https://www.botnets.fr/index.php?action=history&feed=atom&title=TDL4_reloaded%3A_Purple_Haze_all_in_my_brainTDL4 reloaded: Purple Haze all in my brain - Revision history2026-10-24T04:54:55ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=TDL4_reloaded:_Purple_Haze_all_in_my_brain&diff=1951&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:23:05Z<p>1 revision imported</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:23, 7 February 2015</td>
</tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr>
<!-- diff cache key wiki:diff:1.41:old-1950:rev-1951 -->
</table>Eric.freyssinethttps://www.botnets.fr/index.php?title=TDL4_reloaded:_Purple_Haze_all_in_my_brain&diff=1950&oldid=prevEric.freyssinet: Remplacement du texte — « Eset » par « ESET »2012-08-19T17:55:16Z<p>Remplacement du texte — « Eset » par « ESET »</p>
<p><b>New page</b></p><div>{{Publication<br />
|Image=purplehaze1.png<br />
|Legend=<br />
|Document=<br />
|Licence=<br />
|Video=<br />
|Link=http://blog.eset.com/2012/02/02/tdl4-reloaded-purple-haze-all-in-my-brain blog.eset.com<br />
|Author=David Harley, Eugene Rodionov, Aleksandr Matrosov, <br />
|NomRevue=ESET Threat Blog<br />
|Date=February 3, 2012<br />
|Editor=ESET<br />
|Year=2012<br />
|ISBN=<br />
|Page=<br />
|Abstract=This week we received an untypical sample of Win32/Olmarik.AYD ([[TDL4]]) from [[Mila]] (of the contagiodump blog). We have already spent a long time tracking TDL4 bootkit family ([[The Evolution of TDL: Conquering x64]]) and this time we are seeing key modifications to the dropper and hidden file system. In the dropper we find some interesting mechanisms for privilege escalation: this is something we haven’t seen before in Win32/Olmarik droppers. The first interesting discovery is that the dropper downloads and executes a legitimate Adobe Flash Player installer to be launched in the context of the “trusted” application. In the November of the last year Win32/Sirefef ([[ZeroAccess]]) used the same technique to implement a DLL hijacking attack with the msimg32.dll module.<br />
|Botnet=TDL-4, <br />
|Malware=TDL-4 (bot), Purple Haze, ZeroAccess, <br />
|CCProtocol=, <br />
|Operation=, <br />
|Keyword=RC4, bootkit, <br />
}}</div>Eric.freyssinet