Did Grum Really Get Killed?

Forseveral years before July 2012 takedown, Grum was one of the notorious spambotnets and at one time was responsible for more than 30% of spamworldwide. Last year's Grum botnet takedown was a victorious feat by the securitycommunity and could be considered as one of the most significant takedowns of2012. However, the effect of this takedown seems to be temporary as we've observedspam volume from Grum bot trickling back:

GrumGraph copy

Over the lastlittle while, we run a number of Grum samples and observed new command&control (C&C) servers that the bot connects to:
  • 188.93.233.2
  • 185.4.227.170
  • 198.144.156.187
  • 80.86.253.3
  • 84.22.104.163

The usual setof command which is basically a HTTP GET request at port 80 can be observedwhen it communicates to its C&C server.

  • GET /spm/s_get_host.php?ver=[bot version]

    s_get_host.php - get theinfected machine's IP address and hostname

  • GET /spm/s_alive.php?id=[botmachineid]&tick=[system tick]&ver=[bot version]&smtp=[ok|bad]

s_alive.php - reports backto the control server that the bot is alive. The data includes bot id, systemtick,bot version and smtp status to control server

  • GET /spm/s_task.php?id=[bot machineid]&tid=xxxxx

s_task.php - get task andspam templates.

  • GET /spm/s_report.php?task=[task id]&id=[botmachine id]&errors[xxx]=xx

s_report.php - reports backerrors to the command and control server.

The spamming began rightafter it received the encrypted spam template:

Screenshot-Follow TCP Stream-1

The spam campaigns fromGrum were the usual suspect: pharmaceutical spam. The link in the spam points to an illegalpharmacy website operation. I've alsolisted the Russian domains related to this spam campaign, here.

SpamCampaignPharma

The spam volume from Grumthat we are seeing today is a pale shadow of what it was before the July 2012takedown. But it is worth noting that Grum is showing a slow come back. Perhapsbot herders behind Grum botnet are slowly rebuilding it again. We've beeninvolved in helping various botnet takedowns before, but most of the time, theeffect is temporary. It seems this botnet is deeply rooted, that you couldn't take it down by its branch and fruit, but by its roots.

Trustwave Secure Email Gateway customers are protected against this spam campaign.

Trustwave reserves the right to review all comments in the discussion below. Please note that for security and other reasons, we may not approve comments containing links.