Joe Stewart, senior security researcher at SecureWorks, has posted an <a href="http://www.secureworks.com/analysis/spamthru/" target="_blank">analysis</a> of a Trojan program called SpamThru on his company's Web site. As far as malware goes, it's a marvel.

Thomas Claburn, Editor at Large, Enterprise Mobility

October 19, 2006

1 Min Read

Joe Stewart, senior security researcher at SecureWorks, has posted an analysis of a Trojan program called SpamThru on his company's Web site. As far as malware goes, it's a marvel.SpamThru features a custom P2P protocol to share information with other bot-infected or compromised machines. In the event that the command-and-control server gets shut down, the spammer can redirect the hacked peers to a new master server.

SpamThru defends itself against antivirus software by rewriting the hosts file on the infected machine so virus updates can't be found. It also uses its own antivirus engine to eliminate other resident malware that might compete for resources or expose the compromised machine.

It contains its own template-driven spamming engine that's protected by AES (Rijndael) encryption. And it can generate randomized spam images to defeat pattern-based spam detection methods.

"Although we've seen automated spam networks set up by malware before (Sober, Bobax, Bagle, etc) this is one of the more sophisticated efforts," writes Stewart. "The complexity and scope of the project rivals some commercial software. Clearly the spammers have made quite an investment in infrastructure in order to maintain their level of income."

If the rest of my applications looked after themselves as aggressively as SpamThru does, I'd never have to worry about security again.

About the Author(s)

Thomas Claburn

Editor at Large, Enterprise Mobility

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful master's degree in film production. He wrote the original treatment for 3DO's Killing Time, a short story that appeared in On Spec, and the screenplay for an independent film called The Hanged Man, which he would later direct. He's the author of a science fiction novel, Reflecting Fires, and a sadly neglected blog, Lot 49. His iPhone game, Blocfall, is available through the iTunes App Store. His wife is a talented jazz singer; he does not sing, which is for the best.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights