Tracking Rovnix

Over the past few months we’ve been monitoring the Rovnix botnet (other AV vendors call it papras/ursnif/gozi). We have observed as infection vectors pay per install campaigns, but also the Andromeda malware. We have analyzed the malware’s DGA, sinkholed it, and observed its communication protocol to map current infection campaigns and get an idea of the overall size of the botnet.

Domain Generation Algorithm

The DGA (Domain Generation Algorithm) generates 5 or 10 domains per 3 months. Specifically, 5 or 10 domains will be generated for each of the following group of months:

January, February, March
April, May, June
July, August, September
October, November, December

This means there are 20 or 40 candidate domain names per year. The number of the generated domains depends on the DGA version.

The domain names are obtained by concatenating words or their first half as long as the domain name is composed of minimum 12 and maximum 23 characters. Both the words contained in the domain name and its top level domain are chosen in a pseudo-random way from provided lists. The randomness is ensured by a fixed seed number and by the year and months for which the domains are being generated.

The word list is extracted from a publicly available text file, which has a very small probability of being changed in the future, like United States Declaration of Independence, GNU Lesser General Public License, Request for Comments (RFC) pages, and specifications. In order to be part of the list of candidate words, they must contain only letters and be at least 3 characters long. Before being used, they are converted to lower case.

Different versions of the malware use different files from which the words are selected. Interestingly, the versions targeting United Kingdom use the US Declaration of Independence.

For example, the domain names generated by the first version of the DGA for months January, February and March, 2014 are:

theseforbiddentandthe.eu
allsuchsuchreturned.com
landslegisrighthumble.eu
consentrulerallpretended.net
humthethcertainevi.com
theunhasthatinestthmust.net
otheovtheeatci.net
eathapublishtthe.eu
whichdepositoryswath.cn
dissolutionsconvufrom.com

Sinkholed Domains

We have sinkholed so far one domain for each of the 6 versions we found in the wild. In the following table, the seed, the words file and the used top level domains are specified for each version.

Domain	Seed	Words File	TLDs
taxes[removed].net	0x35678930	United States Declaration of Independence	com net biz cn eu
dissour[removed].biz	0xEDBA8930	United States Declaration of Independence	com net biz ru eu
bufa[removed].tk	0xEDBA8930	Netstrings Specification	net com biz ru tk
operation[removed].eu	0xCE728930	United States Declaration of Independence	com net biz ru eu
youorig[removed].de	0xEDBA8930	GNU Lesser General Public License	com net de tk ru
specific[removed].biz	0xEDBA8930	Request for Comments (RFC) 4288	net com biz ru tk

Most domains are still valid for the bots. For example, the last four domains listed in the next table have been receiving requests only two weeks, but are still to receive them in the following two months. Because of this, the number of infected bots contacting them is still expected to increase considerably, like the ones for the first 2 domains did.

Domain	Sinkholing Date	Targeted Countries	Total Number of Reported Infections
taxes[removed].net	04 August 2014	Netherlands, France, Belgium	27.455
dissour[removed].biz	10 September 2014	United Kingdom	129.754
bufa[removed].tk	14 October 2014	Bulgaria	11.441
operation[removed].eu	22 Octomber 2014	Poland	10.055
youorig[removed].de	22 October 2014	Bulgaria	1.630
specific[removed].biz	22 October 2014	Bulgaria	3.394

However, the countries being targeted are already obvious. Proof lies in the fact that the number of infections reported for the most infected country is much higher than the second most infected country. For illustration purposes, note the top 5 most infected countries for each version.

The following images illustrate the number of infections reported for every country, emphasizing on top 5, for each version since sinkholing date. Note how various campaigns target specific countries.

Campaign 1 (targeting Netherlands, France, and Belgium) with taxes[removed].net