Eric.freyssinet at 19:07, 31 July 2015

2015-07-31T19:07:29Z

← Older revision		Revision as of 19:07, 31 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|~~Image~~=		\|Botnet=Ponmocup,
	\|~~Legend~~=		\|Malware=,
	\|~~Document~~=		\|CCProtocol=,
	\|~~Licence~~=		\|Operation=,
	~~\|Video=~~
	~~\|Link=http://security-research.dyndns.org/pub/botnet/ponmocup/ponmocup-analysis_2012-02-18.html security-research.dyndns.org~~
	~~\|Author=Tom U~~,
	~~\|NomRevue=~~
	~~\|Date=~~
	~~\|Editor=~~
	\|Year=2012		\|Year=2012
	\|~~ISBN~~=		\|Link=http://security-research.dyndns.org/pub/botnet/ponmocup/ponmocup-analysis_2012-02-18.html
	\|~~Page~~=		\|Author=Tom U,
	\|Abstract=Why is this malware known under so many different names? (Ponmocup, Pirminay, Kryptik, Swisyn, Vundo etc.)		\|Abstract=Why is this malware known under so many different names? (Ponmocup, Pirminay, Kryptik, Swisyn, Vundo etc.)
	Why aren't AV companies connecting the dots?		Why aren't AV companies connecting the dots?
Line 25:		Line 19:
	HKLM\SOFTWARE\[pseudo-random-key]		HKLM\SOFTWARE\[pseudo-random-key]
	which seems to be consistent amongst systems with a certain trait (maybe same company, domain or similar).		which seems to be consistent amongst systems with a certain trait (maybe same company, domain or similar).
	\|~~Botnet~~=~~Ponmocup,~~		\|Document=
	\|~~Malware~~=,		\|Licence=
	\|~~CCProtocol~~=,		\|Video=
	\|~~Operation~~=,		\|NomRevue=
	\|Keyword=,		\|ISBN=
			\|Page=
			\|Keyword=,
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:27:02Z

1 revision imported

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://security-research.dyndns.org/pub/botnet/ponmocup/ponmocup-analysis_2012-02-18.html security-research.dyndns.org
|Author=Tom U,
|NomRevue=
|Date=
|Editor=
|Year=2012
|ISBN=
|Page=
|Abstract=Why is this malware known under so many different names? (Ponmocup, Pirminay, Kryptik, Swisyn, Vundo etc.)
Why aren't AV companies connecting the dots?

Using one common indicator, the existence or creation of a registry key, namely
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\6
and/or
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\6
I've been finding malware analysis reports from different AV's and online malware analysis sites.

Another indicator is the existence of a pseudo-random registry key under
HKLM\SOFTWARE\[pseudo-random-key]
which seems to be consistent amongst systems with a certain trait (maybe same company, domain or similar).
|Botnet=Ponmocup,
|Malware=,
|CCProtocol=,
|Operation=,
|Keyword=,
}}

Ponmocup analysis - Revision history

Eric.freyssinet at 19:07, 31 July 2015

Eric.freyssinet: 1 revision imported