FBot, malware botnet killing malware crypto botnets?

[WMGroomAK]

An interesting security report was recently released concerning a new botnet being labelled as Fbot that appears to be targeting a seperate botnet for removal.  According to a report from security firm Netlab, this botnet is a variant of the ADBminer software that appears to only have the purposed of seeking out ad removing the com.ufo.miner botnet and may have links to the original Satori botnet.

 

https://www.ccn.com/vigilante-botnet-infects-computers-to-remove-cryptocurrency-malware/

Quote

Botnets consist of dozens, hundreds, or even thousands of internet-connected devices which are then used to carry out to send spam messages en masse or to launch distributed denial-of-service (DDoS) attacks, crashing online services. CCN has reported before on how botnets infected millions of computers last year with cryptojacking software designed to siphon CPU power for and use it to secretly mine crypto for the malware owners.

 

A particularly notorious botnet called ‘Mirai’ famously hijacked IoT devices to mine Bitcoin – while IoT devices are individually extremely ineffective, Mirai is a particularly virulent piece of malware that infected thousands of devices in a short space of time to take small profits from all of them. While the term botnet understandably carries a malicious connotation, one botnet seems to be breaking the mold and is seemingly forcing its way into user computers without to infect them – with crypto antivirus software.

 

Security research firm Netlab released a report describing the malware which they have dubbed ‘Fbot’, a variant of the legitimate ADBminer software designed to mine cryptocurrencies.

“There are 3 interesting aspects about this new botnet:

• First, so far the only purpose of this botnet looks to be just going after and removing another botnet com.ufo.miner.
• Second, the bot does not use traditional DNS to communicate with the C2, instead, it utilizes block-chain DNS to resolve the non-stand C2 name musl.lib. (see below for details)
• Third, this bot appears to have strong links to the original satori botnet.”

The botnet cleanses the ‘infected’ computers of the notoriously widespread cryptojacking malware and so far doesn’t seem to be leaving anything behind in its place, leading some to believe that the botnet may even be designed with that single benign purpose in mind.

 

However, it’s possible that there’s more to the software that meets the eye, or that it’s simply the first phase of a larger plan. The botnet could potentially be clearing competing crypto-malware only to pave the way for a fresh wave of attacks of its own, systematically eliminating the competition. Botnets take time, effort, and funding to operate which makes it hard to believe that an anonymous botnet could be working out there simply to help people.

 

I'm left to wonder if this is a legitimate attempt to have a botnet clean up another botnets mess or is it merely establishing itself and waiting for future deployment potential. Would be nice if it's just the former, but hard to trust.  It is kind of interesting though that someone is using a botnet to kill another botnet.

 

Netlab report: https://blog.netlab.360.com/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/

[vanished]

There was a guy who was doing something like this a while ago - hacking into hacked IoT devices to clean or shut them down - so it's not impossible to imagine this could be altruistic at heart as well, but yeah, you never know for sure, and even if it is, the ends may not necessarily justify the means, depending how it works.

[schwellmo92]

I used to be in the black hat scene many many years ago and killing off competing malware was quite common, you end up with a better quality host if you’re the only one commanding the host.

[Arika]

can someone ELI5 for me?

[Speed Weed]

1 hour ago, schwellmo92 said:

I used to be in the black hat scene many many years ago and killing off competing malware was quite common, you end up with a better quality host if you’re the only one commanding the host.

Stop lying bruh. 

[schwellmo92]

4 hours ago, DaPhuc said:

Stop lying bruh. 

What do I have to gain by lying? When I was a child (<18) I was a black hat (script kiddie). Killing off competing malware was beneficial because you don't have to compete for network (in the case of DDOS attacks) or CPU/GPU (in the case of miners), and then when you are stealing license keys, financial information and accounts you don't have others also leaching that same information.

[Bananasplit_00]

That's a pretty interesting story, and really makes me wonder if we are starting to see a botnet war starting perhaps 

[GoldenLag]

7 minutes ago, Bananasplit_00 said:

That's a pretty interesting story, and really makes me wonder if we are starting to see a botnet war starting perhaps 

The Skynet is mobilizing......

 

[LinuxTek]

Trump gave the .Mil the green light to go hunting.

 

https://www.cnn.com/2018/09/18/politics/us-military-cyberattacks-authority/index.html

[Guest]

28 minutes ago, GoldenLag said:

The Skynet is mobilizing......

 

If only it could target my student loan 

[Speed Weed]

2 hours ago, schwellmo92 said:

What do I have to gain by lying? When I was a child (<18) I was a black hat (script kiddie). Killing off competing malware was beneficial because you don't have to compete for network (in the case of DDOS attacks) or CPU/GPU (in the case of miners), and then when you are stealing license keys, financial information and accounts you don't have others also leaching that same information.

I need a good evidence for that bruh. Anyone can claim that they are a black hat, but without a good evidence I won't buy it. 

[cj09beira]

24 minutes ago, DaPhuc said:

I need a good evidence for that bruh. Anyone can claim that they are a black hat, but without a good evidence I won't buy it. 

its usually not a smart thing to prove this kind of actions, so don't expect them, listen and believe 

[Shally]

37 minutes ago, cj09beira said:

its usually not a smart thing to prove this kind of actions, so don't expect them, listen and believe 

"hur dur here's proof I did lots of illegal stuff to prove I have a large penis"

[Speed Weed]

38 minutes ago, cj09beira said:

its usually not a smart thing to prove this kind of actions, so don't expect them, listen and believe 

Ain't going to buy unless evidence is provided. 

[schwellmo92]

I was just responding to the questions on the OP, I honestly don’t care if you believe me or not, I was just explaining that malware killing is common practise.

[Space Reptile]

15 hours ago, Arika S said:

can someone ELI5 for me?

A computer controlling virus is using its computer controlling power to fight a crypto mining viruses on the computers it infects 

 

its wierd kinda like getting a rash , but that rash cured your flu 

 

[JuNex03]

12 hours ago, Space Reptile said:

A computer controlling virus is using its computer controlling power to fight a crypto mining viruses on the computers it infects 

 

Have you heard of "Kodoku" (Japanese folklore)?

 

https://en.wikipedia.org/wiki/Kodoku

[mr moose]

On 9/19/2018 at 11:26 AM, DaPhuc said:

Stop lying bruh. 

Dude, if it's not him its someone else in this thread who was,  law of averages says that when you have some many tech enthusiasts gather on one site at least a few of them are likely to have been part of some untoward digital activity.  There is literally no point in trying to argue he isn't unless he has specifically said something that illustrates  he made it up,  like the guy in the other thread who said he was a profession who used vs code for debugging but didn't know it was from MS.