Jump to content

ZeroAccess: Difference between revisions

From Botnets.fr
m Remplacement du texte — « feature::Download » par « feature::File download »
 
No edit summary
 
(4 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{Botnet
{{Botnet
|Fonctionnalités=* [[feature::Click fraud]]
|Alias=Smiscer, Sirefef, Zaccess,
* Vol d'identifiants [[feature::FTP password theft|FTP]]
|Target=Microsoft Windows,
* [[feature::File download|Installation]] d'autres charges malveillantes
|Vector=Phoenix,
* [[feature::Bitcoin]] mining
|CCProtocol=HTTP, P2P,
* [[feature::Debugging detection]]
|Feature=Rootkit, RC4 encryption, XOR encoding, Bitcoin mining, Click fraud, FTP password theft, File download, Debugging detection,
|Commandes=Commandes du système de communication pair à pair:
|Group=Downloading,
* “getL” Requête de transmission de l'annuaire d'un pair.
* “retL” Retourne une portion (maximum 16) de l'annuaire P2P ainsi qu'un inventaire des fichiers disponibles (Réponse à la commande getL).
* "setL" Jamais observée dans la nature, cette commande semble proposer l'injection d'un noeud dans l'annuaire de la cible. 
* “getF” Requête d'un fichier binaire dont l'identifiant est obtenu par la réponse "retL".
* “setF” Retourne un fichier demandé (un PE Windows 32 bits ou parfois un fichier Javascript dans un faux fichier PE) (Réponse à "getF").
* “srv?” Détermine si un pair est un supernoeud
* “yes!” Réponse positive
* “news” Fournit de nouvelles données sur les fichiers disponibles
|Infrastructure=* Serveurs HTTP
* Moteur de recherche
* Communications pair à pair UDP et TCP sur les ports 13620, 21315, 21810, 22292, 16464
|UserAgent=Unknown
|CCProtocol=HTTP
|CC2=P2P
|Target=Microsoft Windows
|Status=Actif
|BeginYear=Unknown
|EndYear=Unknown
|Alias=Smiscer
|Vendor1=Kaspersky
|Alias=Sirefef
|Vendor2=Microsoft
|Alias=Zaccess
|Vendor3=Trend Micro
|Victime4=
}}
}}

Latest revision as of 00:32, 8 August 2015

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

ZeroAccess
Alias Smiscer, Sirefef, Zaccess
Group Downloading
Parent
Sibling
Family
Relations Variants:

Sibling of:
Parent of:
Distribution of:
Campaigns:

Target Microsoft Windows
Origin
Distribution vector Phoenix
UserAgent
CCProtocol HTTP (Centralized), P2P (Decentralized)
Activity /
Status
Language
Programming language
Operation/Working group

Introduction

Features


Associated images

Checksums / AV databases

Publications

 AuthorEditorYear
Cracking the encrypted C&C protocol of the ZeroAccess botnetJohn MorrisVirus Bulletin2012
Detecting extended attributes (ZeroAccess) and other Frankenstein’s monsters with HMFTHexacorn2013
Have we seen the end of the ZeroAccess botnet?James WykeSophos Labs2014
Major shift in strategy for ZeroAccess rootkit malware, as it shifts to user-modeJames WykeSophos Labs2012
Over 9 million PCs infected - ZeroAccess botnet uncoveredJames WykeSophos Labs2012
Panda Security uncovers bot-killing malwareBrian PrinceWired Business Media2012
Rovnix Reloaded: new step of evolutionDavid Harley
Aleksandr Matrosov
Eugene Rodionov		ESET2012
Step-by-step reverse engineering malware: ZeroAccess / Max++ / Smiscer crimeware rootkitGiuseppe BonfaInfosec Institute2010
TDL4 reloaded: Purple Haze all in my brainDavid Harley
Aleksandr Matrosov
Eugene Rodionov		ESET2012
The ZeroAccess botnet revealedAditya BalapureInfosec Institute2013
The ZeroAccess botnet: mining and fraud for massive financial gainJames WykeSophos Labs2012
The ZeroAccess rootkitJames WykeSophos2012
Trojan.ZeroAccess infection analysisSean Hittel
Rong Zhou		Symantec2012
ZACCESS/SIREFEF arrives with new infection techniqueManuel GatbuntonTrend Micro2012
ZeroAccess - new steps in evolutionArtem I. BaranovArtem Baranov2012
ZeroAccess anti-debug uses debuggerJoshua CannellMalwarebytes2013
ZeroAccess rootkit launched by signed installersKevin Beets
Peter Szor		McAfee2011
ZeroAccess's way of self-deletionWayneF-Secure2012
ZeroAccess: code injection chroniclesAleksandr MatrosovESET2012
Retrieved from "https://www.botnets.fr/index.php?title=ZeroAccess&oldid=11920"