Difference between revisions of "Avatar rootkit: the continuing saga"
Jump to navigation
Jump to search
(Created page with "{{Publication |Botnet=Avatar, |Feature=File download, |Year=2013 |Date=2013-08-21 |Editor=ESET Welivesecurity |Link=http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the...") |
|||
| Line 6: | Line 6: | ||
|Editor=ESET Welivesecurity | |Editor=ESET Welivesecurity | ||
|Link=http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the-continuing-saga/ | |Link=http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the-continuing-saga/ | ||
|Author=Aleksandr Matrosov, | |Author=Aleksandr Matrosov, Eugene Rodionov, Anton Cherepanov, | ||
|Type=Blogpost | |Type=Blogpost | ||
|Abstract=Back at the beginning of May we posted preliminary information about Win32/Rootkit.Avatar rootkit (Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication). One of the major questions not covered in that previous research was this: What payload and plugins does Avatar install onto infected machines? We continue our research and are still tracking this malware family. In the middle of July we detected a repacked Win32/Rootkit.Avatar with an active command and control (C&C) server. In this blog post we confirm that Avatar in-the-wild activity continues, and disclose some new information about its kernel-mode self-defense tricks. | |Abstract=Back at the beginning of May we posted preliminary information about Win32/Rootkit.Avatar rootkit (Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication). One of the major questions not covered in that previous research was this: What payload and plugins does Avatar install onto infected machines? We continue our research and are still tracking this malware family. In the middle of July we detected a repacked Win32/Rootkit.Avatar with an active command and control (C&C) server. In this blog post we confirm that Avatar in-the-wild activity continues, and disclose some new information about its kernel-mode self-defense tricks. | ||
}} | }} | ||
Latest revision as of 20:22, 30 July 2015
(Publication) Google search: [1]
| Avatar rootkit: the continuing saga | |
|---|---|
| Botnet | Avatar |
| Malware | |
| Botnet/malware group | |
| Exploit kits | |
| Services | |
| Feature | File download |
| Distribution vector | |
| Target | |
| Origin | |
| Campaign | |
| Operation/Working group | |
| Vulnerability | |
| CCProtocol | |
| Date | 2013 / 2013-08-21 |
| Editor/Conference | ESET Welivesecurity |
| Link | http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the-continuing-saga/ (Archive copy) |
| Author | Aleksandr Matrosov, Eugene Rodionov, Anton Cherepanov |
| Type | Blogpost |
Abstract
“ Back at the beginning of May we posted preliminary information about Win32/Rootkit.Avatar rootkit (Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication). One of the major questions not covered in that previous research was this: What payload and plugins does Avatar install onto infected machines? We continue our research and are still tracking this malware family. In the middle of July we detected a repacked Win32/Rootkit.Avatar with an active command and control (C&C) server. In this blog post we confirm that Avatar in-the-wild activity continues, and disclose some new information about its kernel-mode self-defense tricks.
Bibtex
@misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2013BFR1882,
editor = {ESET Welivesecurity},
author = {Aleksandr Matrosov, Eugene Rodionov, Anton Cherepanov},
title = {Avatar rootkit: the continuing saga},
date = {21},
month = Aug,
year = {2013},
howpublished = {\url{http://www.welivesecurity.com/2013/08/21/avatar-rootkit-the-continuing-saga/}},
}