Sydney honeypots attract morphing botnet malware
he Sydney branch of West Coast Labs' global honeynet was amongst the first to record two new malware variants last week, as the RBot family continued to wreak havoc on global networks.
Of the 41 malware threats detected by West Coast Labs' Sydney honeypots last week, 29 were received there for the first time. Two were brand new threats on a global level: a variant of the Allaple family and another of the Virut family.
The Sydney honeypots detected a compressed file - generally agreed to be a member of the polymorphic Virut family of viruses. This virus infects files with encrypted code which spreads further when each infected file is run. The new threat contained the IRCBOT (internet relay chat bot) functionality – which enables remote users to take over an infected machine, adding it to a botnet and used for illicit purposes, such as distributing spam or generating Distributed Denial of Service attacks.
