Report - CrySyS Lab

Note that the configuration file contains references to two servers (in this case, newslite.org and
bannetwork.org), where one of them is accessed via the FTP protocol. The necessary access
credentials (e.g., FTP username and password) are also given in this configuration file.
TeamViewer communication is used to directly command the victim computer; to investigate screen
captures in real-time. The goal of the newslite.org and similar C&C traffic is to maintain a list of the
TeamViewer ID and password of victim computers and also to monitor the availability, to check
which victims can be controlled currently. The communication to bulbanews.org at the original victim
stopped when the TeamViewer based malware was installed to the victim computer, therefore, this
server was most likely used for an older type of attack.
We collected the recently used IP addresses of victims from all the above mentioned C&C server
databases, but only those addresses, for which we have an IP address later than 2012-09-01. The
results are depicted on the following heat map.
3.3 bannetwork.org databases
Figure 13 – Heat map of all known victims after 2012-09-01
We have investigated the contents of the C&C servers. For some of them, we have partial
information only. We obtained the best view on bannetwork.org, where we found detailed
information related to multiple attack campaigns.
12