THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

THE KORDLLBOT BACKDOOR FAMILY
KorDllbot is a family of small/medium size trojans that usually are configured to be installed as services.
Samples can vary a great deal in functionality - from just listening on a port and accepting commands, to harvesting
data, to actively spreading over SMB. This functionality seems almost modular, using different encryption and
encoding methods and different C&C command words. Build environment for the early generations was typically
Visual Studio 6.
KorDllbots use C&C commands starting at different integer offsets depending on version. Here, versions 1.1/1.2/1.5,
1.03, 1.04.2 and 1.05.2 sending success or error status back to remote control client after file deletion.
Common capability seen in the KorDllbot family is:
- Get bot status
- List logical drives
- List directory
- Change directory
- Get process list
- Kill process
- Execute file
- Delete file
- Change file time
- Execute shell command
- Download file
- Upload file
- Get volume serial number
- Get file attributes
Most of these trojans use encrypted or encoded C&C communication, but the algorithms vary between versions.