HTran and the Advanced Persistent Threat
Revision as of 13:01, 31 July 2015 by Eric.freyssinet (talk | contribs) (Text replacement - "/ www." to "/ |Site=www.")
(Publication) Google search: [1]
| HTran and the Advanced Persistent Threat | |
|---|---|
| Botnet | |
| Malware | HTran |
| Botnet/malware group | |
| Exploit kits | |
| Services | |
| Feature | |
| Distribution vector | |
| Target | |
| Origin | |
| Campaign | |
| Operation/Working group | |
| Vulnerability | |
| CCProtocol | |
| Date | 2011 / 2011-08-03 |
| Editor/Conference | DELL SecureWorks |
| Link | http://www.secureworks.com/cyber-threat-intelligence/threats/htran/ (Archive copy) |
| Author | Joe Stewart |
| Type | Blogpost |
Abstract
“ While researching one of the malware families involved in the RSA breach disclosed in March 2011, Dell SecureWorks CTU observed an interesting pattern in the network traffic of a related sample (MD5:53ba6845f57f8e9ef600ef166be3be14). When the sample under analysis attempted to connect to the C2 server at my.amazingrm.com (203.92.45.2), the server returned a succinct plain-text error message instead of the expected HTTP-formatted response:
[SERVER]connection to funn
Bibtex
@misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2011BFR1278,
editor = {DELL SecureWorks},
author = {Joe Stewart},
title = {HTran and the Advanced Persistent Threat},
date = {03},
month = Aug,
year = {2011},
howpublished = {\url{http://www.secureworks.com/cyber-threat-intelligence/threats/htran/}},
}