Malware Hunter — Shodan's Novel Tool To Discovery Malware C&C Servers

Rapidly growing, insecure internet-connected devices are becoming albatross or therefore the necks of individuals in addition to organizations amongst malware authors routinely hacking them to shape botnets that tin move farther used every bit weapons inwards DDoS in addition to other cyber attacks.

But forthwith finding malicious servers, hosted past times attackers, that command botnet of infected machines gets a flake easier. Thanks to Shodan in addition to Recorded Future.

Shodan in addition to Recorded Future convey teamed upwards in addition to launched Malware Hunter – a crawler that scans the Internet regularly to position botnet command in addition to command (C&C) servers for diverse malware in addition to botnets.

Command-and-control servers (C&C servers) are centralized machines that command the bots (computers, smart appliances or smartphones), typically infected amongst Remote Access Trojans or data-stealing malware, past times sending commands in addition to receiving data.

Malware Hunter results convey been integrated into Shodan – a search engine designed to get together in addition to listing information nearly all types of Internet-connected devices in addition to systems.

How Does Malware Hunter Identify a C&C Server?

You powerfulness move wondering how Malware Hunter volition teach to know which IP address is beingness used to host a malicious C&C server.

For this, Shodan has deployed specialized crawlers, to scan the whole Internet to await for computers in addition to devices configured to business office every bit a botnet C&C server past times pretending to move infected reckoner that is reporting dorsum to the command in addition to command server.

The crawler effectively reports dorsum to every IP address on the Web every bit if the target IP is a C&C in addition to if it gets a positive response, in addition to then it knows the IP is a malicious C&C server.

"RATs supply specific responses (strings) when a proper asking is presented on the RAT controller's listener port," according to a 15-page study [PDF] published past times Recorded Future.

"In some cases, fifty-fifty a basic TCP three-way handshake is sufficient to elicit a RAT controller response. The unique reply is a fingerprint indicating that a RAT controller (control panel) is running on the reckoner inwards question."

Malware Hunter Already Identified Over 5,700 Malicious C&C Servers

We gave it a endeavour in addition to institute impressive results, briefly mentioned below:

1. Malware Hunter has already identified over 5,700 command-and-control servers or therefore the World.
2. Top 3 Countries hosting command in addition to command servers include U.S.A. (72%), Hong Kong (12%) in addition to PRC (5.2%).
3. Five pop Remote Access Trojan (RAT) that are widely beingness used include Gh0st RAT Trojan (93.5%), DarkComet trojan (3.7%), along amongst a few servers belong to njRAT Trojan, ZeroAccess Trojan, in addition to XtremeRAT Trojan.
4. Shodan is also able to position C&C servers for Black Shades, Poison Ivy, in addition to Net Bus.

To come across results, all you lot convey to produce is search for "category:malware" without quotes on Shodan website.

Malware Hunter aims at making it easier for safety researchers to position newly hosted C&C servers, fifty-fifty earlier having access to respective malware samples.

This news gathering would also assistance anti-virus vendors position undetectable malware in addition to foreclose it from sending your stolen information dorsum to attacker's command-and-control servers.

Share This :