427 Botnet fm qxd

www.syngress.com
382
Chapter 10 • Using Sandbox Tools for Botnets
427_Botnet_10.qxd 1/9/07 3:06 PM Page 382

---

subtypename="INETCOMM Server Passwords"/>
subtypename="INETCOMM Server Passwords"
itemname="mail.microsoft.com5E3655B0"/>

subtypename="Identities"/>
subtypename="Identities" itemname="IdentitiesPass"/>

subtypename="Internet Explorer"/>
subtypename="Internet Explorer"
itemname="http://www.gmx.net/de/:StringData"/>
Bot-Related 
Findings of Our Live Sandbox
We have been running a live sandbox system at the University of Mannheim, in
Germany, which consists of four CWSandbox hosts and uses a MySQL database
as repository. New samples can be submitted via the Web interface at
www.cwsandbox.org, but many people use scripts to transmit files automati-
cally. In the last few months we have successfully analyzed a total of 11,965
unique malware samples. Inside this set, CWSandbox has detected 1283 pro-
grams that have successfully established an IRC connection to a remote host.
From those, 108 did not follow an RFC conforming protocol but a slightly
modified variant instead. Furthermore, of the others, 40 did send a TCP packet
with data such as 
NICK (null)abcdef
without having a connection established.
Those probably are badly designed applications
1
or some other unforeseen error
occurred during their execution. Anyway, we can assume that these also are
applications that implement some form of IRC communication. Finally, 492 of
the rest tried to connect to a TCP server on port 6665, 6666, or 6667, which
lets us assume that they were also going to initiate an IRC session. So, from the
11,965 samples, 1815 tried to or succeeded in establishing an IRC connection
and, therefore, can be seen as bots or, at least, as malware that contains bot-like
behavior.