underground market 101 - power of community · botnet framework bulletproof hosting exploit kit...
TRANSCRIPT
2013 Maxim Goncharov
Underground Market 101Maxim Goncharov
2013 Maxim Goncharov
Who am I ?
Max Goncharov 12 years Trend Micro
I live in Munich GermanyResearch and Development
Network Analysis Big Data Processing
Data Streaming Underground Research
Max Goncharov 12 years
I live in Munich GermanyResearch and Development
Network Analysis Big Data Processing
Underground ResearchData Streaming
2013 Maxim Goncharov
gmax.at/101
Underground Research
gmax.at/101
2013 Maxim Goncharov
Manual Information Automated
Data Aggregation and Storage
Underground Research
2013 Maxim Goncharov
2013 Maxim Goncharov
Hide
2013 Maxim Goncharov
VPN bulletproof service
hide personal IP
encrypt communication to C&C and other services
hide identity
encrypt communication to C&C and other services
hide personal IP hide identity
2013 Maxim Goncharov
MuraiNiGel BlackW
2013 Maxim Goncharov
2013 Maxim Goncharov
Select kind of Botnet framework
ccbanks
Zeus Botnet
2013 Maxim Goncharov
2013 Maxim Goncharov
2013 Maxim Goncharov
Botnet price
0
200
400
600
800
2009 2010 2011 2012
Botnet Framework
2013 Maxim Goncharov
Bulletproof hosting
Your servers or/and servers are bulletproof
Hosting provider makes no reaction on abuse requests
It does not really matter if you host porno or C&C
Your servers or/and servers are bulletproof
Hosting provider makes no reaction on abuse requests
It does not really matter if you host porno or C&C
2013 Maxim Goncharov
James McQuaid’s IP list
Russian Business Network RBN
2013 Maxim Goncharov
2013 Maxim Goncharov
Dedicated Server
0
200
400
600
800
2009 2010 2011 2012Botnet FrameworkVPS Server
2013 Maxim Goncharov
Exploit kit
Black Hole
Yang Pack Sweet Orange
Nuclear Pack
PhoenixBlack Hole
Yang Pack
Nuclear Pack
Sweet Orange
Phoenix
Nuclear PackAndromeda
2013 Maxim Goncharov
2013 Maxim Goncharov
Exploit kitPhoenix
2013 Maxim Goncharov
Exploit kitPhoenix
2013 Maxim Goncharov
2013 Maxim Goncharov
Andromeda
Base Version $300Advance Version with firewall bypass $500Source code $7000ICQ 5777677jabber [email protected]
2013 Maxim Goncharov
Exploit Kit
0
500
1000
1500
2000
2009 2010 2011 2012
Botnet Framework VPS Server ExploitKit
2013 Maxim Goncharov
Domain names for C&C
Your domain names (FQDN) are bulletproof
Almost nobody can bring your domain down
You can keep you privacy hidden
Good for fast-flux domain technics
Your domain names (FQDN) are bulletproof
Almost nobody can bring your domain down
You can keep you privacy hidden
Good for fast-flux domain technics
2013 Maxim Goncharov
2013 Maxim Goncharov
Dropper file and crypt
Cryptor
Malware
Antivirus
Malware
2013 Maxim Goncharov
Cryptor
Malware
Malware
Antivirus UserWeb
Dropper file and crypt
2013 Maxim Goncharov
Dropper file and crypt
Crypt files to make invisible for AV industry
Use self written crypter and stub files
Daily checks on cyber ‘virustotal’ like services
Updates if some of AV vendors detect dropper
Crypt files to make invisible for AV industry
Use self written crypt and stub files
Daily checks on cyber ‘VirusTotal’ like services
Updates if some of AV vendors detect dropper
2013 Maxim Goncharov
Dropper file and crypt
2013 Maxim Goncharov
2013 Maxim Goncharov
Crypt Services
0
500
1000
1500
2000
2009 2010 2011 2012
Botnet Framework VPS Server ExploitKit Crypt Serv
2013 Maxim Goncharov
Injectors and other modules
Pin/Tan grabbers
Injectors for most bank accounts US/DE/UK/FR/ES
Setup maximum of withdrawals limit
Fake the balance amount after grabbin
Pin/Tan grabbers
Injectors for most bank accounts US/DE/UK/FR/ES
Setup maximum of withdrawals limit
Fake the balance amount after grabbin’
2013 Maxim Goncharov
2013 Maxim Goncharov
VPN ServiceBotnet FrameworkBulletproof hostingExploit KitDomain namesDropper file and cryptModules
$25$125
monthly onetime
$0$40
$0$52$38 $120$0 $20
$25$70$80$8
Total: $225 $370Total: $225 $370
Total
2013 Maxim Goncharov
$595$595
2013 Maxim Goncharov
Questions?
2013 Maxim Goncharov
Thanks!