Edit Publication: Malware 2 - from infection to persistence

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

Image:
Legend:
Botnet:
Malware:
Exploit kit:
Services:
Target:
Origin:
Campaign:
Feature:
Strings:
Distribution vector:
Vulnerability:
CCProtocol:
Programming language:
Botnet/malware group:
Operation/working group:
Year:
Date:
Editor/Conference:
Link:
DOI:
Author:
Type:
Abstract:	In my previous posting, a malicious PDF was analysed that originated from a targeted email campaign that exposed a number of users to infection. The PDF file implemented standard exploitation techniques to exploit issues in Adobe PDF reader to download an executable from a known malicious URL (Malware 1 - From Exploit to Infection). In this post I will look at how the malware sample persists on the infected host using stealth, anti-debugging and common userland hooking and rootkit techniques. The initial analysis of this sample identified that the subsequent download was in fact a dangerous data theft Trojan known as Carberp. This Trojan is primarily associated with financial and data theft and has been compared to the more prevalent ZeuS and SpyEye families. This is due to the similar data exfiltration capabilities of the Carberp family.

Free text:

Summary:

This is a minor edit

Watch this page

Navigation menu