The Ramnit worm appeared in 2010. Within a year more than eight million PCs were infected worldwide. Initially the malware was just file infector spread by removable drives. Later it became better known for stealing user data via browser injection, targeting banking or game users.
Ramnit is still prevalent and old domains are regularly updated. Some of the domains have already been “sinkholed” (redirected to communicate only with a controlled server and not with its malicious developers) by other security researchers.
Apart from its typical malware characteristics (infecting .exe/html files, hooking Internet Explorer process) Ramnit sets up an FTP server on a victim’s machine. That FTP server becomes part of the RMNetwork FTP.
This FTP server supports following commands:
USER, PASS, CWD, CDUP, QUIT, PORT, PASV, TYPE, MODE, RETR, STOR, APPE, REST, RNFR, RNTO, ABOR, DELE, RMD, MKD, LIST, NLST, SYST, STAT, HELP, NOOP, SIZE, EXEC, and PWD.
Using these commands attackers can control the machine remotely, steal other sensitive files, and execute other malicious files. Infected machines that are firewalled or sit behind network address translation cannot “join” RMNetwork FTP, but they can communicate with the control server using TCP port 443 or 447 with custom encryption.