
!! .
(driveSbySdownload)D
!
!! a !
!!
BC .( :!Zeus!
! Spyeye)!
!! s. x o
h(DDoS)!
!! ─ !
Ramnit! ! !!D !
!! oh !
!! FTP !
!!5 . X
!
!! v r
D v!
Sality! . !! rootkitP S !
!! P2P !
!!
f!
!! !
!! E
Entry!Point!
Obscuring P D
!
!! ─ !
!! !
!! rD v!
!!D /
!
!! BC .!
23!
Slenfbot! !!
f!
!
!!5 . X
!
!!
BC .!
!! s. x o
h(DDoS)!
!! ─ !
Tinba! !!TinyBanker!
!!Zusy!
! .
!! oh !
!! !
!! v r
D v!
Torpig! !!Sinowal!
!!Anserin
. !! rootkitP S !
(Mebroot!rootkit)!
!! E !
(DGA)! !
!! .
(driveSbySdownload)D
!
!! rD v!
!! oe!
Virut! ! . !!
f!
!
!! ─ !
!! s. x o
h(DDoS)!
!! !
!! v!
!!!
Wapomi! !!
f!
!!D !
!!5 . X
!
!! BC .!
!!n
!
!!m uj
v
q !
24!
ZeroAccess! !!max++!
!!Sirefef
. !! rootkitP S !
!! P2P !
!! .
(driveSbySdownload)D
!
!! H q ( :
keygen)!
!! BC .!
!!Z & h!
Zeus! !!Gameover
.
!! P !
!! .
(driveSbySdownload)D
!
!! P2P !
!
!! v
rD v!
!! oe!
!!U !
!! BC .( :!
Cryptolocker)!
!! s. x o
h(DDoS)!
!