Sykipot Trojan takes advantage of Adobe Reader zero-day flaw
Posted on 13.12.2011
AlienVault Labs researchers have unearthed a piece of malware that takes advantage of the recently discovered zero-day Adobe Reader flaw used for attacking defense contractors.

The malware in question is the Sykipot Trojan, which has been found abusing various zero-day vulnerabilities in the past.

According to the researchers, the attackers misuse the flaw to make the target computer download the malware, which then searches for outlook, iexplore or firefox in the list of running processes. Once it has found them, it injects DLL files into them.

After that, the malicious binary creates a PDF file that apparently contains “CONUS rates” for traveling expenses in the continental US (click on the screenshot to enlarge it):



"The injected DLL will contact XXXhksrv.hostdefence.net/asp/kys_allow_get.asp?name=getkys.kys to download an encrypted configuration file," explain the researchers. "This file contains several commands that the victim will execute on the sending the results back to the C&C server."

The hostdefence.net domain on which the C&C server is hosted is located in China.






Spotlight

Infographic: 25 years of the firewall

Posted on 24 July 2014.  |  The firewall turned 25, and McAfee is celebrating with an infographic that creatively depicts its lifetime. If you take a moment to scan the infographic, you’ll notice the firewall's introduction and evolution coincide with certain security events.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Jul 25th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //