Eric.freyssinet: Text replacement - " www.securelist.com" to ""

2015-02-07T16:58:02Z

Text replacement - " www.securelist.com" to ""

← Older revision		Revision as of 16:58, 7 February 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.securelist.com/en/blog/208193441/Flashfake_Mac_OS_X_botnet_confirmed ~~www.securelist.com~~		\|Link=http://www.securelist.com/en/blog/208193441/Flashfake_Mac_OS_X_botnet_confirmed
	\|Author=Igor Soumenkov,		\|Author=Igor Soumenkov,
	\|NomRevue=Securelist		\|NomRevue=Securelist

Eric.freyssinet: 1 revision imported

2015-02-07T14:24:16Z

1 revision imported

← Older revision	Revision as of 14:24, 7 February 2015
(No difference)

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

2014-08-27T16:30:22Z

Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

New page

{{Publication
|Image=Flashfake Mac OS X botnet confirmed.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.securelist.com/en/blog/208193441/Flashfake_Mac_OS_X_botnet_confirmed www.securelist.com
|Author=Igor Soumenkov,
|NomRevue=Securelist
|Date=April 06 2012
|Editor=Kaspersky lab
|Year=2012
|ISBN=
|Page=
|Abstract=Earlier this week, Dr.Web reported the discovery of a Mac OS X botnet Flashback (Flashfake). According to their information, the estimated size of this botnet is more than 500, 000 infected Mac machines.

We followed up with an analysis of the latest variant of this bot, Trojan-Downloader.OSX.Flashfake.ab.

It is being distributed via infected websites as a Java applet that pretends to be an update for the Adobe Flash Player. The Java applet then executes the first stage downloader that subsequently downloads and installs the main component of the Trojan. The main component is a Trojan-Downloader that continuously connects to one of its command-and-control (C&C) servers and waits for new components to download and execute.

The bot locates its C&C servers by domain names, and these names are generated using two algorithms. The first algorithm depends on the current date, and the second algorithm uses several variables that are stored in the Trojan’s body and encrypted with the computer’s hardware UUID using RC4 cipher.

We reverse engineered the first domain generation algorithm and used the current date, 06.04.2012, to generate and register a domain name, "krymbrjasnof.com". After domain registration, we were able to log requests from the bots. Since every request from the bot contains its unique hardware UUID, we were able to calculate the number of active bots. Our logs indicate that a total of 600 000+ unique bots connected to our server in less than 24 hours. They used a total of 620 000+ external IP addresses. More than 50% of the bots connected from the United States.
|Botnet=Flashback, Flashfake,
|Malware=Flashback (bot),
|CCProtocol=,
|Operation=,
|Keyword=,
}}

Flashfake Mac OS X botnet confirmed - Revision history

Eric.freyssinet: Text replacement - " www.securelist.com" to ""

Eric.freyssinet: 1 revision imported

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »