TDL-4

Google announced it was suing two Russian men allegedly responsible for operating the Glupteba botnet, a global malware menace that has infected millions of computers over the past decade.

TDSS scans the registry, searches for specific file names, denylists the addresses of the command and control centers of other botnets and prevents victim machines from contacting them.

Just like Sinowal, TDL-4 is a bootkit, which means that it infects the MBR in order to launch itself, thus ensuring that malicious code will run prior to operating system start.

TDSS (a.k.a TDL-4 and Alureon), a stealthy “rootkit” that installs deep within infected PCs and loads even before the underlying Windows operating system boots up.

To prevent other malicious programs not associated with TDL from attracting the attention of users of the infected machine, TDL-4 can now delete them.

Just like Sinowal, TDL-4 is a bootkit, which means that it infects the MBR in order to launch itself, thus ensuring that malicious code will run prior to operating system start.

TDSS scans the registry, searches for specific file names, denylists the addresses of the command and control centers of other botnets and prevents victim machines from contacting them.

This module facilitates communication with the botnet command and control servers and substitutes search results, i.e. fraudulently manipulates advertising systems and search engines.

affiliate programs offer a TDL distribution client that checks the version of the operating system on a victim machine and then downloads TDL-4 to the computer.

The kad.dll module then sends a request to the Kad network to search for the ktzerules file.

This module facilitates communication with the botnet command and control servers and substitutes search results, i.e. fraudulently manipulates advertising systems and search engines.

A file called Socks.dll has been added to TDSS’s svchost.exe; it is used to establish a proxy server on an infected computer.

TDSS uses a public P2P network in order to transmit commands to all infected computers in the botnet.

As before, affiliate programs offer a TDL distribution client that checks the version of the operating system on a victim machine and then downloads TDL-4 to the computer.

The source request is encrypted and then converted to base64. Random strings in base64 are prepended and appended to the received message.

One of the key changes in TDL-4 compared to previous versions is an updated algorithm encrypting the protocol used for communication between infected computers and botnet command and control servers... The source request is encrypted and then converted to base64... the request is sent to the server using HTTPS.