Eric.freyssinet: 1 revision imported

2015-02-07T14:30:08Z

1 revision imported

← Older revision		Revision as of 14:30, 7 February 2015
(No difference)

Eric.freyssinet at 14:33, 2 July 2013

2013-07-02T14:33:00Z

New page

{{Publication
|Type=Blogpost
|Link=http://resources.infosecinstitute.com/the-zeroaccess-botnet-revealed/ resources.infosecinstitute.com
|Author=Aditya Balapure
|NomRevue=Infosec Institute Resources
|Date=2013-07-01
|Editor=Infosec Institute
|Year=2013
|Botnet=ZeroAccess
|Abstract=On similar lines, the ZeroAccess Botnet is a specialised Trojan horse that affects the Windows operating systems and downloads malware to an infected machine to form a botnet. Read about how we reverse-engineered the ZeroAccess trojan here. With reference to Symantec’s analysis of this Trojan, it is said to use an advanced rootkit to hide itself. To set up its own botnet system, this Trojan creates its own hidden file system, downloads more malware from the connected environment, and opens up a back door for access on the compromised system. The attacker is then able to perform actions as per his requirements and the victim’s system becomes a part of the botnet. The name ZeroAccess has been coined due to the fact that a string found in the kernel driver code points to the original project folder ZeroAccess. It is also code named max++ due to its capability of creating a kernel object __max++>
}}

The ZeroAccess botnet revealed - Revision history

Eric.freyssinet: 1 revision imported

Eric.freyssinet at 14:33, 2 July 2013