Schrödinger's RAT: Profiling the Stakeholders in the Remote Access Trojan Ecosystem
Schrödinger's RAT: Profiling the Stakeholders in the Remote Access Trojan Ecosystem
复制标题
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Mohammad Rezaeirad;Brown Farinholt;Hitesh Dharmdasani;P. Pearce;Kirill Levchenko;Damon McCoy
中科院分区：
文献类型：
--
作者：
Mohammad Rezaeirad;Brown Farinholt;Hitesh Dharmdasani;P. Pearce;Kirill Levchenko;Damon McCoy
远程访问特洛伊木马（RAT）是一类恶意软件，使攻击者可以直接交互式访问受害者的个人计算机，允许攻击者从计算机中窃取私人数据，使用摄像头和麦克风实时监视受害者，并通过对话框直接与受害者交互。RAT被用于监视、信息窃取和勒索受害者。在这项工作中，我们报告了两种流行的RAT，njRAT和DarkComet的攻击者和受害者。使用恶意软件存储库VirusTotal，我们可以找到这些RAT的所有实例，并确定其控制器的域名。然后，我们注册那些已经过期的域名，并将它们定向到我们的测量基础设施，使我们能够确定这些活动的受害者。我们调查了几种技术，排除网络扫描程序和沙箱执行的恶意软件样本，以过滤明显的感染，而不是真实的受害者的运动。我们的结果显示，连接到我们的天坑的828，137个IP地址中，超过99%可能不是真实的受害者。我们报告了受害者的数量，RAT活动持续多久，以及受害者和攻击者之间的地理关系。
Remote Access Trojans (RATs) are a class of malware that give an attacker direct, interactive access to a victim’s personal computer, allowing the attacker to steal private data from the computer, spy on the victim in realtime using the camera and microphone, and interact directly with the victim via a dialog box. RATs are used for surveillance, information theft, and extortion of victims. In this work, we report on the attackers and victims for two popular RATs, njRAT and DarkComet. Using the malware repository VirusTotal, we find all instances of these RATs and identify the domain names of their controllers. We then register those domains that have expired and direct them to our measurement infrastructure, allowing us to determine the victims of these campaigns. We investigate several techniques for excluding network scanners and sandbox executions of malware samples in order to filter apparent infections that are not real victims of the campaign. Our results show that over 99% of the 828,137 IP addresses that connected to our sinkhole are likely not real victims. We report on the number of victims, how long RAT campaigns remain active, and the geographic relationship between victims and attackers.