Security-X
Forum Security-X => News => Discussion démarrée par: SX-News le février 02, 2012, 19:07:50
-
TDL4 reloaded: Purple Haze all in my brain
Description : This week we received an untypical sample of Win32/Olmarik.AYD (TDL4) from Mila (of the contagiodump blog)
Lien : http://blog.eset.com/2012/02/02/tdl4-reloaded-purple-haze-all-in-my-brain
-
The first interesting discovery is that the dropper downloads and executes a legitimate Adobe Flash Player installer to be launched in the context of the “trusted” application. In the November of the last year Win32/Sirefef (ZeroAccess) used the same technique to implement a DLL hijacking attack with the msimg32.dll module.
This time TDL4 uses the ncrypt.dll module for implementing the attack and to install a bootkit on the system with trusted process privileges. We wonder how long this bug will be on our tail?
Vive la série Jimi Hendrix ..... Que du bonheur :AAG