Waledac malware returns after two years with password-stealing capabilities

A new version of the Waledac malware has been spotted on the Internet, but unlike previous variants, which were mainly used for spamming purposes, this one steals various log-in credentials and BitCoins, a type of virtual currency.

“The sample was originally detected on Feb 2nd and the first coverage by a major AV was not observed until Feb 13th,” researchers from network security firm Palo Alto Networks announced in a blog post on Tuesday.

[ Learn how to secure your systems with InfoWorld’s Malware Deep Dive PDF special report and Security Central newsletter, both from InfoWorld. ]

The original Waledac botnet was one of the top spam sources on the Internet until it got shut down by Microsoft in cooperation with other security vendors in March 2010.

However, the new version’s primary goal might no longer be spam, said Wade Williamson, a senior product manager at Palo Alto Networks. That’s because it also steals FTP, POP3 and SMTP user passwords, as well as .dat files for BitCoin wallets.

This is the first time that Palo Alto Networks’ firewall products have spotted Waledac-related activity since the original botnet was shut down two years ago, Williamson said.

The botnet’s two-year inactivity was confirmed by antivirus firm BitDefender. “We have closely monitored the Web space during international events such as the deaths of political leaders and calamities – moments when the Waledac botnet would run at peak capacity before the takedown and did not notice any malicious activity on that front,” said BitDefender E-Threats Analyst Bogdan Botezatu.

It’s difficult to determine with certainty if the new version is the creation of the original Waledac authors, but its high similarity to the old variant suggests that it is the work of someone with access to the original source code, Williamson said.

“What it is sure is the fact that the newly added functionalities (email and FTP credentials harvesting) will contribute to an explosive development of the new botnet,” Botezatu said. “FTP accounts will likely be used to accommodate binary copies of the bots, while the e-mail accounts will be used to propagate spam through not-yet-blacklisted mail servers.”

Palo Alto Networks researchers have determined that the new Waledac version is being distributed through Web sessions, probably with the help of exploits hosted on compromised websites. According to Botezatu, BitDefender is also investigating this possibility.

“We recommend users to deploy and update a security solution with antispam and antivirus modules,” Botezatu said. “We also advise that users rely on SFTP and SSL when connecting to FTP and mail servers, respectively, in order to minimize the risk of network sniffing.”