https://www.botnets.fr/index.php?action=history&feed=atom&title=TDSS_botnet%3A_full_disclosureTDSS botnet: full disclosure - Revision history2026-10-24T07:42:19ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=TDSS_botnet:_full_disclosure&diff=2730&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:29:11Z<p>1 revision imported</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:29, 7 February 2015</td>
</tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr>
<!-- diff cache key wiki:diff:1.41:old-2729:rev-2730 -->
</table>Eric.freyssinethttps://www.botnets.fr/index.php?title=TDSS_botnet:_full_disclosure&diff=2729&oldid=prevEric.freyssinet at 22:10, 6 December 20122012-12-06T22:10:41Z<p></p>
<p><b>New page</b></p><div>{{Publication<br />
|Link=http://nobunkum.ru/analytics/en-tdss-botnet nobunkum.ru<br />
|Author=Andrey Rassokhin, Dmitry Oleksyuk<br />
|Date=2012-03-17<br />
|Editor=Esage Lab<br />
|Year=2012<br />
|ISBN=No Bunkum<br />
|Botnet=TDSS<br />
|Abstract=TDSS is a wide-spread rootkit which forms a powerful botnet. TDSS is studied pretty well today. Howewer, no studies include anything beyond analysis of binary code and common attack vectors. Main goal of this article is to fill this gap in the IT security knowledge base by uncovering the TDSS botnet mechanisms.<br/><br/><br />
<br />
Also, we are humbly hoping to benefit to the existing computer crimes investigation methodology. This research shows a generic way to locate the “digital core” of a cyberband, having only their instrument (a malicious binary file). Pease note that this method makes it possible to find all technical info about an incident, while personal identification and prosecution of intruders remains in law-enforcement authorities sphere.<br/><br/><br />
<br />
The article consists of two parts. In the first part the process of breaking into the botnet is covered step-by-step. The second part is dedicated to analysis of the botnet’s inner details. Because we gained access to the C&C database, objective statistics of the botnet is included at the end of the article.<br />
}}</div>Eric.freyssinet