Leouncia - Yet another backdoor - Part 2

(Publication) Google search: [1]

Leouncia - Yet another backdoor - Part 2
Botnet	Leouncia
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2010 / 2010-12-14
Editor/Conference	FireEye
Link	http://blog.fireeye.com/research/2010/12/leouncia-yet-another-backdoor-part-2.html blog.fireeye.com (blog.fireeye.com Archive copy)
Author	Atif Mushtaq
Type

Abstract

“ Leouncia's C&C payload decryption consists of two major phases. The first part is the formulation of a dynamic permutation table using a variable 128 bit key. This permutation table is further used to decrypt the actual payload.

Let me explain it step by step...

Bibtex

 @misc{2010BFR1205,
   editor = {FireEye},
   author = {Atif Mushtaq},
   title = {Leouncia - Yet another backdoor - Part 2},
   date = {14},
   month = Dec,
   year = {2010},
   howpublished = {\url{http://blog.fireeye.com/research/2010/12/leouncia-yet-another-backdoor-part-2.html blog.fireeye.com}},
 }