UPDATE: The tool „Detekt“: what you should know about it
As reported, the recently launched tool “Detekt” is a tool to detect nation-state spyware by performing in-memory scans with the help of static Yara rules. G DATA appreciates the approach to raise awareness against spyware, but looking at the technical realization of the tool, we have to say that it…
The tool „Detekt“: what you should know about it
Amnesty International, Digitale Gesellschaft, Electronic Frontier Foundation and Privacy International jointly launched a tool named "Detekt". Primarily, they wish to raise awareness about spying actions against computer users and especially against activists and journalists. The tool is designed…
COM Object hijacking: the discreet way of persistence
G DATA SecurityLabs experts discovered a new Remote Administration Tool, which we dubbed COMpfun. This RAT supports 32-bit and 64-bit Windows versions, up to the Windows 8 operating system. The features are rather common for today’s espionage tools: file management (download and upload), screenshot…
New FrameworkPOS variant exfiltrates data via DNS requests
Between April and September 2014, the American retailer Home Depot was targeted by criminals who aimed to steal credit card information. The malware used during these attacks targets Point of Sale systems. Home Depot said that the cyber criminals stole 56 million of debit and credit card numbers…
Poweliks: the persistent malware without a file
When security researchers talk about malware, they usually refer to files stored on a computer system, which intends to damage a device or steal sensitive data from it. Those files can be scanned by AV engines and can be handled in a classic way. The following analysis is an example of malware which…
G DATA Malware Report July - December 2013
G DATA’s Malware Report H2 2013 includes the most important statistics and information regarding new malware types, websites’ threat potential as well as botnet and banking Trojan activities. Check out the essential facts.
Analysis of Uroburos, using WinDbg
Uroburos was already described as a very sophisticated and highly complex malware in our G DATA Red Paper, where we had a look at the malware’s behavior. This malware belongs to a specific type called rootkit. The general purpose of a rootkit is to modify the behavior of the system and, especially,…
If misused, legitimate tool phishes for Windows credentials
Windows user credentials are a valuable good, especially when it comes to attacking a company: Sneaking onto the computer of an employee is one thing, but being able to impersonate this employee and to use all his/her permissions within the company network is another, an even higher, threat level! A…
Uroburos – Deeper travel into kernel protection mitigation
Uroburos was already described as a very sophisticated and highly complex malware in our G Data Red Paper, where we had a look at the malware’s behavior. This assumption is again supported, looking at its installation process. Uroburos uses a technique not previously known to the public to bypass…
Uroburos - highly complex espionage software with Russian roots
G Data Security experts have analyzed a very complex and sophisticated piece of malware, designed to steal confidential data. G Data refers to it as Uroburos, in correspondence with a string found in the malware's code and following an ancient symbol depicting a serpent or dragon eating its own…
Karsten Hahn
Virus Analyst
Tim Berghoff
Security Evangelist
