https://www.botnets.fr/index.php?action=history&feed=atom&title=TDL3_%3A_Why_so_seriousTDL3 : Why so serious - Revision history2026-10-25T05:56:15ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=TDL3_:_Why_so_serious&diff=1983&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:23:16Z<p>1 revision imported</p>
<p><b>New page</b></p><div>{{Publication<br />
|Image=<br />
|Legend=<br />
|Document=<br />
|Licence=<br />
|Video=<br />
|Link=http://virusvn.com/download/video-tutorial/tdl3_analysis_paper.pdf<br />
|Author=Nguyễn Phố Sơn, <br />
|NomRevue=<br />
|Date=<br />
|Editor=<br />
|Year=<br />
|ISBN=<br />
|Page=<br />
|Abstract=TDL or TDSS family is a famous trojan variant for its effectiveness and active technical<br />
development. It contains couple compoments: a kernel-mode rootkit and user-mode<br />
DLLs which performs the trojan operation such as downloaders, blocking Avs, etc,. Since<br />
the rootkit acts as an “injector” and protector for the usermode bot binaries, almost all<br />
technical evolutions of this threat family focus on rootkit technology so as to evade AV<br />
scanners.<br />
As in its name, TDL3 is the 3rd generation of TDL rootkit which still takes its aims at<br />
convering stealthy existences of its malicious codes. Beside known features, this threat is<br />
exposed with a couple of impressive tricks which help it bypassing personal firewall and<br />
staying totally undetected by all AVs and ARKs at the moment. These aspects and<br />
techniques will be discussed in more detail in the sections that follow.<br />
|Botnet=TDSS, <br />
|Malware=TDL-3 (bot), <br />
|CCProtocol=HTTP, <br />
|Operation=, <br />
|Keyword=, <br />
}}</div>Eric.freyssinet