{"id":24123,"date":"2013-04-23T17:25:28","date_gmt":"2013-04-24T00:25:28","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=24123"},"modified":"2025-06-06T02:12:52","modified_gmt":"2025-06-06T09:12:52","slug":"travnet-botnet-steals-huge-amount-of-sensitive-data","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/travnet-botnet-steals-huge-amount-of-sensitive-data\/","title":{"rendered":"Travnet Botnet Steals Huge Amount of Sensitive Data"},"content":{"rendered":"

In a McAfee Labs blog <\/a>by my colleague Vikas Taneja last month, he discussed high-level functioning in the malware Travnet. Since then we have continued to analyze different samples and now classify Travnet as a botnet rather than a Trojan because of the presence of control code, and the malware’s ability to wait for further commands from the malicious control server.<\/p>\n

The Travnet bot not only steals sensitive information from a victim\u2019s machine; it also steals document files. Generally speaking, we store most of our sensitive information in Office files, PDFs, etc. Using data compression and data-encoding methods allows Travnet to steal huge amount of data including large files.<\/p>\n

The bot at first gathers sensitive information about victim\u2019s machine. Then searches for document files (doc, docx, xls, xlsx, txt, rtf, pdf). Here is snippet of code:\"Travnet_source\"<\/a><\/p>\n

The preceding code includes computer name, IP address, username, operating system, list of running processes, IP config details, and information about different accounts present on the system. The malware creates the file system_t.dll to store this information in plain text. It also creates the file travelbackinfo-(SystemTime).dll, which will be used in an HTTP GET request.<\/p>\n

The data stored in the file can be huge, depending upon running processes and IP config details. The bot will use data compression and encoding methods to send the sensitive data to a remote server. The packet capture looks like this:<\/p>\n

\"Travnet_get_Request\"<\/a><\/p>\n

The bot sends the stolen data with the parameter \u201c&filetext,\u201d which starts with \u201cbegin::.\u201d But the compressed file can be too big to send over the HTTP, so the bot sends the compressed file in chunks of 1,024 bytes. To track this, it uses the parameter \u201c&filestart.\u201d The bot appends the string \u201c::end\u201d to signal the end of the file.<\/p>\n

Data compression and encoding techniques<\/b><\/h2>\n

The bot processes the original data in two passes:<\/p>\n