Eric.freyssinet at 18:22, 30 July 2015

2015-07-30T18:22:56Z

← Older revision		Revision as of 18:22, 30 July 2015
Line 6:		Line 6:
	\|Editor=ESET Welivesecurity		\|Editor=ESET Welivesecurity
	\|Link=http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the-continuing-saga/		\|Link=http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the-continuing-saga/
	\|Author=Aleksandr Matrosov,		\|Author=Aleksandr Matrosov, Eugene Rodionov, Anton Cherepanov,
	\|Type=Blogpost		\|Type=Blogpost
	\|Abstract=Back at the beginning of May we posted preliminary information about Win32/Rootkit.Avatar rootkit (Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication). One of the major questions not covered in that previous research was this: What payload and plugins does Avatar install onto infected machines? We continue our research and are still tracking this malware family. In the middle of July we detected a repacked Win32/Rootkit.Avatar with an active command and control (C&C) server. In this blog post we confirm that Avatar in-the-wild activity continues, and disclose some new information about its kernel-mode self-defense tricks.		\|Abstract=Back at the beginning of May we posted preliminary information about Win32/Rootkit.Avatar rootkit (Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication). One of the major questions not covered in that previous research was this: What payload and plugins does Avatar install onto infected machines? We continue our research and are still tracking this malware family. In the middle of July we detected a repacked Win32/Rootkit.Avatar with an active command and control (C&C) server. In this blog post we confirm that Avatar in-the-wild activity continues, and disclose some new information about its kernel-mode self-defense tricks.
	}}		}}

Eric.freyssinet: Created page with "{{Publication |Botnet=Avatar, |Feature=File download, |Year=2013 |Date=2013-08-21 |Editor=ESET Welivesecurity |Link=http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the..."

2015-07-30T17:46:06Z

Created page with "{{Publication |Botnet=Avatar, |Feature=File download, |Year=2013 |Date=2013-08-21 |Editor=ESET Welivesecurity |Link=http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the..."

New page

{{Publication
|Botnet=Avatar,
|Feature=File download,
|Year=2013
|Date=2013-08-21
|Editor=ESET Welivesecurity
|Link=http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the-continuing-saga/
|Author=Aleksandr Matrosov,
|Type=Blogpost
|Abstract=Back at the beginning of May we posted preliminary information about Win32/Rootkit.Avatar rootkit (Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication). One of the major questions not covered in that previous research was this: What payload and plugins does Avatar install onto infected machines? We continue our research and are still tracking this malware family. In the middle of July we detected a repacked Win32/Rootkit.Avatar with an active command and control (C&C) server. In this blog post we confirm that Avatar in-the-wild activity continues, and disclose some new information about its kernel-mode self-defense tricks.
}}

Avatar rootkit: the continuing saga - Revision history

Eric.freyssinet at 18:22, 30 July 2015

Eric.freyssinet: Created page with "{{Publication |Botnet=Avatar, |Feature=File download, |Year=2013 |Date=2013-08-21 |Editor=ESET Welivesecurity |Link=http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the..."