TDL-4

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

TDL-4
Alias
Group	Downloading
Parent	TDSS
Sibling
Family	TDSS (family)
Relations	Variants: Sibling of: TDL-3 Parent of: DGAv14 Distribution of: Campaigns:
Target
Origin
Distribution vector
UserAgent
CCProtocol	HTTPS (Centralized), Kademlia P2P (Decentralized)
Activity	2011 / Unknown
Status	Unknown
Language
Programming language
Operation/Working group

Features

• File download

• Affiliation

• Custom XOR-based encryption

• Bootkit

• Removal of competing malware

• Proxy

Publications

	Author	Editor	Year
A new iteration of the TDSS/TDL-4 malware using DGA-based command and control		Damballa	2012
Analysis of TDL4	Sergei Shevchenko	BAE Systems	2012
Olmasco bootkit: next circle of TDL4 evolution (or not)	Aleksandr Matrosov	Eset	2012
Researchers: Bredolab still lurking, though severely injured	Steve Ragan		2010
TDL4 - Top Bot	Sergey Golovanov Igor Soumenkov	Kaspersky lab	2011
TDL4 reloaded: Purple Haze all in my brain	David Harley Aleksandr Matrosov Eugene Rodionov	ESET	2012
Unveiling the network criminal infrastructure of TDSS/TDL4 - DGAv14: a case study on a new TDSS/TDL4 variant	Manos Antonakakis Jeremy Demar David Dagon Kevin Stevens	Damballa	2012
Zeroing in on malware propagation methods	Joe Faulhaber David Felstead Paul Henry Jeff Jones Ellen Cram Kowalczyk Jimmy Kuo John Lambert Marc Lauricella Aaron Margosis Michelle Meyer Anurag Pandit Anthony Penta Dave Probert Tim Rains Mark E. Russinovich Weijuan Shi Adam Shostack Frank Simorjay Hemanth Srinivasan Holly Stewart Matt Thomlinson Jeff Williams Scott Wu Terry Zink	Microsoft	2011