Ramnit Malware Creates FTP Network From Victims’ Computers

This blog post was written by Vikas Taneja.

The Ramnit worm appeared in 2010. Within a year more than eight million PCs were infected worldwide. Initially the malware was just file infector spread by removable drives. Later it became better know for stealing user data via browser injection, targeting banking or game users.

While reviewing the malware recently, we found new samples with active domains.

Ramnit is still prevalent and old domains are regularly updated. Some of the domains have already been “sinkholed” (redirected to communicate only with a controlled server and not with its malicious developers) by other security researchers.

Apart from its typical malware characteristics (infecting .exe/html files, hooking Internet Explorer process) Ramnit sets up an FTP server on a victim’s machine. That FTP server becomes part of the RMNetwork FTP.

This FTP server supports following commands:

USER, PASS, CWD, CDUP, QUIT, PORT, PASV, TYPE, MODE, RETR, STOR, APPE, REST, RNFR, RNTO, ABOR, DELE, RMD, MKD, LIST, NLST, SYST, STAT, HELP, NOOP, SIZE, EXEC, and PWD.

Using these commands attackers can control the machine remotely, steal other sensitive files, and execute other malicious files. Infected machines that are firewalled or sit behind network address translation cannot “join” RMNetwork FTP, but they can communicate with the control server using TCP port 443 or 447 with custom encryption.

By looking at the malware’s domain names, they seem to be created a domain generation algorithm. However, these active domains are hardcoded in the binary. This means new binaries are being created with the malware’s builder tool and are spreading by other malware or phishing scams. These domains are encrypted using the XOR algorithm with different keys for every sample.

McAfee customers are already protected from this threat.