View source for TDL3 : Why so serious

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://virusvn.com/download/video-tutorial/tdl3_analysis_paper.pdf
|Author=Nguyễn Phố Sơn, 
|NomRevue=
|Date=
|Editor=
|Year=
|ISBN=
|Page=
|Abstract=TDL or TDSS family is a famous trojan variant for its effectiveness and active technical
development. It contains couple compoments: a kernel-mode rootkit and user-mode
DLLs which performs the trojan operation such as downloaders, blocking Avs, etc,. Since
the rootkit acts as an “injector” and protector for the usermode bot binaries, almost all
technical evolutions of this threat family focus on rootkit technology so as to evade AV
scanners.
As in its name, TDL3 is the 3rd generation of TDL rootkit which still takes its aims at
convering stealthy existences of its malicious codes. Beside known features, this threat is
exposed with a couple of impressive tricks which help it bypassing personal firewall and
staying totally undetected by all AVs and ARKs at the moment. These aspects and
techniques will be discussed in more detail in the sections that follow.
|Botnet=TDSS, 
|Malware=TDL-3 (bot), 
|CCProtocol=HTTP, 
|Operation=, 
|Keyword=, 
}}