Palo Alto Networks discovered a new spambot that determines whether the IP address on an infected host appears on a blacklist. If it does, the bot terminates itself without bothering to download the rest of the drop. Its Real-time Blackhole List (RBL) is specially designed and updated to prevent spam transmission by marking and blocking malicious addresses.

Sarvdap Scans Blacklists

According to SecurityWeek, the spambot, called Sarvdap, is distributed by the Andromeda botnet to deliver pharmaceutical spam or new copies of the Andromeda bot.

The spambot’s overall process is fairly detail-oriented. When it tries to inject itself, for example, it checks for the presence of a debugger. In normaly circumstances, the presence of a debugger could mean it is being observed.

“Sarvdap is particularly interesting not due to its scale, but rather due to its attempts to increase overall spam delivery by abusing reputation blacklists,” the Palo Alto researchers said.

Whereas other spambots simply pop up and start sending out spam, Sarvdap first conducts an IP check of the host to see if its even worth the effort. If the host passes the RBL check and Sarvdap doesn’t self-destruct, it attempts to communicate with the Microsoft website.

If that works, it sends messages to the host to determine whether it can communicate freely over TCP port 2352. If the command-and-control (C&C) server is online, it downloads a configuration file.

A Conceptual Advance

Palo Alto researchers found one interesting file inside the source code of the spambot: a hard-coded list of commonly known blacklist servers. Interestingly, this list was global in reach. That led the researchers to believe that the malware author was planning a widespread distribution of the spambot from the beginning.

Other strains of malware that predate Sarvdap, such as Furtim, also use blacklists. Unlike Sarvdap, however, they use these lists primarily to evade detection. The use of RBLs for nefarious purposes represents a conceptual advance for spambots — and it’s something users will increasingly have to watch out for in the future.