[Alex]

Two days ago ESET (TDSS and hacking the hackers) published a tool called TdlFsReader.exe, the tool contains signed drivers which allow to dump TDL's files...

[EP_X0FF]

A little bit (just little - two years) too late. So this reader is just another attempt to do some PR on that rootkit.

[markusg]

dll.exe
http://www.virustotal.com/file-scan/rep ... 1307633271

[EP_X0FF]

dll.exe
http://www.virustotal.com/file-scan/rep ... 1307633271

[main]
version=0.03
aid=30041
sid=0
builddate=351
rnd=515967899
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://lo4undreyk.com/;hxxps://sh01cilewk.com/;hxxps://cap01tchaa.com/;hxxps://kur1k0nona.com/;hxxps://u101mnay2k.com/
wsrv=hxxp://gnarenyawr.com/;hxxp://rinderwayr.com/;hxxp://jukdoout0.com/;hxxp://swltcho0.com/;hxxp://ranmjyuke.com/
psrv=hxxp://crj71ki813ck.com/
version=0.175

the same as few previous.

[dphrag]

Has anyone tested those latest samples on x64 vms ?

[EP_X0FF]

Some fresh TDL4 for collection

[main]
version=0.03
aid=30198
sid=0
builddate=351
rnd=220523388
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://lo4undreyk.com/;hxxps://sh01cilewk.com/;hxxps://cap01tchaa.com/;hxxps://kur1k0nona.com/;hxxps://u101mnay2k.com/
wsrv=hxxp://gnarenyawr.com/;hxxp://rinderwayr.com/;hxxp://jukdoout0.com/;hxxp://swltcho0.com/;hxxp://ranmjyuke.com/
psrv=hxxp://crj71ki813ck.com/
version=0.175

Unpacked dropper also attached.

original http://www.virustotal.com/file-scan/rep ... 1308277187
unpacked http://www.virustotal.com/file-scan/rep ... 1308276205

[gjf]

TDL4 - Top Bot

[EP_X0FF]

Attached recent TDL4 dropper with updated cmd.dll

[main]
version=0.03
aid=40787
sid=0
builddate=351
installdate=1.7.2011 2:26:34
rnd=2709195991
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://4tag16ag100.com/;hxxps://zna61udha01.com/;hxxps://dg6a51ja813.com/;hxxps://7gaur15eb71.com/;hxxps://ka18i7gah10.com/
wsrv=hxxp://bangl24nj14.com/;hxxp://lkeopee32.com/;hxxp://63.223.106.16/;hxxp://63.223.106.17/;hxxp://iau71nag001.com/;hxxp://baj19kall10.com/
psrv=hxxp://cikh71ynks66.com/;hxxp://clkh71yhks66.com/
version=0.24

All in attach.

[rkhunter]

Another article about TDL4 research: http://danuxx.blogspot.com/2011/03/tdss ... art-1.html

[rkhunter]

Matrosov wrote in Twitter that ESET update info about TDL botnet - http://www.eset.com/us/resources/white- ... of_TDL.pdf
=)