Security researchers have identified an advanced variant of the notorious malware , which managed to infect more than 11,000 computers in just 24 hours.
Pushdo, a multi-featured trojan, has been used to distribute financial malware such as ZeuS and SpyEye, as well as to carry out spam campaigns via the Cutwail botnet, since 2007.
Although it has been taken down several times in the past, Pushdo constantly recovers and continues to evolve, using increasingly advanced techniques to hide communications with the Command-and-Control (C&C) Servers.
The new variant of the malware uses a mechanism based on the DGA (Domain Generation Algorithm), which is designed to hide the details of the real C&C server. This algorithm is used for the dynamic creation of a list of domains, from which only one is activated at a time, making it more difficult, if not almost impossible, to locate it.
According to Bitdefender researchers, about 6,000 compromised computer systems (among the 1.5 million botnet members) already host the advanced version of Pushdo. The countries most affected by the malware's activity are India, Vietnam and Turkey. Countries such as the United Kingdom, France and the USA have also been targeted.
Bitdefender reports that more than 11,000 computers have been infected worldwide within a twenty-four hour period.
«We managed to successfully monitor the traffic of Pushdo and get an idea about the size of this botnet», said analyst Catalin Cosoi of Bitdefender.
"The extent of this criminal activity, although not quite sophisticated, is rather worrying, while there are indications that the botnet is still in its development phase," it says.
Researchers have also found that the new variant of the malware uses different encryption keys to protect communications between the bots and the C&C, but the protocol used for communication remains the same.
