Eric.freyssinet: 1 revision imported

2015-02-07T14:23:30Z

1 revision imported

← Older revision		Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet at 18:17, 4 March 2012

2012-03-04T18:17:04Z

New page

{{Publication
|Image=kelihos_back_intown.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.abuse.ch/?p=3658 abuse.ch
|Author=,
|NomRevue=The Swiss Security Blog
|Date=March 4, 2012
|Editor=abuse.ch
|Year=2012
|ISBN=
|Page=
|Abstract=In September 2011, Microsoft announced the takedown of the Kelihos botnet. In the beginning of 2012, Kaspersky found a new version of Kelihos in the wild.

Kelihos (also know as Hlux) is a Spambot with the capability to steal credentials from the victims computer and drop additional malware. While the old version used the second level domain cz.cc for it’s distribution and to control the botnet, the new version takes advantage of TLD .eu in combination with Fast Flux techniques.

*** The Kelihos Spambot ***

Recently, I spotted a sample of Kelihos in my sandnet, so I decided to have a short look at it:

As soon the victims computer has been infected successfully, the malware will try to drop an additional file by calling a .eu domain which seem to be hard coded in the infection binary:
[...]
'''Therefore it should be very easy to detect Kelihos in your network, just watch out for HTTP GET request containing the header field “Content-Length”.'''
|Botnet=Kelihos, Waledac,
|Malware=,
|CCProtocol=P2P,
|Operation=,
|Keyword=Fast Flux,
}}

Kelihos back in town using Fast Flux - Revision history

Eric.freyssinet: 1 revision imported

Eric.freyssinet at 18:17, 4 March 2012