ZeroAccess: Difference between revisions

Revision as of 00:07, 1 August 2015

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

ZeroAccess
Alias	Smiscer, Sirefef, Zaccess
Group	Downloading
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target	Microsoft Windows
Origin
Distribution vector	Phoenix
UserAgent
CCProtocol	HTTP (Centralized), P2P (Decentralized)
Activity	/
Status
Language
Programming language
Operation/Working group

Introduction

Features

Rootkit

RC4 encryption

XOR encoding

Associated images

Checksums / AV databases

Publications

	Author	Editor	Year
Cracking the encrypted C&C protocol of the ZeroAccess botnet	John Morris	Virus Bulletin	2012
Detecting extended attributes (ZeroAccess) and other Frankenstein’s monsters with HMFT		Hexacorn	2013
Have we seen the end of the ZeroAccess botnet?	James Wyke	Sophos Labs	2014
Major shift in strategy for ZeroAccess rootkit malware, as it shifts to user-mode	James Wyke	Sophos Labs	2012
Over 9 million PCs infected - ZeroAccess botnet uncovered	James Wyke	Sophos Labs	2012
Panda Security uncovers bot-killing malware	Brian Prince	Wired Business Media	2012
Rovnix Reloaded: new step of evolution	David Harley Aleksandr Matrosov Eugene Rodionov	ESET	2012
Step-by-step reverse engineering malware: ZeroAccess / Max++ / Smiscer crimeware rootkit	Giuseppe Bonfa	Infosec Institute	2010
TDL4 reloaded: Purple Haze all in my brain	David Harley Aleksandr Matrosov Eugene Rodionov	ESET	2012
The ZeroAccess botnet revealed	Aditya Balapure	Infosec Institute	2013
The ZeroAccess botnet: mining and fraud for massive financial gain	James Wyke	Sophos Labs	2012
The ZeroAccess rootkit	James Wyke	Sophos	2012
Trojan.ZeroAccess infection analysis	Sean Hittel Rong Zhou	Symantec	2012
ZACCESS/SIREFEF arrives with new infection technique	Manuel Gatbunton	Trend Micro	2012
ZeroAccess - new steps in evolution	Artem I. Baranov	Artem Baranov	2012
ZeroAccess anti-debug uses debugger	Joshua Cannell	Malwarebytes	2013
ZeroAccess rootkit launched by signed installers	Kevin Beets Peter Szor	McAfee	2011
ZeroAccess's way of self-deletion	Wayne	F-Secure	2012
ZeroAccess: code injection chronicles	Aleksandr Matrosov	ESET	2012

@@ Line 4: / Line 4: @@
 |Vector=Phoenix,
 |CCProtocol=HTTP, P2P,
+|Feature=Rootkit, RC4 encryption, XOR encoding,
+|Group=Downloading,
 }}