Eric.freyssinet at 14:18, 19 April 2015

2015-04-19T14:18:17Z

← Older revision		Revision as of 14:18, 19 April 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Botnet=Harnig, Piptea,		\|Botnet=Harnig, Piptea, SpyEye, Zbot, Ertfor,
	\|Feature=Pay-per-install,		\|Feature=Pay-per-install,
	\|Year=2011		\|Year=2011

Eric.freyssinet: Created page with "{{Publication |Botnet=Harnig, Piptea, |Feature=Pay-per-install, |Year=2011 |Date=2011-03-22 |Editor=FireEye |Link=https://www.fireeye.com/blog/threat-research/2011/03/a-retrea..."

2015-04-19T14:13:58Z

Created page with "{{Publication |Botnet=Harnig, Piptea, |Feature=Pay-per-install, |Year=2011 |Date=2011-03-22 |Editor=FireEye |Link=https://www.fireeye.com/blog/threat-research/2011/03/a-retrea..."

New page

{{Publication
|Botnet=Harnig, Piptea,
|Feature=Pay-per-install,
|Year=2011
|Date=2011-03-22
|Editor=FireEye
|Link=https://www.fireeye.com/blog/threat-research/2011/03/a-retreating-army.html
|Author=Atif Mushtaq,
|Type=Blogpost
|Abstract=Rustock is not the only botnet which suffered from the recent take down by Microsoft. It appears that Harnig (a.k.a Piptea), a close relative to Rustock, is retreating as well. There is no evidence that someone is trying to shutdown Harnig. It looks like a decision made solely by the bot herders. Why? I'll talk about it shortly.

Harnig is considered to be a very wide spread pay per install malware whose sole purpose is to infect PCs and then download and install a variety of other malware on the system. In return for this favor, the owners of other malware families pay the bot herders a little sum, normally a few cents per machine. When it comes to pay per install networks, the type and amount of malware being dropped can't easily be determined. What matters is, who and when someone is paying the bot herders. But things between Harnig and Rustock were quite different. There has been a long term relationship between the Harnig and Rustock botnets. For the last 2 years or so, Rustock has almost always been seen being spread through Harnig. Very rarely will one see Rustock using some other infection vector or pay per install network to propagate itself.
}}

Harnig botnet: a retreating army - Revision history

Eric.freyssinet at 14:18, 19 April 2015

Eric.freyssinet: Created page with "{{Publication |Botnet=Harnig, Piptea, |Feature=Pay-per-install, |Year=2011 |Date=2011-03-22 |Editor=FireEye |Link=https://www.fireeye.com/blog/threat-research/2011/03/a-retrea..."