The Srizbi botnet consists of Microsoft Windows computers which have been infected by the Srizbi
trojan horse. This trojan horse is deployed onto its victim computer through the
Mpack malware kit. Past editions have used the "n404 web exploit kit" malware kit to spread, but this kit's usage has been deprecated in favor of Mpack. Apart from this self-propagation, the MPack kit is also known for much more aggressive spreading tactics, most notably the compromise of about 10,000 websites in June 2007. These domains, which included a surprising number of pornographic websites, ended up forwarding the unsuspecting visitor to websites containing the MPack program. Once a computer becomes infected by the trojan horse, the computer becomes known as a
zombie, which will then be at the command of the controller of the botnet, commonly referred to as the botnet herder. The operation of the Srizbi botnet is based upon a number of servers which control the utilization of the individual bots in the botnet. These servers are redundant copies of each other, which protects the botnet from being crippled in case a system failure or legal action takes a server down.
Reactor Mailer The
server-side of the Srizbi botnet is handled by a program called "Reactor Mailer", which is a
Python-based
web component responsible for coordinating the spam sent out by the individual bots in the botnet. Reactor Mailer has existed since 2004, and is currently in its third release, which is also used to control the Srizbi botnet. The software allows for secure login and allows multiple accounts, which strongly suggests that access to the botnet and its spam capacity is sold to external parties (
Software as a service). This is further reinforced by evidence showing that the Srizbi botnet runs multiple batches of spam at a time; blocks of
IP addresses can be observed sending different types of spam at any one time. Once a user has been granted access, he or she can utilize the software to create the message they want to send, test it for its
SpamAssassin score and after that send it to all the users in a list of email addresses. Suspicion has arisen that the writer of the Reactor Mailer program might be the same person responsible for the Srizbi trojan, as code analysis shows a code fingerprint that matches between the two programs. If this claim is indeed true, then this coder might well be responsible for the trojan behind another botnet, named
Rustock. According to
Symantec, the code used in the Srizbi trojan is very similar to the code found in the Rustock trojan, and could well be an improved version of the latter.
Srizbi trojan The Srizbi trojan is the
client side program responsible for sending the spam from infected machines. The trojan has been credited with being extremely efficient at this task, which explains why Srizbi is capable of sending such high volumes of spam without having a huge numerical advantage in the number of infected computers. Apart from having an efficient spam engine, the trojan is also very capable in hiding itself from both the user and the system itself, including any products designed to remove the trojan from the system. The trojan itself is fully executed in
kernel mode and has been noted to employ
rootkit technologies to prevent any form of detection. By patching the
NTFS file system drivers, the trojan will make its files invisible for both the
operating system and any human user utilizing the system. The trojan is also capable of hiding
network traffic it generates by directly attaching
NDIS and
TCP/IP drivers to its own process, a feature currently unique for this trojan. This procedure has been proven to allow the trojan to bypass both
firewall and
sniffer protection provided locally on the system. Once the bot is in place and operational, it will contact one of the
hardcoded servers from a list it carries with it. This server will then supply the bot with a
zip file containing a number of files required by the bot to start its spamming business. The following files have been identified to be downloaded: • 000_data2 - mail server domains • 001_ncommall - list of names • 002_senderna - list of possible sender names • 003_sendersu - list of possible sender surnames • config - Main spam configuration file • message - HTML message to spam • mlist - Recipients mail addresses • mxdata - MX record data When these files have been received, the bot will first initialize a software routine which allows it to remove files critical for revealing
spam and
rootkit applications. After this procedure is done, the trojan will then start sending out the spam message it has received from the control server. == Incidents ==