TR-24 analysis - Destory RAT family - Revision history

Eric.freyssinet at 22:58, 30 July 2015

2015-07-30T22:58:07Z

← Older revision		Revision as of 22:58, 30 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|~~Type~~=~~Blogpost~~		\|Botnet=Destory, PlugX, Gulpix, Korplug, Thoper, Sogu, TVT
	\|~~Link~~=~~http://www.circl.lu/pub/tr-24/ www.circl.lu~~		\|Year=2014
	\|Date=2014-06-03		\|Date=2014-06-03
	\|Editor=CIRCL		\|Editor=CIRCL
	\|~~Year~~=~~2014~~		\|Link=http://www.circl.lu/pub/tr-24/
	\|~~Botnet~~=~~Destory, PlugX, Gulpix, Korplug, Thoper, Sogu, TVT~~		\|Type=Blogpost
	\|Abstract=The malware is used by a specific group of attackers specialized in industrial espionage starting from 2007 (Command Five). CIRCL published this report about Destory RAT family due to the regular confusion with the PlugX malware family. PlugX and Destory RAT malware are technically different for their respective initialization phase, utilized obfuscation techniques and other parts that will be outlined in this document, showing that both families are initially coming from the same malware writers, following the same internal and network communication protocols and using the same code for the vast majority of the code.		\|Abstract=The malware is used by a specific group of attackers specialized in industrial espionage starting from 2007 (Command Five). CIRCL published this report about Destory RAT family due to the regular confusion with the PlugX malware family. PlugX and Destory RAT malware are technically different for their respective initialization phase, utilized obfuscation techniques and other parts that will be outlined in this document, showing that both families are initially coming from the same malware writers, following the same internal and network communication protocols and using the same code for the vast majority of the code.

	All known malware family members (PlugX, Gulpix, Korplug, Destory, Thoper, Sogu, TVT) are briefly discussed in this document, showing differences and similarities that could lead to the assumption that an initial code base has been shared among different teams and used/enhanced for different purposes.		All known malware family members (PlugX, Gulpix, Korplug, Destory, Thoper, Sogu, TVT) are briefly discussed in this document, showing differences and similarities that could lead to the assumption that an initial code base has been shared among different teams and used/enhanced for different purposes.
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:30:32Z

1 revision imported

← Older revision		Revision as of 14:30, 7 February 2015
(No difference)

Eric.freyssinet at 13:21, 5 June 2014

2014-06-05T13:21:52Z

New page

{{Publication
|Type=Blogpost
|Link=http://www.circl.lu/pub/tr-24/ www.circl.lu
|Date=2014-06-03
|Editor=CIRCL
|Year=2014
|Botnet=Destory, PlugX, Gulpix, Korplug, Thoper, Sogu, TVT
|Abstract=The malware is used by a specific group of attackers specialized in industrial espionage starting from 2007 (Command Five). CIRCL published this report about Destory RAT family due to the regular confusion with the PlugX malware family. PlugX and Destory RAT malware are technically different for their respective initialization phase, utilized obfuscation techniques and other parts that will be outlined in this document, showing that both families are initially coming from the same malware writers, following the same internal and network communication protocols and using the same code for the vast majority of the code.

All known malware family members (PlugX, Gulpix, Korplug, Destory, Thoper, Sogu, TVT) are briefly discussed in this document, showing differences and similarities that could lead to the assumption that an initial code base has been shared among different teams and used/enhanced for different purposes.
}}