Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Can I spam from here: An Unusually Clever Spambot Tests Blacklists

Summary: Unit 42 researchers observed a spambot, commonly downloaded by the Andromeda malware and tracked by Microsoft as Sarvdap, that queries a hardcoded list of global DNS blacklist servers before sending pharmaceutical spam and propagating Andromeda. If the infected host's IP appears on any blacklist, the malware terminates its process instead of sending mail; if it passes, it beacons to a hardcoded command and control server over TCP port 2352.

Why it matters: This bot's edge is not volume but evasion: it checks reputation blacklists worldwide and shuts itself down on a hit, so a clean IP reputation is exactly the condition under which it operates - and the blacklists your mail gateway trusts are the same feeds it is reading.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related