TDSS/TDL3 RK's investigation and analysis

TDSS Rootkits analysis

http://www.securelist.com/ru/analysis/208050642/TDSS

Lots of background info in there. I used http://translate.google.com/translate

Another analysis


TDL3:*The*Rootkit*of*All*Evil?**
*

http://www.eset.com/resources/white-papers/TDL3-Analysis.pdf


They are still at it today, and using Fake SSL Certs once again.







Managed to grab the MZ etc source from one of the www's and converted it to TDL.exe



VT was down ? and not just the HTTPS version, as was http://virscan.org ? so i used http://virusscan.jotti.org and http://viruschief.com Also scanned locally with Avira and Prevx = NO detects from ANY so it's definately a fresh nasty

Now on the way to vendors

 

Thanks. Here is another paper on the subject
http://www.eset.com/blog/2010/06/25/tidy-tdss-tld3-paper

 

@Cudni

Hi, the link you gave leads to the PDF one i listed

Thanks for thinking along the same lines though, always good to get nice info

 

Always. And my link, although in error, will serve as redundancy in case anybody misses it at first

 

@Cudni

Indeedy weedy

 

Thanks for the links

 

The Case of TDL3

Ace from our Kuala Lumpur lab has written a technical white paper on the internals of the highly advanced TDL3 trojan. The paper goes deep into the features of this advanced backdoor/rootkit.

http://www.f-secure.com/weblog/archives/00001976.html