Kelihos - Revision history

Eric.freyssinet: Text replacement - "=Unknown" to "="

2015-08-08T13:45:24Z

Text replacement - "=Unknown" to "="

← Older revision		Revision as of 13:45, 8 August 2015
Line 4:		Line 4:
	[[Image:Kelihos-Infection.png]]		[[Image:Kelihos-Infection.png]]
	\|Target=Microsoft Windows		\|Target=Microsoft Windows
	\|UserAgent=~~Unknown~~		\|UserAgent=
	\|CCProtocol=P2P		\|CCProtocol=P2P
	\|Feature=DDoS, Virtual machine detection, Fast flux, FTP password theft, Firefox password theft, Bitcoin mining, Bitcoin wallet theft, Keylogger, Winpcap interception, Double fastflux, USB vector, Send spam,		\|Feature=DDoS, Virtual machine detection, Fast flux, FTP password theft, Firefox password theft, Bitcoin mining, Bitcoin wallet theft, Keylogger, Winpcap interception, Double fastflux, USB vector, Send spam,
	\|CVE=CVE-2010-2568,		\|CVE=CVE-2010-2568,
	\|Status=~~Unknown~~		\|Status=
	\|BeginYear=~~Unknown~~		\|BeginYear=
	\|EndYear=~~Unknown~~		\|EndYear=
	\|Group=Spamming		\|Group=Spamming
	\|Fonctionnalités=* [[feature::Spam]]		\|Fonctionnalités=* [[feature::Spam]]

Eric.freyssinet at 00:21, 8 August 2015

2015-08-08T00:21:03Z

← Older revision		Revision as of 00:21, 8 August 2015
Line 1:		Line 1:
	{{Botnet		{{Botnet
	\|Introduction=~~Une première action contre ce~~ botnet ~~a été possible grâce à la fermeture du domaine~~ cz.cc.		\|Introduction=First attempt to shut down this botnet was done by closing the cz.cc domain.

	[[Image:Kelihos-Infection.png]]		[[Image:Kelihos-Infection.png]]
			\|Target=Microsoft Windows
			\|UserAgent=Unknown
			\|CCProtocol=P2P
			\|Feature=DDoS, Virtual machine detection, Fast flux, FTP password theft, Firefox password theft, Bitcoin mining, Bitcoin wallet theft, Keylogger, Winpcap interception, Double fastflux, USB vector, Send spam,
			\|CVE=CVE-2010-2568,
			\|Status=Unknown
			\|BeginYear=Unknown
			\|EndYear=Unknown
			\|Group=Spamming
	\|Fonctionnalités=* [[feature::Spam]]		\|Fonctionnalités=* [[feature::Spam]]
	* [[feature::USB vector]] (2012-10) [[cve::CVE-2010-2568]]		* [[feature::USB vector]] (2012-10) [[cve::CVE-2010-2568]]
Line 19:		Line 28:
	\|Infrastructure=* P2P via port 80		\|Infrastructure=* P2P via port 80
	\|Commercialisation=		\|Commercialisation=
	~~\|UserAgent=Unknown~~
	\|UserAgent2=		\|UserAgent2=
	\|UserAgent3=		\|UserAgent3=
Line 27:		Line 35:
	\|Language3=		\|Language3=
	\|Language4=		\|Language4=
	~~\|CCProtocol=P2P~~
	\|CC2=IRC		\|CC2=IRC
	\|CC3=		\|CC3=
	~~\|Target=Microsoft Windows~~
	\|OS2=		\|OS2=
	\|OS3=		\|OS3=
	\|OS4=		\|OS4=
	~~\|Status=Unknown~~
	~~\|BeginYear=Unknown~~
	~~\|EndYear=Unknown~~
	~~\|Group=Spamming~~
	\|Groupe2=		\|Groupe2=
	~~\|Alias=Waledac~~
	\|Vendor1=		\|Vendor1=
	~~\|Alias=Nap~~
	\|Vendor2=		\|Vendor2=
	~~\|Alias=Hlux~~
	\|Vendor3=		\|Vendor3=
	~~\|Alias=~~
	\|Vendor4=		\|Vendor4=
	~~\|Alias=~~
	\|Vendor5=		\|Vendor5=
	~~\|Alias=~~
	\|Vendor6=		\|Vendor6=
	~~\|Alias=~~
	\|Vendor7=		\|Vendor7=
	~~\|Alias=~~
	\|Vendor8=		\|Vendor8=
	~~\|Alias=~~
	\|Vendor9=		\|Vendor9=
	~~\|Alias=~~
	\|Vendor10=		\|Vendor10=
	~~\|Vector=~~
	\|Exploitkit2=		\|Exploitkit2=
	\|Exploitkit3=		\|Exploitkit3=

Eric.freyssinet: 1 revision imported

2015-02-04T22:03:15Z

1 revision imported

← Older revision		Revision as of 22:03, 4 February 2015
(No difference)

Eric.freyssinet at 09:25, 26 August 2014

2014-08-26T09:25:38Z

New page

{{Botnet
|Introduction=Une première action contre ce botnet a été possible grâce à la fermeture du domaine cz.cc.

[[Image:Kelihos-Infection.png]]
|Fonctionnalités=* [[feature::Spam]]
* [[feature::USB vector]] (2012-10) [[cve::CVE-2010-2568]]
* [[feature::Double fastflux]] for malware distribution
* [[feature::Winpcap interception]]
* [[feature::Keylogger]]
* [[feature::Bitcoin wallet theft]]
* [[feature::Bitcoin]] mining
* [[feature::Firefox password theft]]
* [[feature::FTP password theft]]
* [[feature::Fast flux]]
* [[feature::Virtual machine detection]]*
* [[feature::DDoS]]
|Illustrations=
|Commandes=
|Infrastructure=* P2P via port 80
|Commercialisation=
|UserAgent=Unknown
|UserAgent2=
|UserAgent3=
|UserAgent4=
|Language1=
|Language2=
|Language3=
|Language4=
|CCProtocol=P2P
|CC2=IRC
|CC3=
|Target=Microsoft Windows
|OS2=
|OS3=
|OS4=
|Status=Unknown
|BeginYear=Unknown
|EndYear=Unknown
|Group=Spamming
|Groupe2=
|Alias=Waledac
|Vendor1=
|Alias=Nap
|Vendor2=
|Alias=Hlux
|Vendor3=
|Alias=
|Vendor4=
|Alias=
|Vendor5=
|Alias=
|Vendor6=
|Alias=
|Vendor7=
|Alias=
|Vendor8=
|Alias=
|Vendor9=
|Alias=
|Vendor10=
|Vector=
|Exploitkit2=
|Exploitkit3=
|Exploitkit4=
|Exploitkit5=
|Victime1=
|Victime2=
|Victime3=
|Yara rules=
|Victime4=
}}
== Liens externes ==
* {{en}} [http://blogs.technet.com/b/microsoft_blog/archive/2011/09/27/microsoft-neutralizes-kelihos-botnet-names-defendant-in-case.aspx Microsoft démantèle le botnet Kelihos aux 3,8 milliards de spams quotidiens]
* {{en}} [http://threatpost.com/en_us/blogs/botnet-shutdown-success-story-how-kaspersky-lab-disabled-hluxkelihos-botnet-092911 The Inside Story of the Kelihos Botnet Takedown]