https://www.botnets.fr/index.php?action=history&feed=atom&title=TDL3_%3A_The_rootkit_of_all_evil 2026-10-24T00:45:36Z Revision history for this page on the wiki MediaWiki 1.43.11 https://www.botnets.fr/index.php?title=TDL3_:_The_rootkit_of_all_evil&diff=1981&oldid=prev 2015-02-07T14:23:16Z

<p>1 revision imported</p> <p><b>New page</b></p><div>{{Publication<br /> |Image=<br /> |Legend=<br /> |Document=<br /> |Licence=<br /> |Video=<br /> |Link=http://go.eset.com/us/resources/white-papers/TDL3-Analysis.pdf<br /> |Author=Aleksandr Matrosov, Eugene Rodionov, <br /> |NomRevue=ESET White papers<br /> |Date=<br /> |Editor=ESET<br /> |Year=2010<br /> |ISBN=<br /> |Page=<br /> |Abstract=Not so long ago one of our clients asked us to analyze a set of TDSS droppers and to locate the<br /> source of the threat. During our investigation we found evidence of the complicity of one of the wellknown<br /> cybercrime groups in distributing those rootkits. The droppers were distributed using a Pay‐Per‐<br /> Install (PPI) scheme well‐known and growing increasingly popular among cybercrime groups . The PPI<br /> scheme is similar to those used for distributing toolbars for the browsers. For instance, if you are a<br /> partner of Google and distribute its toolbars then you have a special build with an embedded identifier<br /> which allows for calculating the number of your installations and therefore your revenue. The same<br /> approach is used for distributing the rootkits: information about the distributor is embedded into the<br /> executable and there are special servers used to calculate the number of installations.<br /> |Botnet=TDSS, <br /> |Malware=TDL-3 (bot), <br /> |CCProtocol=HTTP, <br /> |Operation=, <br /> |Keyword=, <br /> }}</div>

Eric.freyssinet