Gauss: abnormal distribution - Revision history

Eric.freyssinet at 21:24, 21 March 2016

2016-03-21T21:24:23Z

← Older revision		Revision as of 21:24, 21 March 2016
Line 1:		Line 1:
	{{Publication		{{Publication
	\|~~Link~~=~~http://www.securelist.com/en/analysis/204792238/Gauss_Abnormal_Distribution~~		\|Botnet=Gauss
	\|~~Author~~=~~Global Research & Analysis Team~~		\|Year=2012
	~~\|NomRevue=Securelist~~
	\|Date=2012-08-09		\|Date=2012-08-09
	\|Editor=Kaspersky lab		\|Editor=Kaspersky lab
	\|~~Year~~=~~2012~~		\|Link=http://www.securelist.com/en/analysis/204792238/Gauss_Abnormal_Distribution
	\|~~Botnet~~=~~Gauss~~		\|Author=GReAT,
			\|Type=Blogpost
	\|Abstract=Introduction<br/>		\|Abstract=Introduction<br/>
	While analyzing the Flame malware that we detected in May 2012, Kaspersky Lab experts identified some distinguishing		While analyzing the Flame malware that we detected in May 2012, Kaspersky Lab experts identified some distinguishing
Line 29:		Line 29:
	Gauss is a much more widespread threat than Flame. However, we have found no self-replication functionality in the		Gauss is a much more widespread threat than Flame. However, we have found no self-replication functionality in the
	modules that we have seen to date, which leaves open the question of its original attack vector.<br/>		modules that we have seen to date, which leaves open the question of its original attack vector.<br/>
			\|NomRevue=Securelist
	}}		}}

Eric.freyssinet: Text replacement - " www.securelist.com" to ""

2015-02-07T16:59:46Z

Text replacement - " www.securelist.com" to ""

← Older revision		Revision as of 16:59, 7 February 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Link=http://www.securelist.com/en/analysis/204792238/Gauss_Abnormal_Distribution ~~www.securelist.com~~		\|Link=http://www.securelist.com/en/analysis/204792238/Gauss_Abnormal_Distribution
	\|Author=Global Research & Analysis Team		\|Author=Global Research & Analysis Team
	\|NomRevue=Securelist		\|NomRevue=Securelist

Eric.freyssinet: 1 revision imported

2015-02-07T14:27:21Z

1 revision imported

← Older revision	Revision as of 14:27, 7 February 2015
(No difference)

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

2014-08-27T16:30:07Z

Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

New page

{{Publication
|Link=http://www.securelist.com/en/analysis/204792238/Gauss_Abnormal_Distribution www.securelist.com
|Author=Global Research & Analysis Team
|NomRevue=Securelist
|Date=2012-08-09
|Editor=Kaspersky lab
|Year=2012
|Botnet=Gauss
|Abstract=Introduction 
While analyzing the Flame malware that we detected in May 2012, Kaspersky Lab experts identified some distinguishing
features of Flame’s modules. Based on those features, we discovered that in 2009, the first variant of the Stuxnet worm
included a module that was created based on the Flame platform. This indicates that there was some form of collaboration
between the groups that developed the Flame and Tilded (Stuxnet/Duqu) platforms. 
Based on the results of a detailed analysis of Flame, we continued to actively search for new, unknown components. A more
in-depth analysis conducted in June 2012 resulted in the discovery of a new, previously unknown malware platform that
uses a modular structure resembling that of Flame, a similar code base and system for communicating to C&C servers, as
well as numerous other similarities to Flame. 
In our opinion, all of this clearly indicates that the new platform which we discovered and which we called “Gauss,” is
another example of a cyber-espionage toolkit based on the Flame platform. 
Gauss is a project developed in 2011-2012 along the same lines as the Flame project. The malware has been actively
distributed in the Middle East for at least the past 10 months. The largest number of Gauss infections has been recorded in
Lebanon, in contrast to Flame, which spread primarily in Iran. 
Functionally, Gauss is designed to collect as much information about infected systems as possible, as well as to steal
credentials for various banking systems and social network, email and IM accounts. The Gauss code includes commands to
intercept data required to work with several Lebanese banks – for instance, Bank of Beirut, Byblos Bank, and Fransabank.
Curiously, several Gauss modules are named after famous mathematicians. The platform includes modules that go by the
names “Gauss”, “Lagrange”, “Godel”, “Tailor”, “Kurt” (in an apparent reference to Godel). The Gauss module is responsible
for collecting the most critical information, which is why we decided to name the entire toolkit after it. 
Gauss is a much more widespread threat than Flame. However, we have found no self-replication functionality in the
modules that we have seen to date, which leaves open the question of its original attack vector. 
}}

Gauss: abnormal distribution - Revision history

Eric.freyssinet at 21:24, 21 March 2016

Eric.freyssinet: Text replacement - " www.securelist.com" to ""

Eric.freyssinet: 1 revision imported

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »