Eric.freyssinet: 1 revision imported

2015-02-07T14:23:11Z

1 revision imported

← Older revision	Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet at 00:27, 25 November 2012

2012-11-25T00:27:31Z

New page

{{Publication
|Image=longlifekelihos.png
|Link=http://community.websense.com/blogs/securitylabs/archive/2012/02/17/long-life-to-kelihos.aspx
|Author=Gianluca Giuliani
|NomRevue=Websense Security Labs blog
|Date=2012-02-17
|Editor=Websense
|Year=2012
|Botnet=Kelihos
|Malware=Hlux_(bot)
|Abstract=During the past months, the spam engine Kelihos has attracted the attention of many people, including security company researchers and analysts. Very interesting also was the recent official Microsoft response where has been confirmed a new generation of Kelihos variants derived from the previous. The Websense® Security Labs™ Spam Trap system has detected a variant of Kelihos that is apparently still active.

We focused our research on trying to uncover the Kelihos command and control infrastructure and P2P network, along with some features of the botnet that we could recognize, including enhancements. The first interesting thing we noticed was in a sample of the network traffic generated by the bot before it starts its spam activity. As shown below, the bot generates a first request to an IP address that is listening on HTTP port 80
}}

Long life to Kelihos! - Revision history

Eric.freyssinet: 1 revision imported

Eric.freyssinet at 00:27, 25 November 2012