Note: Updates are available at the bottom of this article.
Ozdok a.k.a Mega-d is one of those botnets that has been very successful flying under the radar over the past few years. Recent stats by Marshal TRACE show Ozdok is currently responsible for about 4.2% of the world's overall SPAM. The question that arises again is who are the guys controlling this botnet, and more importantly from where? I recently conducted a detailed study of Ozdok's active command and control servers. There are two main things I took away from this study.
1. The USA is still a first choice for bad guys when it comes to hosting CnC servers.
2. After the McColo experience, these guys are no longer relying on a single net block for hosting their CnCs. To further ensure their safety, most botnets today are equipped with a fallback mechanism. As a matter of fact, in the case of Ozdok, there is more than one fallback mechanism involved. These come into play once the primary command and control structures fall apart. How? I'll explain that shortly.
Here is geo-locations of the Ozdok command and control servers based on last few months data:
| Sr. | IPs | ISP | Location |
|---|---|---|---|
| 1 1 | 72.21.32.138 72.232.161.250 72.232.229.114 72.21.32.138 72.232.161.250 72.232.229.114 |
LAYERED TECHNOLOGIES INC LAYERED TECHNOLOGIES INC | TEXAS, USA TEXAS, USA |
| 2 2 | 96.9.186.181 66.197.143.133 66.197.221.117 96.9.186.181 66.197.143.133 66.197.221.117 |
NETWORK OPERATIONS CENTER INC NETWORK OPERATIONS CENTER INC | PENNSYLVANIA, USA PENNSYLVANIA, USA |
| 3 3 | 174.139.0.226 98.126.44.146 174.139.16.50 98.126.17.114 174.139.0.226 98.126.44.146 174.139.16.50 98.126.17.114 |
VPLS INC. D/B/A KRYPT TECHNOLOGIES VPLS INC. D/B/A KRYPT TECHNOLOGIES | CALIFORNIA, USA CALIFORNIA, USA |
| 4 4 | 79.135.168.110 79.135.168.110 | SISTEMNET TELEKOMUNIKASYON VE BILGI TEK. TIC. LTD. STI SISTEMNET TELEKOMUNIKASYON VE BILGI TEK. TIC. LTD. STI | TURKEY TURKEY |
| 5 5 | 64.202.189.170 64.202.189.170 | GODADDY.COM INC GODADDY.COM INC | ARIZONA, USA ARIZONA, USA |
| 6 6 | 208.100.29.107 (not currently active) 208.100.29.107 (not currently active) | NOZONE INC NOZONE INC | CHICAGO, USA CHICAGO, USA |
| 7 7 | 66.90.101.194 66.90.101.194 | FDCSERVERS.NET FDCSERVERS.NET | ILLINOIS, USA ILLINOIS, USA |
| 8 8 | 76.191.98.245 76.191.98.245 | SENTRIS NETWORK LLC SENTRIS NETWORK LLC | WASHINGTON, USA WASHINGTON, USA |
| 9 9 | 62.90.134.24 62.90.134.24 | ADPERFORM ADPERFORM | TEL AVIV, ISRAEL TEL AVIV, ISRAEL |
The stats above clearly show that these servers are wide spread across the USA. Only two command server were found to be located outside the USA. So does it mean that shutting these servers down would result in a complete botnet shut down? Keeping in view Ozdok's multi layered fallback mechanism the answer here is 'no'.
Here is Ozdok's command and control structure.
1. A majority of Ozdok variants use domain names to locate their command servers. Samples seen so far by me had a complete list of domains embedded in the malware body. In case one domain fails, it will move to the next one.
Bad news:
--------------
Shutting down the back end servers will not have a long term effect on this botnet. If these servers are ever taken down, the bot herders would move their command servers to some other net block.
2. All the new samples have a hard coded list of custom DNS servers. Each domain in the list will first be resolved through host configured DNS servers. In case of failure, Ozdok will try to resolve it using a hard coded list of NS servers. If it still fails, it will move to the second domain in the list and repeat the same process.
More Bad News:
-------------
If these domains are taken down with the registrars help, custom DNS severs will come into play for supplying new CnC hosts.
3. In case all the hard coded domains and custom NS servers are taken down. Ozok will fall-back to its final nefarious trick. Newer samples are equipped with a domain generation algorithm. In case all fallback mechanisms fail, Ozdok has the ability to generate one random domain per day. This domain is generated based on the current date and time.
Even More Bad News:
------------
Unless someone is committed enough to pre-register those domains, the bot herders can always come forward and register those domains and take botnet control back.
Figure 1
Figure 2
4. There is one more fallback mechanism which most of modern malware like Ozdok follow now a days, and that is BotnetWeb. For a refresher here is how I define BotnetWeb.
"A collection of heterogeneous Botnets being operated in
conjunction with each other controlled by one or more closely linked
cyber criminal group(s)"
As a matter of fact, during the past many months I have seen Ozdok being a sub download of many other known malware such as Trojan.Piptea. Historic data shows that most of the time Ozdok is dropped onto pre-infected machines as a spam component together with other malware, each dedicated to a particular job.
Can't be worst than this:
------------
In case all other fallback mechanisms fail there is always a chance that bot herders will move their reserve troops (top level malware) forward and may drop an updated version onto the infected machines pointing to a completely different address space.
Here is the complete list of constant domains (45) with their currently resolved IPs. 'Not Found' means that domain currently is not pointing to any IP address.
yokserezantia.net <-> 72.232.161.250
poelzmdayl.com <-> Not Found
resonabhuy.kz <-> Not Found
nayzielzp.biz <-> Not Found
ajzplrakzui.org <-> Not Found
zmcby6vg.biz <-> Not Found
grezasadaf.info <-> 66.197.221.117
billibonskanzas.com <-> 72.232.229.114
yankdream.info <-> Not Found
yopilazankaza.net <-> 174.139.16.50
zavaretalies.com <-> 98.126.17.114
verissimocafe.kz <-> Not Found
jabrastatic.inf0 <-> Not Found
milfifezaboq.org <-> Not Found
galileoboots.info <-> Not Found
foodcaters.info <-> 72.232.161.250
gondolfrazrv3.com <-> 72.232.161.250
wikirocksa.info <-> Not Found
raffaellopaolino.net <-> Not Found
micralokp.biz <-> Not Found
kuport.com <-> 64.202.189.170
skiloper.net <-> Not Found
typirew.org <-> Not Found
hakasimq.info <-> Not Found
blagoinc.info <-> Not Found
miraklegroup.info <-> Not Found
mirexint.biz <-> Not Found
alfaharpun.org <-> Not Found
greatpunnett.com <-> Not Found
yourwaybaskets.com <-> Not Found
jamfzuyqyra.com <-> 98.126.44.146
admzjyda.biz <-> Not Found
beztakrezt.info <-> Not Found
mkzyajiujoiq.info <-> Not Found
mazerattikrak.info <-> Not Found
pilimerkazana.biz <-> 72.232.161.250
jopiterazania.net <-> Not Found
upoyansa.com <-> Not Found
hotopikalar.info <-> Not Found
iztep14mrkde.info <-> Not Found
grezasadaf.info <-> 66.197.221.117
xul93.pubdomainstr.com <-> 62.90.134.24
greatpunnett.com <-> Not Found
cristymisty.info <-> Not Found
Live = 13, Dead = 32
Auto generated domains for the last few days look like this:
io7grec9merhpzga.org
g8nolnusu5tveruo.org
b7znmw6skpsorjkp.org
After seeing all these fallback mechanisms, it doesn't look very easy to kill Ozdok in one go but hurting this beast might not be that difficult. Sudden shutdown of the current CnC host will cause the bot herders to loose important logistics and valuable data. This shutdown might also earn infected machines some time to disinfect themselves. Above all, it will be another gestures to show the bad guys that the security industry is awake and keeping a close eye on them.
Update 1: We just got a response from 'Go daddy' authorities that 64.202.189.170 is actually a forwarding server and is not directly under control of the bot herders. But then why is the ozdok domain, kuport.com, still pointing to it? This is something which I don't have any explanation for at the moment.
Atif Mushtaq @ FireEye Malware Intelligence Lab
Detailed Question/Comments : research SHIFT-2 fireeye DOT COM
