Srizbi kernel-mode spambot reappears as Pitou

Posted by   Virus Bulletin on   Aug 28, 2014

Malware possibly still in the 'brewing' stage.

In November 2007, we published an article by Kimmo Kasslin (F-Secure) and Elia Florio (Symantec), in which they analysed the 'Srizbi' trojan, notable for being the first malware found in the wild that operated fully in kernel mode. It appears that Srizbi has made a return.

In a whitepaper published today (pdf), researchers at F-Secure describe 'Pitou', a piece of malware that the authors believe is a revival of Srizbi. And while the two families share a number of similarities, as well as the objective to send spam, the researchers considered the change in code significant enough to justify a new name for the latest incarnation.

As cybercrime goes, spam is considered neither particularly advanced, nor very profitable, so it is interesting to see that a number of fairly advanced, though not entirely new, techniques are being used by the trojan. Among these are 'DLL hijacking' by the dropper to escalate privileges, hijacking the BIOS interrupt handler, and the use of a domain generating algorithm (DGA) to communicate with its command and control servers.

Pitou is believed to have spread via drive-by downloads and through a number of downloaders, which themselves were downloaded via malicious spam. However, the malware is nowhere near as widely propagated as its predecessor was, and it is possible that Pitou is still in the 'brewing' stage. This, of course, makes it all the more important to keep a close eye on how the trojan develops; thankfully, the whitepaper provides many technical details.

More details in a Q&A on F-Secure's blog here.

Posted on 28 August 2014 by Martijn Grooten



Latest posts:

VB2016 paper: The TAO of Automated Iframe Injectors - Building Drive-by Platforms For Fun

We publish Aditya K. Sood's VB2016 paper on the use of iframe injectors by cybercriminals to deliver drive-by downloads.

“Cybersecurity is, at its core, a people problem,” says VB2016 keynote speaker

An interview with VB2016’s keynote speaker Christine Whalley - Director, Governance and IT Risk Management at Pfizer

Throwback Thursday: Following the Breadcrumbs

In 1999, Christine Orshesky described how one large organization decided to find out how and where the viruses within it were being obtained so it could do more to protect its networks.

VB2016 preview: Cryptography mistakes in malware

At VB2016, two talks will discuss mistakes made by malware authors in cryptographic implementations. Ben Herzog and Yaniv Balmas will present a paper in which they look at a number of these mistakes, while Malwarebytes researcher hasherezade will…

GPS technology is more at risk from cyber attack than ever before, security expert demonstrates at VB2016

Next month at VB2016, HPE Security's Oleg Petrovsky will speak about attacks on GPS. We conducted a short interview with Oleg and asked him about GPS, about the conference, and about his ultimate dinner party.