"Dr. Web" informed about a botnet with 1,5 million hosts

Software company "Dr. Web" announced about the spread of the virus Win32.Rmnet.12. The botnet, which was created by this malware, consists of 1,400,520 Windows devices.

Experts call Win32.Rmnet.12 a complex multicomponent file virus with the ability of self-replication without user's intervention. Affecting the system, the malware finds the browser used by default and embeds itself in its processes. After that it saves a hidden file in user’s startup folder, using a name generated from the name of the hard drive. A configuration file, which records all the data required for work, is created in the same folder.

Using a special algorithm the virus determines the name of the C&C server and connects to it.

“Dr. Web” experts state that the virus contains a backdoor module. Every 70 seconds this module sends requests for such sites as google.com, bing.com and yahoo.com, analyzing the speed of answers that were received. After that all the information is transmitted to C&C server via FTP protocol. The backdoor is capable of performing all the commands received from the C&C server, including download and execution of files, update and transmission of any information, and even the crash down of the operating system.

The virus spreads via network using two methods. Firstly, the malware exploits vulnerabilities in browsers. This allows to store and run the executable files, when the users visit specially crafted web-pages. Secondly, Win32.Rmnet.12 infects all .exe-files on the computer and copies itself to thumb drives.

“Doctor Web” claims that it gained the complete control over the botnet Win32.Rmnet.12. The experts examined the protocol which was used for data exchange between the infected machines and C&C servers, and applied the sinkhole-method, which was also used to study the Flashback botnet.

The majority of systems infected by Win32.Rmnet.12 is located in Indonesia - 320,014, which accounts for 27,12% of all botnet hosts. Number of bots in Russia is 43,153, i.e. 3.6% of all botnet hosts.