Eric.freyssinet: Created page with "{{Publication |Botnet=Morto, |CCProtocol=DNS, |Year=2011 |Date=2011-08-31 |Editor=Symantec |Link=http://www.symantec.com/connect/blogs/morto-worm-sets-dns-record |Author=Catha..."

2015-07-30T19:37:00Z

Created page with "{{Publication |Botnet=Morto, |CCProtocol=DNS, |Year=2011 |Date=2011-08-31 |Editor=Symantec |Link=http://www.symantec.com/connect/blogs/morto-worm-sets-dns-record |Author=Catha..."

New page

{{Publication
|Botnet=Morto,
|CCProtocol=DNS,
|Year=2011
|Date=2011-08-31
|Editor=Symantec
|Link=http://www.symantec.com/connect/blogs/morto-worm-sets-dns-record
|Author=Cathal Mullaney,
|Type=Blogpost
|Abstract=There has been a lot of coverage of the recent RDP capable W32.Morto worm, but one of the more interesting aspects of the worm’s behavior appears to have been overlooked. Most malware that we have seen recently has some means of communication with a remote Command and Control (C&C) server. The actual vector of communication tends to vary between threats. For example, W32.IRCBot uses Internet Relay Chat channels whereas the recent high profile threat, Trojan.Downbot, is capable of reading commands embedded in HTML pages and image files. W32.Morto has added another C&C communication vector by supplying remote commands through Domain Name System (DNS) records.
}}

Morto worm sets a (DNS) record - Revision history

Eric.freyssinet: Created page with "{{Publication |Botnet=Morto, |CCProtocol=DNS, |Year=2011 |Date=2011-08-31 |Editor=Symantec |Link=http://www.symantec.com/connect/blogs/morto-worm-sets-dns-record |Author=Catha..."