Kelihos

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Kelihos
Alias
Group	Spamming
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target	Microsoft Windows
Origin
Distribution vector
UserAgent
CCProtocol	P2P (Decentralized)
Activity	/
Status
Language
Programming language
Operation/Working group	Operation b79

Introduction

First attempt to shut down this botnet was done by closing the cz.cc domain.

Features

• DDoS

• Virtual machine detection

• Fast flux

• FTP password theft

• Firefox password theft

• Bitcoin mining

• Bitcoin wallet theft

• Keylogger

• Winpcap interception

• Double fastflux

• USB vector

• Send spam

CVE: CVE-2010-2568

Publications

	Author	Editor	Year
A quick update on spambot Kelihos		Abuse.ch	2012
An encounter with trojan Nap	Ali Islam Abhishek Singh	FireEye	2013
An overview of messaging botnets	François Paget	McAfee	2013
Battling the Rustock threat	Marc Lauricella Holly Stewart T.J. Campana David Anselmi Richard Boscovich Samantha Doerr Oleg Petrovsky Tareq Saade	Microsoft	2011
Botnet shutdown success story - again: disabling the new Hlux/Kelihos botnet	Stefan Ortloff	Kaspersky lab	2012
Botnet shutdown success story: how Kaspersky Lab disabled the Hlux/Kelihos botnet	Tillmann Werner	Kaspersky lab	2011
FAQ on Kelihos.B/Hlux.B sinkholing	David Dittrich	The Honeynet Project	2012
Kelihos back in town using Fast Flux		Abuse.ch	2012
Kelihos botnet appears again with new variant	Jay Pfoutz	Secure Connexion	2013
Kelihos botnet trying to expand by harnessing Russian national sentiments	Ran Mosessco Nick Griffin Brandon Laux	Websense	2014
Kelihos is dead. Long live Kelihos	Gunter Ollmann	Damballa	2012
Kelihos is dead… No wait… Long live Kelihos! Again!	Phil Hay	Trustwave	2013
Kelihos/Hlux botnet returns with new techniques	Maria Garnaeva	Kaspersky lab	2012
Kelihos: not alien resurrection, more attack of the clones	David Harley	ESET	2012
Latest Kelihos botnet shut down live at RSA Conference 2013	Michael Mimoso	Kaspersky lab	2013
Long life to Kelihos!	Gianluca Giuliani	Websense	2012
Microsoft neutralizes Kelihos botnet, names defendant in case	Richard Domingues Boscovich	Microsoft	2011
P2P botnet Kelihos.B with 100.000 nodes sinkholed	Tillmann Werner		2012
The where and why of Hlux	Sergey Golovanov	Kaspersky lab	2012
Trojan Nap aka Kelihos/Hlux - Feb. 2013 status update	Mila Parkour	DeepEnd Research	2013
ZeuSbot/Spyeye P2P updated, fortifying the botnet	Andrea Lelli	Symantec	2012

Liens externes

• Template:En Microsoft démantèle le botnet Kelihos aux 3,8 milliards de spams quotidiens
• Template:En The Inside Story of the Kelihos Botnet Takedown