Danmec Bot, Fast-Flux networks and recruitment of Zombies PCs

Danmec, or Asprox, is called a trojan designed to recruit zombie machines while collecting information for each of the victims infected.

While the appearance of this trojan isn't new, it's now worth more complex strategies that typically used by other malicious code, including its early variants, such as the Fast-Flux to avoid detection by blocking programs and infect as many computers as possible.

Today, Fast-Flux networks are massively exploited and thousands of active domains of Russian origin, such as activating again botnets created by Danmec.

google-analitycs.lijg .ru
fmkopswuzhj .biz
fnygfr .com
fvwugekf .info
fwkbt .info
gbrpn .org
gbxpxugx .org
ghtileh .biz
gnyluuxneo .com
fuougcdv .org
www. dbrgf .ru
www. bnmd .kz
www. nvepe .ru
www. mtno .ru
www. wmpd .ru
www. msngk6 .ru
www. vjhdo .com
www. aspx37 .me
google-analitycs.dbrgf .ru
www. advabnr .com
www. lijg .ru
www. dft6s .kz

Each of these domains hosting the following script written in JavaScript called script.js (MD5: ccec2c026a38ce139c16ae97065ccd91), which runs from a Drive-by-Download:

This call through the iframe tag is made to a URL that is part of a Fast-Flux network.

, google-analitycs.lijg.ru. IN A

;; ANSWER SECTION:
google-analitycs.lijg.ru. 600 IN A 68.119.39.129
google-analitycs.lijg.ru. 600 IN A 69.176.46.57
google-analitycs.lijg.ru. 600 IN A 71.12.89.233
google-analitycs.lijg.ru. 600 IN A 76.73.237.59
google-analitycs.lijg.ru. 600 IN A 97.104.40.246
google-analitycs.lijg.ru. 600 IN A 98,194,180,179
google-analitycs.lijg.ru. 600 IN A 146.57.249.100
google-analitycs.lijg.ru. 600 IN A 151,118,186,131
google-analitycs.lijg.ru. 600 IN A 165.166.236.74
google-analitycs.lijg.ru. 600 IN A 173.16.99.131
google-analitycs.lijg.ru. 600 IN A 173.17.180.79
google-analitycs.lijg.ru. 600 IN A 24,107,209,119
google-analitycs.lijg.ru. 600 IN A 24,170,188,201
google-analitycs.lijg.ru. 600 IN A 68.93.61.194

;; AUTHORITY SECTION:
lijg.ru. 339897 IN NS ns3.lijg.ru.
lijg.ru. 339897 IN NS ns2.lijg.ru.
lijg.ru. 339897 IN NS ns1.lijg.ru.
lijg.ru. 339897 IN NS ns5.lijg.ru.
lijg.ru. 339897 IN NS ns4.lijg.ru.

;; Query time: 263 msec
;; SERVER: 192.168.240.2 # 53 (192.168.240.2)
;; WHEN: Sun Jan 25 20:31:57 2009
;; MSG SIZE rcvd: 356

While each of the web addresses above lines form a new farm Fast-Flux networks with groups of IP addresses mirrors.

Fast-Flux is an advanced technique used for malicious purposes, together with others, for the spread of various threats. This means be cautious at all times.

# Jorge Mieres