The gradual increment in botnet developing is intresting, and this time "SqUeEzEr" (Scott Van Dinter, a Young boy of 18 years old, as some of his online profiles say) comes into the scene with a botnet developed in VB6, with some inline ASM in it.
The botnet works under Ring3, something that makes the detection process easier. It was tested under Windows XP, Windows Vista and Windows 7.
ActiveX Startup. An already well-known startup method.
Advanced Anti-Checking. -Different threads with continuous checks. 10 different methods
Attacking. As every botnet that serves to its purposes, it has a DDOS system that Works with TCP Connections and runs in the background.
Firewall Bypass. Add's itsself to the windows firewall. Unhooks ring3 firewall hooks
Process Protection. An advanced protection system will keep the process from being closed
File Protection. Strike is protected from deletion, even if the process is not running. Can't even be deleted by Rootkit Unhooker
Serial Stealing. Strike can steal the windows serial code, and more than other 200 serials.
Sockets. Strike uses API sockets to connect with the web interface (That means that it doesn’t use the well-known Winsock). It also uses the http protocol to bypass firewalls.
Spreading. Strike has the ability to spread itsself into every compressed folder (zip/rar) on the infected computer.
MSN Passwords. Strike is able to steal stored MSN passwords.
Internet Explorer. Strike is also able to steal Internet Explorer passwords.
Update. A very interesting feature, with this function Strike is also able to download a newer version and update itself.
- Exit, you can terminate strike with this command
- Melt, Strike can be fully removed from a computer (It doesn’t match with the "common" definition of “Melting”)
- Bsod, Strike can trigger a Blue Screen of Death
- Kill, Strike can delete files on the computer
- Exec, Execute files on the victims computer
- Down, Strike can download files from the web by using the HTTP protocol and can then execute them
At last, Strike is FUD (Fully Undetectable) at compile-time (so, it doesn’t use crypting). The autor says that a video demonstration will be probably up within one week.
Malware Researcher en MalwareIntelligence