Symantec has a nice writeup on this, it is a few months old, but a new variant appears to be running around now.
Now from an identification prospective, DHCP fingerprinting comes in quite nicely here! I was able to get someone to send me a packet capture of DHCP Offers and ACKs from an infected machine on the latest variant. I'd like to get a few others also, but have not had a chance to look into it much due to other projects and work.
I'll be adding the fingerprint into the dhcp.xml file here shortly, assuming time permits. If anyone has packet captures from other variants of this trojan, or others that are doing dhcp offers/acks, please email them to me.
Subscribe To
Posts
Comments
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment