Hodprot: hot to bot - Revision history

Eric.freyssinet at 02:16, 20 August 2015

2015-08-20T02:16:32Z

← Older revision		Revision as of 02:16, 20 August 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Image=Hodprot_hot_to_bot.png		\|Image=Hodprot_hot_to_bot.png
	\|Botnet=Hodprot, Carberp, Sheldor, RDPdoor,		\|Botnet=Hodprot, Carberp, Sheldor, RDPdoor, Shiz,
	\|Malware=,		\|Malware=,
	\|CCProtocol=,		\|CCProtocol=,

Eric.freyssinet at 10:02, 4 August 2015

2015-08-04T10:02:33Z

← Older revision		Revision as of 10:02, 4 August 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Image=Hodprot_hot_to_bot.png		\|Image=Hodprot_hot_to_bot.png
	\|~~Legend~~=		\|Botnet=Hodprot, Carberp, Sheldor, RDPdoor,
	\|~~Document~~=		\|Malware=,
	\|~~Licence~~=		\|CCProtocol=,
	\|~~Video~~=		\|Operation=,
			\|Year=2011
			\|Date=2011-10-05
			\|Editor=ESET
	\|Link=http://go.eset.com/us/resources/white-papers/Hodprot-Report.pdf go.eset.com (PDF)		\|Link=http://go.eset.com/us/resources/white-papers/Hodprot-Report.pdf go.eset.com (PDF)
	\|Author=Eugene Rodionov, Aleksandr Matrosov, Dmitry Volkov,		\|Author=Eugene Rodionov, Aleksandr Matrosov, Dmitry Volkov,
	~~\|NomRevue=ESET white paper~~
	~~\|Date=5 octobre 2011~~
	~~\|Editor=ESET~~
	~~\|Year=2011~~
	~~\|ISBN=~~
	~~\|Page=~~
	\|Abstract=As discussed in our presentation at CARO2011 on "Cybercrime in Russia: Trends and issues", the number of Russian cybercrimes related to financial fraud and stealing money from bank accounts increased		\|Abstract=As discussed in our presentation at CARO2011 on "Cybercrime in Russia: Trends and issues", the number of Russian cybercrimes related to financial fraud and stealing money from bank accounts increased
	significantly in the last year. Moreover we can see accelerated growth in the number of cybercrimes related to banking fraud in the second half of 2011. The most common malware families involved in		significantly in the last year. Moreover we can see accelerated growth in the number of cybercrimes related to banking fraud in the second half of 2011. The most common malware families involved in
Line 28:		Line 25:
	statistics of incidents provided by Group-IB, one of the most-used families of malware is Win32/Hodprot. This is an interesting family of Trojans which merits further discussion: it implements		statistics of incidents provided by Group-IB, one of the most-used families of malware is Win32/Hodprot. This is an interesting family of Trojans which merits further discussion: it implements
	many sophisticated algorithms and anti-forensic mechanisms.		many sophisticated algorithms and anti-forensic mechanisms.
	\|~~Botnet~~=~~Hodprot, Carberp, Sheldor, RDPdoor,~~		\|Document=
	\|~~Malware~~=,		\|Licence=
	\|~~CCProtocol~~=,		\|Video=
	\|~~Operation~~=,		\|NomRevue=ESET white paper
	\|Keyword=,		\|ISBN=
			\|Page=
			\|Keyword=,
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:26:41Z

1 revision imported

← Older revision		Revision as of 14:26, 7 February 2015
(No difference)

Eric.freyssinet at 18:35, 5 June 2012

2012-06-05T18:35:51Z

New page

{{Publication
|Image=Hodprot_hot_to_bot.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://go.eset.com/us/resources/white-papers/Hodprot-Report.pdf go.eset.com (PDF)
|Author=Eugene Rodionov, Aleksandr Matrosov, Dmitry Volkov,
|NomRevue=ESET white paper
|Date=5 octobre 2011
|Editor=ESET
|Year=2011
|ISBN=
|Page=
|Abstract=As discussed in our presentation at CARO2011 on "Cybercrime in Russia: Trends and issues", the number of Russian cybercrimes related to financial fraud and stealing money from bank accounts increased
significantly in the last year. Moreover we can see accelerated growth in the number of cybercrimes related to banking fraud in the second half of 2011. The most common malware families involved in
incidents of banking fraud in Russia are:
* Win32/Carberp
* Win32/Shiz
* Win32/Hodprot
* Win32/Sheldor
* Win32/RDPdoor
Here are the major regions of distribution of these banking Trojans:
# Russia
# Ukraine
# Kazakhstan
Attackers have focused on these countries because similar banking software and mechanisms for financial transactions are in use there. In the late spring and early summer of 2011, according to
statistics of incidents provided by Group-IB, one of the most-used families of malware is Win32/Hodprot. This is an interesting family of Trojans which merits further discussion: it implements
many sophisticated algorithms and anti-forensic mechanisms.
|Botnet=Hodprot, Carberp, Sheldor, RDPdoor,
|Malware=,
|CCProtocol=,
|Operation=,
|Keyword=,
}}