2013 Maxim Goncharov

Underground Market 101Maxim Goncharov

2013 Maxim Goncharov

Who am I ?

Max Goncharov 12 years Trend Micro

I live in Munich GermanyResearch and Development

Network Analysis Big Data Processing

Data Streaming Underground Research

Max Goncharov 12 years

I live in Munich GermanyResearch and Development

Network Analysis Big Data Processing

Underground ResearchData Streaming

2013 Maxim Goncharov

gmax.at/101

Underground Research

gmax.at/101

2013 Maxim Goncharov

Manual Information Automated

Data Aggregation and Storage

Underground Research

2013 Maxim Goncharov

2013 Maxim Goncharov

Hide

2013 Maxim Goncharov

VPN bulletproof service

hide personal IP

encrypt communication to C&C and other services

hide identity

encrypt communication to C&C and other services

hide personal IP hide identity

2013 Maxim Goncharov

MuraiNiGel BlackW

2013 Maxim Goncharov

2013 Maxim Goncharov

Select kind of Botnet framework

ccbanks

Zeus Botnet

2013 Maxim Goncharov

2013 Maxim Goncharov

2013 Maxim Goncharov

Botnet price

0

200

400

600

800

2009 2010 2011 2012

Botnet Framework

2013 Maxim Goncharov

Bulletproof hosting

Your servers or/and servers are bulletproof

Hosting provider makes no reaction on abuse requests

It does not really matter if you host porno or C&C

Your servers or/and servers are bulletproof

Hosting provider makes no reaction on abuse requests

It does not really matter if you host porno or C&C

2013 Maxim Goncharov

James McQuaid’s IP list

Russian Business Network RBN

2013 Maxim Goncharov

2013 Maxim Goncharov

Dedicated Server

0

200

400

600

800

2009 2010 2011 2012Botnet FrameworkVPS Server

2013 Maxim Goncharov

Exploit kit

Black Hole

Yang Pack Sweet Orange

Nuclear Pack

PhoenixBlack Hole

Yang Pack

Nuclear Pack

Sweet Orange

Phoenix

Nuclear PackAndromeda

2013 Maxim Goncharov

2013 Maxim Goncharov

Exploit kitPhoenix

2013 Maxim Goncharov

Exploit kitPhoenix

2013 Maxim Goncharov

2013 Maxim Goncharov

Andromeda

Base Version $300Advance Version with firewall bypass $500Source code $7000ICQ 5777677jabber ar3s@dlab.org.in

2013 Maxim Goncharov

Exploit Kit

0

500

1000

1500

2000

2009 2010 2011 2012

Botnet Framework VPS Server ExploitKit

2013 Maxim Goncharov

Domain names for C&C

Your domain names (FQDN) are bulletproof

Almost nobody can bring your domain down

You can keep you privacy hidden

Good for fast-flux domain technics

Your domain names (FQDN) are bulletproof

Almost nobody can bring your domain down

You can keep you privacy hidden

Good for fast-flux domain technics

2013 Maxim Goncharov

2013 Maxim Goncharov

Dropper file and crypt

Cryptor

Malware

Antivirus

Malware

2013 Maxim Goncharov

Cryptor

Malware

Malware

Antivirus UserWeb

Dropper file and crypt

2013 Maxim Goncharov

Dropper file and crypt

Crypt files to make invisible for AV industry

Use self written crypter and stub files

Daily checks on cyber ‘virustotal’ like services

Updates if some of AV vendors detect dropper

Crypt files to make invisible for AV industry

Use self written crypt and stub files

Daily checks on cyber ‘VirusTotal’ like services

Updates if some of AV vendors detect dropper

2013 Maxim Goncharov

Dropper file and crypt

2013 Maxim Goncharov

2013 Maxim Goncharov

Crypt Services

0

500

1000

1500

2000

2009 2010 2011 2012

Botnet Framework VPS Server ExploitKit Crypt Serv

2013 Maxim Goncharov

Injectors and other modules

Pin/Tan grabbers

Injectors for most bank accounts US/DE/UK/FR/ES

Setup maximum of withdrawals limit

Fake the balance amount after grabbin

Pin/Tan grabbers

Injectors for most bank accounts US/DE/UK/FR/ES

Setup maximum of withdrawals limit

Fake the balance amount after grabbin’

2013 Maxim Goncharov

2013 Maxim Goncharov

VPN ServiceBotnet FrameworkBulletproof hostingExploit KitDomain namesDropper file and cryptModules

$25$125

monthly onetime

$0$40

$0$52$38 $120$0 $20

$25$70$80$8

Total: $225 $370Total: $225 $370

Total

2013 Maxim Goncharov

$595$595

2013 Maxim Goncharov

Questions?

2013 Maxim Goncharov

Thanks!