Full Disclosure mailing list archives
Re: Multiple 0-days in Dark Comet RAT
From: Valdis.Kletnieks () vt edu
Date: Thu, 18 Oct 2012 20:55:06 -0400
On Fri, 19 Oct 2012 03:22:04 +0330, kaveh ghaemmaghami said:
I appreciate his analyze coz if somebody gets pwn in my network i don't have to spend time for reversing and analyzing this malware .
No, if you find one of these in your network, it means you have *bigger* problems that you *do* need to spend time on. The exploit is against the C&C (Command and Control) server, *not* the bot end. In other words - if you find this one on your net, it means somebody has been *controlling* a botnet from a host on your net. Just a tad more serious than just finding a botted host.
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Multiple 0-days in Dark Comet RAT, (continued)
- Re: Multiple 0-days in Dark Comet RAT Philip Whitehouse (Oct 10)
- Re: Multiple 0-days in Dark Comet RAT Thor (Hammer of God) (Oct 10)
- Re: Multiple 0-days in Dark Comet RAT Pascal Ernster (Oct 11)
- Re: Multiple 0-days in Dark Comet RAT Valdis . Kletnieks (Oct 11)
- Re: Multiple 0-days in Dark Comet RAT Gage Bystrom (Oct 11)
- Re: Multiple 0-days in Dark Comet RAT Julius Kivimäki (Oct 11)
- Re: Multiple 0-days in Dark Comet RAT Hertz, Jesse (Oct 14)
- Re: Multiple 0-days in Dark Comet RAT Valdis . Kletnieks (Oct 15)
- Re: Multiple 0-days in Dark Comet RAT Hertz, Jesse (Oct 17)
- Re: Multiple 0-days in Dark Comet RAT Philip Whitehouse (Oct 10)
- Re: Multiple 0-days in Dark Comet RAT Valdis . Kletnieks (Oct 18)