View source for TDSS botnet: full disclosure

{{Publication
|Link=http://nobunkum.ru/analytics/en-tdss-botnet nobunkum.ru
|Author=Andrey Rassokhin, Dmitry Oleksyuk
|Date=2012-03-17
|Editor=Esage Lab
|Year=2012
|ISBN=No Bunkum
|Botnet=TDSS
|Abstract=TDSS is a wide-spread rootkit which forms a powerful botnet. TDSS is studied pretty well today. Howewer, no studies include anything beyond analysis of binary code and common attack vectors. Main goal of this article is to fill this gap in the IT security knowledge base by uncovering the TDSS botnet mechanisms.<br/><br/>

Also, we are humbly hoping to benefit to the existing computer crimes investigation methodology. This research shows a generic way to locate the “digital core” of a cyberband, having only their instrument (a malicious binary file). Pease note that this method makes it possible to find all technical info about an incident, while personal identification and prosecution of intruders remains in law-enforcement authorities sphere.<br/><br/>

The article consists of two parts. In the first part the process of breaking into the botnet is covered step-by-step. The second part is dedicated to analysis of the botnet’s inner details. Because we gained access to the C&C database, objective statistics of the botnet is included at the end of the article.
}}