Where is Waledac?

Win32/Waledac [1] is a trojan that is used to send spam. It also has the ability to download and execute arbitrary files, harvest email addresses from the local machine, perform denial of service attacks, proxy network traffic and sniff passwords.

Waledac first drew significant attention in December 2008 via a Christmas-themed postcard lure. In the six months since, many users have been the recipient of various other eye-catching lures sent by Waledac. From the perennial holiday-themed lures to the more recent ‘Reuters Terror Attack’ or ‘SMS Spy’ themes, downloading a variant of Waledac is only a single, socially engineered step away.

When it was unleashed in December, Win32/Waledac was by no means an under-developed piece of malware. The authors had been testing and developing the capabilities for at least a year prior to its release. The earliest known binary we were able to find in the wild was from 25 December 2007. The developmental progression of Win32/Waledac can be traced by its internal version numbers. In this case, the version was ‘0’.

A major point in development came with the release of version 15 in the last week of November 2008. This was the first version to support ‘labels’. The label would essentially provide a mechanism to identify and segment drones and the tasks designated to them. The labels appear to be used as affiliate identifiers.

Whilst the major distribution vector for Waledac appears to be through the use of spam campaigns and web hosting on compromised machines, the trojan may also be installed via a custom downloader. These custom downloaders are easily recognized as members of the Waledac family because they employ the same downloading technique as the main component. The technique is to decode an encrypted binary appended to a legitimate JPG. The encryption and the marker separating the JPG from the encrypted data are the same for the downloader and the main component.

We observed that the filename of the JPG retrieved was equivalent to the label contained within the binary itself. Some of the labels observed in samples in the wild have the appearance of a ‘handle’. For example:

Searching on the Internet for these labels produces some circumstantial evidence to support this theory. In some cases, where the number of results yielded is low, there is a bias towards Russian-hosted websites.

The authors of Waledac appear to have established a relationship of some description with other malware authors. The most notable demonstration of this is by a variant of Win32/Conficker [2]. This particular variant was able to download an encrypted copy of Waledac. The Conficker binary used a private key to decrypt the file from the host ‘goodnewsdigital.com’.

This suggests a level of co-operation, as the Waledac authors would be required to encrypt a binary to an affiliate’s specifications. An alternative scenario is that affiliates have the privilege to ‘publish’ binaries to the distributed hosting network. Therefore, any additional cryptographic transformations could be performed independently.

In addition to Conficker, trojan downloaders such as Win32/Bredolab [3] have also been observed to retrieve Waledac binaries hosted at ‘goodnewsdigital.com’. The label of the Waledac variant downloaded by Conficker was ‘twist’. The label of the binary downloaded by Bredolab was ‘dmitriy777’.

Waledac has the ability to update itself by downloading and executing a newer version from the Internet. This downloading capability is also leveraged to install other malware such as Win32/Rugzip, though perhaps the most interesting piece of malware downloaded recently is Win32/FakeSpypro [4]. The fact that Waledac has installed rogue security applications demonstrates that there is money to be made from affected users.

Figure 1. Win32/FakeSpypro – the fact that Win32/Waledac has installed rogue security applications demonstrates that there is money to be made from affected users.

Now let’s take a look at the MSRT (Malicious Software Removal Tool) [5] telemetry from April, the month in which Waledac was added to the MSRT. Waledac was the twenty-fourth-most prevalent family during this month. More than 24,000 distinct machines were reported with a Waledac infection worldwide. Waledac is deployed mostly on Windows XP (see ).Figure 2 Note this is not normalized. As of today, the MSRT installation base on Vista is about 37% the size of that on Windows XP.

Figure 2. Waledac infection breakdown by OS.

If we take another step to normalize the infection rate by OS, factoring in the MSRT install base, Figure 3 shows that Windows XP has the largest number of computers cleaned per thousand MSRT executions (CCM). Here, CCM is a metric for infection rate based on the MSRT data widely used in the Microsoft Security Intelligence Report [6].

Figure 3. Waledac computers cleaned per thousand (CCM) by platform.

Breaking down the reports by country and performing the same normalization with the MSRT install base, we derive the following table for infection rate. The table presents the top 25 most ‘infected’ countries, ranked by CCM. Turkey has the highest infection rate, followed by Hungary, Russia and the United States:

Waledac is highly polymorphic. From over 24,000 infected machines there were 2,452 unique Waledac binaries. The following table shows the top 10 reported Waledac hashes. The top six files reported are internal version 34, which was the most recent at the time of the April MSRT release.

Over the period 16–21 April 2009, Forefront Online Security for Exchange (FOSE) tracked data on Waledac-related spam. In the study, the following domains were tracked:

By observing FOSE customers’ incoming mail containing these links, it was possible to capture all of the IPs that sent this mail. These IPs were analysed and the sum total of all mail sent from these IPs was calculated (not just the mail containing the Waledac spam links). Next, a geographical distribution was sketched showing the allocation of the IPs according to their sending source.

One of the characteristics of the Waledac botnet is that it sends a high proportion of mail with an empty MAIL FROM < > field. Empty senders are not included in either the total spam count or the total mail count, but they are included in the average number of mails sent per IP. Empty sender mail could be spam (such as that occurring in Waledac spam) or it could be backscatter mail. This distinction is not made in the statistics below.

As a proportion of total overall mail, showing the percentages:

From the above tables, observe that total spam is only a small proportion of the total mail. Slightly more than a third of North America’s mail is marked as spam, and the numbers are not dissimilar for the other regions. This implies that the Waledac botnet is spread very widely on machines that do not typically send high volumes of spam. In other words, the sending machines are compromised, but the amount of mail sent per bot is sufficiently small so as to hide it within a larger, overall good mail stream.

The next table shows the IP distribution per country, sorted by the total amount of empty sender mail. Manual inspection of a number of Waledac-related spam messages confirmed that much of the spam was sent with empty MAIL FROMs. The average mail/IP includes the empty sender count.

As a proportion of relative totals:

The United States is first in this list and it appears to send a disproportionate amount of spam compared to the number of distinct IPs associated with it, but if we compare it to the others like France, Sweden and Belarus, it is not the worst offender. One surprise finding in this list is China, which ranks eleventh in the list. Even though it accounts for nearly one fifth of all the IPs found in the botnet, it accounts for less than 1% of the spam sent. In fact, looking at both sets of data, by continent and by country, Waledac is more likely to be found in the western hemisphere than in the eastern hemisphere.

If we compare North America to Europe, we see that substantially more mail comes from North America than from Europe if we exclude empty sender mail. Yet, if we isolate only that particular type of mail, then the two regions are very similar to each other.