Eric.freyssinet: Text replacement - " www.securelist.com" to ""

2015-02-07T17:00:01Z

Text replacement - " www.securelist.com" to ""

← Older revision		Revision as of 17:00, 7 February 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.securelist.com/en/blog/663/The_where_and_why_of_HLUX ~~www.securelist.com~~		\|Link=http://www.securelist.com/en/blog/663/The_where_and_why_of_HLUX
	\|Author=Sergey Golovanov,		\|Author=Sergey Golovanov,
	\|NomRevue=Securelist		\|NomRevue=Securelist

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:07Z

1 revision imported

← Older revision		Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

2014-08-27T16:29:54Z

Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

New page

{{Publication
|Image=securelist1.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.securelist.com/en/blog/663/The_where_and_why_of_HLUX www.securelist.com
|Author=Sergey Golovanov,
|NomRevue=Securelist
|Date=February 15 2012
|Editor=Kaspersky lab
|Year=2012
|ISBN=
|Page=
|Abstract=This is not the first time the HLUX botnet has been mentioned in this blog, but there are still some unanswered questions that we’ve been receiving from the media: What is the botnet’s sphere of activity? What sort of commands does it receive from malicious users? How does the bot spread? How many infected computers are there in the botnet?

Before answering the questions it’s important to clarify that the HLUX botnet we previously disabled is still under control and the infected machines are not receiving commands from the C&C, so they’re not sending spam. Together with Microsoft’s Digital Crimes Unit, SurfNET and Kyrus Tech, Inc., Kaspersky Lab executed a sinkhole operation, which disabled the botnet and its backup infrastructure from the C&C.

The answers below refer to a new version of the HLUX botnet – it’s a different botnet but the malware being used is build using the same HLUX coding. Analysis of a new bot version for the HLUX botnet (md5: 010AC0BFF69EB945108B57B40A4784BE, size: 882176 B) revealed the following information.
|Botnet=Hlux, Gbot, Virut, Bredolab,
|Malware=Hlux_(bot), TDSS,
|CCProtocol=P2P,
|Operation=,
|Keyword=,
}}

The where and why of Hlux - Revision history

Eric.freyssinet: Text replacement - " www.securelist.com" to ""

Eric.freyssinet: 1 revision imported

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »